The Department of Homeland Security is looking for tools to help the law enforcement community better pull forensic evidence from solid state drives found in smartphones and GPS devices in particular.
The security agency said the popularity of solid state storage, and specifically solid state drives (SSD), in laptops, netbooks, cellphones and other portable devices, is presenting challenging problems for law enforcement forensic investigators. "Traditional forensic approaches utilizing write-blocking tools to image a magnetic hard drive, do not effectively translate to investigations involving NAND flash memory-based SSDs," DHS stated.
Specifically the tools DHS is looking for "should consider direct interface with the SSD controller, the controller-driven process of wear leveling, solid state manufacturer specific garbage collection, and the increasing use of the TRIM command[used to tap into solid states drives]."
Any contracts DHS ultimately awards for the forensic technology will include the following developmental phases:
PHAZE I: Law enforcement investigators require the ability to pull evidence from SSDs in a more reliable and forensically sound manner. This will require research into methodologies for imaging and parsing of data from SSDs, particularly those utilizing the TRIM command on TRIM-enabled operating systems (OS). Research methodologies should consider the significance of the OS, any techniques for identifying tampered controllers, and the potential ability to perform user-driven data recovery operations to overcome corruption or damage. The potential future state of integrated, on-board SSS, without a separate drive, in consumer devices may also be considered in this research. The Phase I deliverable should be a method for a comprehensive memory parser for SSDs.
PHASE II: Utilizing the methodology established in Phase I, demonstrate and implement hardware and software applications for development of a comprehensive, forensically sound imaging and parsing tool that is reproducible across multiple SSDs. The tool should be developed for law enforcement and forensic examiner use and, where possible, should utilize or be delivered as, open source technology.
PHASE III: The final developed tools will be marketable to a wide variety of Federal, State, and local law enforcement agencies. It is anticipated that those tools will require support, custom extensions, and additional applications as technologies are commercially introduced.
Layer 8 Extra
Check out these other hot stories: