A quiet revolution in the take-up of solid state disks for enterprise and government storage could have disastrous consequences for the use of digital evidence in court, according to a new paper published by researchers at Murdoch University in Perth.

The findings of forensic specialists Graeme B. Bell and Richard Boddington, recently made available online HERE, allege that “solid-state drives (SSDs) have the capacity to destroy evidence catastrophically under their own volition, in the absence of specific instructions to do so from a computer.”

According to the authors, “The results found in this paper may have significant implications for legal matters involving digital evidence, most especially in those cases where digital data is alleged to have been deleted intentionally or deliberately permanently wiped by a defendant.

“Given the pace of development in SSD memory and controller technology, and the increasingly proliferation of manufacturers, drives, and firmware versions, it will probably never be possible to remove or narrow this new grey area within the forensic and legal domain. It seems possible that the golden age for forensic recovery and analysis of deleted data and deleted metadata may now be ending.”

The authors point out that the while most are aware of the transition from portable magnetic floppy discs to portable USB transistor flash devices, the transition from magnetic hard drives to solid-state drives inside modern computers has so far attracted very little attention from the research community.

Their paper is dedicated to showingconventional assumptions about the behaviour of storage media are “no longer valid” with SSDs.

“In particular, we demonstrate that modern storage devices can operate under their own volition in the absence of computer instructions. Such operations are highly destructive of traditionally recoverable data. This can contaminate evidence; can obfuscate and make validation of digital evidence reports difficult; can complicate the process of live and dead analysis recovery; and can complicate and frustrate the post recovery forensic analysis.”