Forensic Acqusition of Solid State Storage Devices
Solid state drives (SSD) suffer from data modification issues caused by internal influences such as those caused by manufacturer implemented
functionality designed to increase product life and maintain performance. The purpose of the proposed innovation is to address these issues to provide
the capability of acquiring a full forensic data copy while maintaining the forensic integrity of the subject SSD. The solution will be software and
firmware based and will not require physical modification of the SSD.
Work will include the research and implementation of a method of leveraging manufacturer based commands in order to attain forensic level access to
the flash memory. Drive controller firmware research and modification will also be performed with the goal of providing similar forensic level access
as well as write-protection of the device interface. An application suite providing a user interface to the proposed functionality as well as a method of
reassembling physical memory images into a standard, logical format will also be developed. The output of the reassembly software will be compatible
with existing analysis tools.
Completion of Phase I and Phase II efforts will result in a comprehensive suite of software and firmware tools capable of retrieving data from SSD
drives in a complete and forensically sound manner without physical drive modification.
Commercial applications resulting from research and development efforts include a forensic quality SSD image acquisition toolkit for lab or field use,
an SSD drive and flash chip data recovery toolkit, and an SSD drive and flash chip data destruction toolkit.
Small Business Information at Submission:
CPR Tools Inc.
730 East Cowboy Way LaBelle, FL 33935-4483
Number of Employees: