HDD vs SSD

File writing

On HDD.

• it is possible to read and change the information in a specific sector.

• reading specific sectors is common in digital investigation.

On SSD.

• when a file is modified it is not possible to save it in the same sector.

• because it is not possible to write into cells before erasing them.

• the file is saved into a new empty sector and the original one goes to the garbage collection list.

• the old sector is erased only when all sectors in the same block are freed.

File erasing

SSD erasing and wear leveling mechanisms consequences:

• when we ask the OS to delete, the data is not deleted, it goes to the garbage collection list.

• only a few flags change.

• it is effectively deleted only when the erase routine is executed by the garbage collection algorithm.

  • for example: 1 block of 64 sectors × 2048 B = 128 kB.

• the physical location of a sector changes over time → this is a problem for data acquisition at the physical level.

• even without an OS commanding, garbage collection operations can happen (power on is enough).

  • a write blocker does not prevent garbage collection or wear leveling operations.

  • this limits the availability of “deleted” or interesting slack data.