Chapter 9 — Exercises
A mix of concept checks, hands-on labs (check TRIM status without touching the evidence, recover from an SD-card image, run the zero-block triage, calculate and verify a hash, write the report paragraph), and judgment calls where the right answer is sometimes "the data is gone — stop." Work them in order: the early groups build the mental model of the controller as a small computer, the middle groups train your hands on diagnosis and recovery, and the last groups train the harder skill — telling a client the truth about flash, fast. (answer in Appendix) marks problems with a worked solution in Answers. ⭐ marks a stretch problem. Labs that say "use a practice image" point to the datasets in Appendix J — Practice Images and Lab Setup — never practice on a client's only copy, and on flash, never "test by using" the evidence drive at all.
Group A — Why flash is not a small hard drive
9.1 The hard-drive mental model — "logical sector N is always physical location N, and reading it returns whatever was last written there" — is false for an SSD at the physical level. Name the three NAND-and-controller facts that break it, and for each give one concrete recovery consequence. (answer in Appendix)
9.2 NAND is read and programmed (written) at page granularity but erased only at block granularity, and a page cannot be reprogrammed in place. Assume a 16 KB page and a 256-page (4 MB) block. (a) Walk through what the controller physically does when the OS says "overwrite LBA 5,000,012." (b) What happens to the page that previously held that LBA? (c) Name the indirection that makes all of this possible, and explain in one sentence why it is not an optimization the controller could choose to skip. (d) This same asymmetry is the origin of write amplification — explain in one sentence why a single small host write can cost the drive far more than one page of actual NAND wear, and why that matters when you read a drive's lifetime "bytes written" to gauge how much overwriting it has done.
9.3 Rank the four cell types — SLC, MLC, TLC, QLC — from easiest to hardest to reconstruct from a raw chip-off dump, and state the approximate P/E-cycle endurance of each. Then explain the physical reason that "more bits per cell" produces a noisier, error-laden raw dump that is harder to read at the silicon level. Which cell types dominate the cheap consumer drives and memory cards a shop sees most often?
9.4 ⭐ The Flash Translation Layer's logical-to-physical (L2P) map has three properties that drive every recovery decision: it decouples logical order from physical order completely, it is the single point of failure, and its churn leaves ghosts. For each property, give one recovery or forensic implication — and for the third, explain how a "ghost" can hand a forensic examiner a prior version of a document the suspect believed was overwritten.
Group B — TRIM, garbage collection, and the recovery window
9.5 State the single most important question in any SSD recovery job and the second most important. Then define TRIM and name its SCSI and NVMe equivalents. Explain, before TRIM existed, why the controller had no way to know a deleted file's blocks were free, and why that hurt performance on a nearly full drive. (answer in Appendix)
9.6 A drive advertises one of three post-TRIM read behaviors. For each — non-deterministic TRIM, DRAT (Deterministic Read After TRIM), and RZAT (Deterministic Read Zero After TRIM) — state what a read of a trimmed-but-not-yet-erased LBA returns, and whether the case is recovery-friendly or recovery-hostile. Which one is the default behavior of most modern consumer and enterprise SSDs?
9.7 Reproduce the destruction sequence for a deleted file on an RZAT drive, from "file deleted in NTFS" to "charge physically drained from the NAND." (a) At which step does a host-side software tool start returning zeros for that range? (b) Why does that step precede the physical erase? (c) The chapter says chip-off can occasionally beat software here but you cannot rely on it — explain both halves of that sentence.
9.8 ⭐ Garbage collection runs autonomously whenever the drive is powered and not too busy — even with no host commands at all, and even behind a hardware write blocker. (a) Explain why a write blocker does not stop GC. (b) State the consequence for recovery (what is the "clock" on the recoverable ghosts of deleted data?). (c) State the consequence for forensics (why can two images of the same drive, minutes apart, differ?).
9.9 List the situations in which TRIM did not reach the deleted data, so the SSD behaves like a hard drive and recovery is realistic. For each, give the one-sentence reason TRIM never fired: (a) the seconds immediately after deletion; (b) TRIM disabled at the OS; (c) external/USB-bridged SSDs; (d) hardware-RAID members; (e) legacy operating systems; (f) SD cards and camera media. Then, for each scenario, name the single cheap check you would run to confirm it before you rely on it (for example, what one command confirms (b), and what one command confirms that the bridge in (c) really drops TRIM?), and rank the six from the most to the least dependable recovery prospect, justifying your top and bottom choices.
Group C — Diagnose before you promise (hands-on triage)
9.10 Lab — interpret tool output. You connect a client's SATA SSD through a write blocker and, without trimming it yourself, query its capabilities. The drive presented through the client's external USB-SATA bridge; you also queried the bridge's discard support: (answer in Appendix)
$ sudo hdparm -I /dev/sda | grep -iE 'model|trim'
Model Number: Samsung SSD 870 EVO 1TB
* Data Set Management TRIM supported (limit 8 blocks)
* Deterministic read ZEROs after TRIM
$ lsblk --discard
NAME DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO
sda 0 0B 0B 0
(a) Is this drive RZAT, DRAT, or non-deterministic, and what does that imply if TRIM reached the deleted range? (b) What does DISC-GRAN 0B tell you about the path the drive came in on? (c) The client deleted the target files three days ago while the drive lived in this USB enclosure. Put (a) and (b) together: is the prognosis hopeful or hopeless, and why?
9.11 Lab — Windows, no third-party tools. Write the commands to determine, without writing to the evidence, (1) whether the OS was issuing TRIM (delete-notification) and (2) the media type and health of each attached disk. Then interpret this returned output and state what you tell the client before touching anything:
NTFS DisableDeleteNotify = 0 (Enabled)
FriendlyName MediaType HealthStatus GB
------------ --------- ------------ ----
Samsung SSD 980 1TB SSD Healthy 931
9.12 Name the two commands — one Linux, one Windows/PowerShell — that the chapter lists only so you recognize and never run them on evidence, say exactly what each one does, and explain why running either against a case drive is the destruction, not the diagnosis.
9.13 ⭐ Lab — NVMe endurance. You pull SMART/health data from a 1 TB NVMe SSD that holds files a client deleted last week:
$ sudo smartctl -a /dev/nvme0
Percentage Used: 61%
Data Units Written: 3,114,884,096 [1.59 PB]
Available Spare: 82%
(a) Roughly how heavily has this drive been written over its life, and what does that imply about how much garbage collection and physical overwriting it has done? (b) Combined with a confirmed RZAT determinism flag and enabled OS TRIM, does the heavy write history make recovery of last week's deletion more or less likely? (c) Why is wear/TBW a useful secondary signal even though TRIM status is the primary one?
Group D — Recovery when TRIM hasn't won (labs)
9.14 Lab — recover from this image. Using the "reformatted-camera-card" practice image from Appendix J (an exFAT SDXC card reformatted in camera): (a) image it through a card reader behind a write blocker with dcfldd, writing a hash log; (b) carve it for JPEG and camera-raw signatures with photorec; (c) report how many files came back and spot-check one carved JPEG's header bytes to confirm a valid FF D8 FF start with an Exif or JFIF marker. Then answer the conceptual core: why does an in-camera reformat of exFAT leave the prior photo clusters fully carvable, even three weeks later? (answer in Appendix)
9.15 Lab — run the zero-block triage. Run the chapter's trim_triage.py (or your own equivalent) against two acquired images: the camera-card image from 9.14 and the "laptop-NVMe-after-TRIM" practice image. (a) Report the all-zero percentage for each. (b) The NVMe image reads ~78% zeros; explain why that number is a fingerprint of RZAT-plus-TRIM rather than proof on its own (what else reads as all zeros?). (c) Why does the script also flag high-entropy blocks, and what would a large high-entropy fraction suggest about the drive?
9.16 Lab — calculate and verify the hash. After imaging the camera card to sdcard.dd, compute its SHA-256 (sha256sum sdcard.dd or hashdeep -c sha256), record it, copy the image to your analysis workstation, and re-hash to confirm a clean transfer. Now answer the part that matters on flash: this hash certifies what, exactly? Contrast the card — which sits inert and hashes identically every time — with a powered laptop SSD, where a full-image hash taken twice may differ. What is different about the two media, and which artifact remains hashable-and-stable on both? Finally, write the one hashdeep -r -c sha256 (or md5deep) command you would run to produce a per-file manifest of the recovered evidence, and explain in one sentence why that manifest is the integrity record that survives an SSD's full-image non-determinism even when a whole-drive hash does not.
9.17 "Image first — and image fast" is presented as a discipline unique to flash. (a) On a hard drive, why can you take your time imaging? (b) On an SSD, what specifically is the clock, and why does every powered minute reduce your yield? (c) Restate, in one sentence each, why "let me just check if it mounts" and "leave it connected so it's ready" are both errors on an SSD that would be harmless on an HDD. (d) The War Story describes a technician who plugged a client's SSD into a running Windows workstation "to see if it even mounts." Trace the exact chain of events from that plug-in to the data being gone an hour later — naming each actor (the OS, the file system's view of free space, the TRIM command, the controller) — and state the one rule that, followed, would have prevented all of it.
9.18 ⭐ Lab — the bridge discipline. A portable SSD's deleted data survived only because its cheap USB-to-SATA bridge never passed TRIM. (a) Explain why you should image it through that same bridge (or a known non-TRIM path) rather than shucking the bare drive into a faster, modern UASP adapter. (b) What might a modern UASP enclosure do on connection that the old bridge never did? (c) Generalize the rule into one sentence about the path that preserved the data versus the path that acquires it.
Group E — Controller failure, chip-off, and monolithic flash
9.19 The controller is dead — the drive is undetected, reports zero capacity, or is stuck in a vendor safe mode — but the NAND is intact. (a) Why is controller-level repair (e.g., PC-3000 SSD talking to the drive in factory/technological mode) the correct first move rather than reaching for the soldering iron? (b) What does such a repair actually do to bring the drive back? (c) Name the HDD analog of this failure from Chapter 8, and the one way the SSD case is harder to fix by hand. (answer in Appendix)
9.20 A NAND reader has clocked out a raw dump that looks like high-entropy noise. List, in order, the five transformations you must reverse to turn that dump into a mountable file-system image, with one line on what each does: ECC correction, de-scrambling (de-randomization), de-XOR, de-interleaving, and reconstructing the translator (L2P). (a) Which two of these are the reason the tools that do this "cost what a car costs"? (b) Where does the OOB/spare region come into the process, and what two kinds of information does it hold that you need? (c) A reconstruction session reports "11,318 pages corrected, 4 uncorrectable" and "47 holes." Explain what an uncorrectable page is, why holes are normal rather than a sign you did something wrong, and when those holes do versus do not matter to the client.
9.21 The encryption wall. (a) Explain why a flawless chip-off of a self-encrypting drive (SED) yields a perfect image of ciphertext that is worthless. (b) Where does the key live, and what happens to recoverability if the controller that holds it is dead? (c) What is "instant secure erase" / crypto-erase, and why is it the fastest, most complete destruction in this book? (d) State the one-sentence rule about what you must determine before you desolder anything.
9.22 ⭐ Monolithic flash. (a) Why can you not "desolder the NAND" from a typical USB thumb drive or microSD card? (b) Define technological points and describe how a specialist reads the raw NAND through a monolith's package. (c) Contrast this with eMMC/UFS storage in phones and tablets: what standardized access (name two test-point methods) sometimes lets you read the raw flash without desoldering — and what modern feature increasingly turns even a successful raw dump into ciphertext? (Cross-reference Chapter 11 — Mobile Device Recovery.)
Group F — The forensic problem: non-determinism, hashing, and limits
9.23 Two forensic images of the same SSD, taken minutes apart, produce different SHA-256 hashes, and no one tampered with anything. (a) Explain the mechanism. (b) Name the 2010 paper that named this problem for the field. (c) List the four professional responses (acquire immediately/minimize powered time; write-block anyway; hash file-resident data separately; document the medium's behavior) and say, for each, what it buys you. (answer in Appendix)
9.24 A defense attorney confronts you on the stand: "Your own tools say the drive is different from what you seized. How can you ask the jury to trust any of your analysis?" Write the two-to-three-sentence answer you would give. Then explain why hiding a hash mismatch you understand is misconduct, while being surprised by it on the stand is incompetence — and why the time to address it is in your notes and report, before cross-examination. As a final step, list the three facts you would record in your contemporaneous notes the moment you recognize an exhibit is solid-state, so that the explanation you give months later is backed by documentation rather than memory.
9.25 The chapter says the files themselves — the data the file system still references — do not change under garbage collection, while the unallocated and stale regions do. (a) Explain why that is true. (b) Why does per-file hashing of the live evidence therefore remain stable and provable even when the full-drive image hash does not? (c) How does this distinction let you give a court a defensible integrity argument despite a full-image hash mismatch?
9.26 ⭐ Judgment — the "absence of evidence" finding. A suspect's laptop is an RZAT NVMe SSD; whatever the suspect deleted before the OS trimmed it is genuinely unrecoverable. (a) Write the finding that distinguishes "we did not find such files" from "such files, if they existed, cannot be recovered because the device erased them," in plain, non-overclaiming language. (b) Explain why, on this medium, the absence of recovered files proves nothing about whether they once existed. (c) Connect both to theme #5 (know your limitations) — why is "the evidence is insufficient to reach a conclusion" a complete, professional finding here rather than a failure?
Group G — Economics, reporting, and the Progressive Project
9.27 A client brings in a 1 TB laptop NVMe SSD: a project folder deleted three days ago, Recycle Bin emptied. Your diagnostics show DisableDeleteNotify = 0 (TRIM was on) and the namespace reports read-zero-after-deallocate (RZAT). The client has heard that "chip-off can recover anything" and wants to pay $1,500 for it. (a) What do you tell them, and why? (b) What would a chip-off actually return in this case, and why? (c) Explain why the professional act here is the conversation you have on day one, not the work you could bill for. (answer in Appendix)
9.28 Write the report. Draft the short paragraph you would include in a forensic report for an SSD evidence item, stating plainly that the device is solid-state, that SSDs perform autonomous internal operations that can alter unallocated areas independent of host activity, that this is an inherent property of the technology and not a sign of tampering, and that your acquisition minimized and accounted for it. Make it the paragraph that, as the chapter puts it, makes you "credible" because you raised it before the cross-examiner did. (See Chapter 26 — The Forensic Report.)
9.29 ⭐ Progressive Project — account for the medium in your case file. Add all four elements the chapter specifies to your Forensic Case File: (1) identify and document the subject medium, including its TRIM determinism (RZAT/DRAT/non-deterministic) and whether it is self-encrypting, plus the host's TRIM configuration; (2) record your write-blocked, minimal-powered-time acquisition with power-on and power-off timestamps in the chain-of-custody record, and the acquisition hashes; (3) if your practice image supports it, acquire twice, compare full-image hashes, and write the paragraph explaining why a mismatch would not indicate tampering — then hash the file-resident evidence separately and note its stability; (4) add a finding that distinguishes recoverable deleted data from what TRIM may have rendered unrecoverable. File it where it will fold into the report (Chapter 26) and the capstone (Chapter 38).
9.30 Judgment and the human cost. In the same week, two clients lose irreplaceable files: one reformatted a camera's SD card; the other deleted a folder from a laptop NVMe SSD and emptied the Recycle Bin two days ago. The card is recoverable; the laptop is not. (a) Script, in plain language, how you deliver opposite verdicts for the same kind of mistake — without making the card client think you are a miracle worker or the laptop client think you did not try. (b) What is the actual service you provide in the "no"? (c) How do you pivot, gently, to the prevention lesson (backups, and pulling power immediately next time before the OS trims) so the next irreplaceable thing they own is never in this position? (d) The laptop client, desperate, asks you to "just try the chip-off anyway — I'll pay whatever it costs." Write the response that declines the work as a kindness, and explain why taking the money would be unethical even though the client has consented and the lab would profit.
Self-check. You have mastered this chapter when, before you quote or promise anything, your first two questions are was TRIM issued against this data? and is this drive encrypted? — when you can read a drive's determinism flags and the host's TRIM configuration and know in seconds which kind of case you are in — when you image flash fast and never "just check if it mounts" — and when you can explain a benign full-image hash mismatch to a court before the cross-examiner weaponizes it. Above all, you can say "the data cannot be recovered because the device erased it" or "the evidence is insufficient" plainly and early, and know that doing so is professional, not failure. Carry the dual lens forward: Chapter 10 takes the single device into the array, where the TRIM behavior you just learned changes how an SSD-backed RAID fails and recovers.