The differences between SSD and HDD technology regarding forensic investigations

Abstract: In the past years solid state disks have developed drastically and are now gaining increased popularity compared to conventional hard drives. While hard disk drives work predictable, transparent SSD routines work in the background without the user’s knowledge. This work describes the changes to the everyday life for forensic specialists; a forensic investigation includes data recovery and the gathering of a digital image of each acquired memory that provides proof of integrity through a checksum. Due to the internal routines, which cannot be stopped, checksums are falsified. Therefore the images cannot prove integrity of evidence anymore. The report proves the inconsistence of checksums of SSD and shows the differences in data recovery through high recovery rates on hard disk drives while SSD drives scored no recovery or very poor rates.