Empirical analysis of solid state disk data retention when used with contemporary operating systems

TLDR

Data recovery for traditional platter drives has remained largely unchanged, while SSDs differ in storage and recall mechanisms and require special care, and garbage‑collection implementations vary, affecting data retention. The study aims to analyze SSD data retention and examine how the ATA8‑TRIM command influences forensic recovery. The analysis is based on empirical evidence collected from 16 different SSDs. The experiment found that without TRIM nearly all data could be recovered, whereas with TRIM enabled only up to 27% of blocks were recoverable, varying by controller manufacturer.

Abstract

Data recovery techniques for platter-based disk drives have remained rather static due to the dominance of the hard disk for the last two decades. Solid State Disk drives have differing storage and recall functionality from platter-based disks and require special care when attempting data recovery. Manufacturers have varying implementations of garbage collection in each drive, which affects the amount of data retained on the disk. This paper presents an analysis of solid state disk data retention based off of empirical evidence of 16 different disks. It also discusses the data recovery problem faced by forensic examiners due to the ATA8 TRIM command, which can sanitize disks in seconds. The experiment shows that without TRIM, nearly all data is recoverable, but with TRIM enabled only up to 27% of blocks were recoverable dependent on the controller manufacturer.