Solid State Drive Forensics

Michael Lawson


Supervised by Michael Daley; Moderated by Kirill Sidorov

When imaging SSD's they often spend a long time on the system powered up, has the potential to end up with unallocated clusters being zero'ed out. This project will look into who or what is controlling this and what can be done to minimise the loss of data when acquiring this image. Real world trials on different chipsets and or come up with a best practice for capturing data or even the likelihood of the MD5 changing whilst power applied to it. This project is an oppoutunity to collaborate with Gwent police.

Initial Plan (05/02/2018) [Zip Archive]

Final Report (11/05/2018) [Zip Archive]

Publication Form