The retention characteristics of magnetic media have been outlined:
- Storage devices should be considered as networked computer systems in their own right
- Their external interface will provide a purely logical view of their internal organisation of physical on-disk storage
Knowledge and the ability to access the low-level interface of the storage device are important where media have been erased or overwritten by the operating system level:
• Such techniques can be employed even where relatively sophisticated counter-forensics mechanisms were used
In case of physical damage or where attempts at recovery must be made even for overwritten sectors, physical inspection of the storage medium may be needed:
- Data recovery up to spin stand analysis was described earlier for magnetic media
- Similar approaches can also be undertaken for optical media, here physically destroyed or erased media can also be partly reconstructed
Solid-State Memory Type - SRAM:
Static RAM uses bistabile latches to store each but and hence does not need a refresh cycle
• Data will still be lost when power is not applied, but battery-backup may be sufficient
• Speed is similar to dynamic RAM, but significantly more complex
• Used in caches for specialised purposes such as multi-ported Video RAM, displays and printers
• Of particular interest: Configuration memory, buffers
Solid-State Memory Type - EPROM:
Mainly of historic interest, programmable ROM based on floating-gate field-effect transistors programmed with higher voltage.
• Programmed data can persist for 10-20 years
• Erasing is accomplished by exposure to UV light
Solid-State Memory Type - EEPROM:
Electrically erasable programmable ROMs do not require UV exposure
• Originally a generic term, now used mainly referring to EEPROM that can be erased byte-wise as they have a separate erase transistor
• Used mainly for small configuration memories
• Data is retained for 10+ years
Solid-State Memory Type - FeRAM:
Ferroelectric RAM uses ferroelectric material to hold a magnetic charge
• Power is only consumed on reading and writing with similar levels
• Main advantages over e.g. Flash memory is fast write speed and lower power consumption
Solid-State Memory Type - MRAM:
Magnetoresistive RAM is also nonvolatile, a resistor has different resistances depending on magnetic layer directions
• While interesting in theory, it is still not deployed at larger scales
Ubiquitous variants of EEPROM storage also based on floating-gate transistors:
- Implementation can use standard fabrication equipment and materials
- Floating gates can have more than two voltage levels, allowing multi-level cells
- NAND and NOR variants
A NOR gate flash has one end of each cell connected to GND, the other to a bit line, acting as a NOR gate:
Elevating a word line voltage level results in output bit being pulled low by storage transistor
Default state for NOR cells is logical 1:
- Setting it to 0 requires elevated voltage to activate channel from source to drain
- Current is sufficiently high for electrons to jump the insulating layer onto the floating gate: Hot electron injection
Erasing a cell (setting it to 1) requires larger voltage of opposite polarity between control gate and source:
- Electrons are removed from the floating gate through quantum tunneling
- Unlike programming, this must occur in blocks
A NAND gate cell connects transistors in series:
- Only if all word lines are pulled HIGH, the bit lines is pulled low
- Groups are connected externally in array form
- Reading pulls all word lines for a bit high except one; if the bit is set, it is pulled low
NAND memory is more dense than NOR memory owing to smaller cell size
- This makes NAND memory preferable for storage
* Density of NAND at present is about 2x that of NOR memory as transistors can be in series, meaning less metal contacts
NAND memory has slower read times as cells are stacked:
- Where Flash memory is used for program memory storage, NOR memory is preferred as it has faster access times
- NAND memory always must be read and written in blocks
- NOR memory can be read in a random access pattern
NAND overwriting and erasing is generally faster than for NOR Flash memory:
- Both NAND and NOR cells have a limited number of programming and erasure cycles
- Typically around 100k cycles are supported
Code execution also differs as it requires random access patterns:
- NOR memory uses execute in place patterns
* NAND relies on Store and Download (SND) access, typically a combination of Dynamic or SDRAM and NAND flash memory
Feature sizes of Flash memory have only been shrinking modestly in recent years; instead manufacturers have focused on 3D structures:
- One of the most common problems of NAND memory are retention errors
- Arrhenius’ law shows how high temperature worsens effects: 2 hours at 100C are the equivalent of a year at 25C
Flash cells also use multiple voltage levels to store more than one bit per cell:
- This is also affected by temperature, but not every voltage level is affected in the same way
- Even the error behaviours of layers and word lines at higher temperatures differ
Naïve implementations of file systems intended for disks suffer from a number of drawbacks:
- Most dramatic is uneven use of storage locations
* Flash storage is also not built up in 512 byte blocks, but significantly larger blocks
Impact on File System Architecture:
- Flash storage built up in large blocks, e.g. 128kBytes
- Blocks are further divided into pages, e.g. 64 of 2 kBytes each
- To emulate magnetic disks, pages are further divided into 512-byte sector units
- Each page will have a data area and a spare area for memory management, e.g. 2kBytes and 16 bytes
- The spare area is not accessible directly and is used for error detection and administration
The properties of Flash memory require the use of a Flash Translation Layer (FTL):
- This translation can occur in the device itself to make it behave like a conventional magnetic disk, as is typically the case for pen drives
- Particularly for larger SSD and for embedded applications such as mobile phones, adaptation can also occur directly in the file system
The main tasks of Flash Translation Layer (FTL):
- Translation of storage area into smaller, virtual sectors/chunks
- Providing the appearance of writing in place despite wear levelling
- Performing wear levelling
To avoid the cost of erasing small files…
The file system uses a log structure - uses copy-on-write, with free space in large blocks written sequentially
-
Introduction to Forensic Science3
-
Digital Evidence14
-
Forensics Walk-Through16
-
Magnetic Storage Media, Volumes, and Encryption17
-
FAT File Systems14
-
Reconstructing FAT File System Structures29
-
Microsoft Windows Storage Architecture38
-
The Windows NTFS File System35
-
File and Volume Encryption11
-
Physical Storage Artefacts in Magnetic Media8
-
Nonvolatile Storage Forensics43
-
Microsoft Windows Kernel Architecture65
-
Introduction to Microsoft Windows Live Forensics17
-
Microsoft Windows Security Architecture35
-
Memory Acquisition and Forensics6
-
Firmware and Forensics0
-
Host-Based Network Forensics Sources0
-
Network-Component Forensic Information Collection0
-
Email Forensics0
-
Malware Concepts and Objectives0
-
Malware Infiltration Mechanisms0
-
Malware Exfiltration Mechanisms0
-
Malware Concealment and Detection Techniques0
-
Mobile Device Forensics Introduction0
-
Android Forensics Fundamentals0
-
iOS Forensics Fundamentals0
