Solid State Drives – Delete Does Mean Delete

Solid state drives are gaining in popularity in laptop computers and tablets. Compared to their hard disk drive counterparts, solid state drives are more expensive and offer less storage. However, they are much faster and lack the moving parts that can make HDDs prone to failure, particularly in mobile devices that experience a great deal of movement. Solid state drives also consume much less power, allowing portable devices to be used longer between charging.

As with any digital technology, as they move into the mainstream, the price of solid state drives will fall and the storage capacity will increase. It is expected that solid state drives will virtually replace conventional hard drives in portable devices within the next 3 to 5 years.

All of this sounds great, except when it comes to computer forensics. For years, computer forensic professionals have been claiming that “delete does not mean delete”. When you drag a file into the Windows recycle bin, or delete an email in Outlook, a computer forensic technician can usually recover it. This is because, when you “delete” a record on a computer, all that happens is that the record is hidden from view and is suitably marked so that sometime in the future, the computer can replace it with newer data.

Unlike conventional hard drives, solid state drives are little computers unto themselves. They insulate the main device from all the nitty gritty details about storing and retrieving information. Among other things, the solid state drive automatically purges deleted information after 30 to 60 minutes. This is done to reduce power consumption, as the power is directly related to how much data is stored on the drive. Unfortunately (from a computer forensics perspective) this means that when you “delete” a file or email, after an hour, it is permanently erased from the solid state drive.

Although most e-Discovery matters only involve active data, there are situations such as fraud or harassment, where deleted information may be important. The widespread use of solid state drives will make investigations such as these more difficult.

​For more information about the computer forensic implications of solid state drives, refer to the Journal of Digital Forensics, Security and Law, Volume 5, Number 3.