The suspect had used a standard software wipe. To the operating system, the drive looked like a desert of zeros. However, Leo was looking for the area—a hidden reservoir of storage cells that the SSD controller uses for its own maintenance.
This is a story about how the very features that make modern SSDs fast—like and background garbage collection —can become a security professional's biggest headache. The Phantom Files of Sector 42 ssd security
Leo knew that SSDs are "liars" by design. To prevent the memory cells from wearing out, a controller inside the drive constantly moves data around in the background—a process called . When you delete a file, the drive doesn't actually delete it; it just marks that space as "invalid" and moves on. The suspect had used a standard software wipe
Security and Forensics–Is Solid State Drive a Friend or a Foe? This is a story about how the very
If you want to ensure your data stays private, here are the industry-standard moves:
Leo, a senior digital forensics investigator, was staring at a "wiped" laptop. The suspect, a corporate spy, had reportedly performed a on the machine just minutes before the police arrived. On a traditional hard drive, a wipe is usually the end of the story—once the magnetic bits are overwritten, they’re gone.
"He thinks he's safe," Leo muttered, connecting the drive to a specialized hardware imager.