SSD
Solid State Drive
Halbleiterlaufwerk
An SSD stores data in flash memory cells without moving parts and is therefore faster and more robust than a magnetic hard disk. For forensics, however, it brings a catch: mechanisms such as TRIM and internal storage management can independently and quickly destroy deleted data permanently. This makes evidence preservation more demanding than with an Hard Disk Drive (HDD).
History & facts. Unlike on an Hard Disk Drive (HDD), deleted data often does not survive on an SSD: via the TRIM command the operating system reports released blocks, which the controller then independently clears to preserve write performance. In addition, the internal management (wear levelling) distributes data across the cells such that the logical and physical storage location diverge. Both considerably complicate the classic reconstruction of deleted content.
Outlook & recommendation. For forensics this means: time is critical, and the approach must account for SSD peculiarities — a connected, still-running drive can destroy data on its own. A prompt, methodically clean imaging with write protection is all the more important. Conversely, the same mechanics complicate the targeted, complete deletion of individual files, which is why for secure wiping of SSDs the vendor-side methods are authoritative.