Deconstruct and preserve (DaP): a method for the preservation of digital evidence on solid state drives (SSD)

Mitchell, Ian, Anandaraja, Tharmila, Hara, Sukhvinder, Hadzhinenov, George and Neilson, David (2017) Deconstruct and preserve (DaP): a method for the preservation of digital evidence on solid state drives (SSD). In: 11th International Conference on Global Security, Safety and Sustainability, 18-20 Jan 2017, Greenwich, London, England.

PDF - Final accepted version (with author's formatting)
Download (308kB) | Preview


Imaging SSDs is problematic due to TRIM commands and garbage collectors that make the SSD behave inconsistently over time. It is this inconsistency that can cause a difference between images taken of the SSD. These differences result in unmatched hash number gener-ation and would normally be attributed to contamination or spoliation of digital evidence. DaP is a proposed method that ensures all images taken of the SSD are consistent and removes the volatility normally as-sociated with these devices. DaP is not focused with the recoverability of deleted data, however DaP does stabilise the device to prevent uninten-tional contamination due to garbage collection. Experiments show that the DaP method works on a range of devices and consistently produces the hash-identical images. The conclusions are to consider DaP as a new Standard Operating Procedure (SOP) when imaging SSDs.

Item Type: Conference or Workshop Item (Paper)
Additional Information: Published as chapter in : Global Security, Safety and Sustainability - The Security Challenges of the Connected World, Volume 630 of the series Communications in Computer and Information Science, pp 3-11
Research Areas: A. > School of Science and Technology > Computer Science
Item ID: 20792
Notes on copyright: This is the author accepted manuscript version. The final publication is available at Springer via
Useful Links:
Depositing User: Ian Mitchell
Date Deposited: 25 Oct 2016 09:39
Last Modified: 02 Apr 2019 08:41

Actions (login required)

Edit Item Edit Item

Full text downloads (NB count will be zero if no full text documents are attached to the record)

Downloads per month over the past year