Security and Forensics–Is Solid State Drive a Friend or a Foe?
Leo knew that SSDs are "liars" by design. To prevent the memory cells from wearing out, a controller inside the drive constantly moves data around in the background—a process called . When you delete a file, the drive doesn't actually delete it; it just marks that space as "invalid" and moves on. ssd security
By bypassing the standard controller interface and talking directly to the NAND flash chips, Leo began to see the "ghosts" of the deleted files. Security and Forensics–Is Solid State Drive a Friend