O problema: os firmwares de discos SSD tem a capacidade de destruir evidência sem nenhuma instrução ou interferência do computador a que estão conectados. Mesmo utilizando bloqueadores de escrita que impedem a alteração de dados em discos rígidos tradicionais, os pesquisadores constataram que em poucos minutos o firmware de certos discos de estado sólido já altera o conteúdo (do espaço "não alocado" gravado nele).
O maior impacto desta realidade: A probabilidade de alteração dos dados originais de forma repentina - mesmo quando as melhores práticas para obtenção de evidências é aplicada - pode tornar a prova inadmissível durante o processo - considerando as melhores práticas atuais (os hashes do disco original e da imagem não irão bater).
O culpado: um algorítimo 'garbage collector' do firmware do disco SSD que por motivios de performance procura resetar os blocos que não estão em uso. Isto pode interferir no estado dos dados poucos minutos depois de ser ligado para análise, ou até mesmo durante uma duplicação forense. Os resultados apresentados interferem também na interpretação de que se o dado não existe na "superfície" do disco, é porque ele nunca esteve lá.
Na conferência Usenix deste ano, pesquisadores da Universidade da Califórnia já tinham apresentado achados interessantes a respeito da ineficiente dos métodos tradicionais de wipe para discos SSD: Reliably Erasing Data From Flash-Based Solid State Drives
Será interessante acompanhar a evolução destas descobertas. Enquanto isto, as recomendações feitas pelos autores australianos no paper não são muito animadoras.
Possivelmente novas práticas e metodologias irão surgir para validar o máximo possível de informações retiradas deste tipo de dispositivos - mas enquanto não surgem, informemo-nos:
1. Solid-state drives of all types and data stored on such drives should be immediately and henceforth considered to be a 'grey area' as far as forensic recovery and legal validation are concerned until extensive studies have been made of drive and data behaviour.
2. Processes that are corrosive/erasive towards data marked for deletion may take place extremely suddenly, extremely quickly and completely automatically without human awareness or control.
3. Present-day evidence indicating 'no data' does not authoritatively prove that data did not exist at the time of capture.
4. Evidence of deleted data being permanently erased or partially corrupted is not evidence of intentional permanent erasure or corruption.
6. Past metadata and data blocks may be deleted without warning and without the opportunity to realise that they had existed at time of capture.
7. Garbage collection can occur either following file deletion or following (quick/full) formatting of a disk. ‘Quick’ formatting is therefore no longer necessarily distinct from ‘full’ formatting.
8. Formatting of disks is a normal and reasonable activity that an innocent person might choose to do e.g. to improve the performance of an SSD drive, to tidy up the disk etc. yet may completely eradicate evidence from a disk. Such eradication of evidence may occur within minutes.
9. We cannot guarantee previously deleted file data to be preserved on an SSD, regardless of whether the drive image was taken during a 'live' capture of evidence or following a 'dead' capture of evidence.
10. Drives can clearly self-modify their data after physical evidence has been gathered, despite best practice efforts by forensic analysts to prevent such behaviour using traditionally effective means such as write-blockers.
11. A software or hardware-based write-blocker does not protect against the drive's internal firmware choosing to wipe data from the drive.
12. The speed at which corrosion of digital evidence takes place should be expected to increase even further as garbage collection algorithms become more aggressive in cleaning up, and drives become faster, and more powerful controller chips become available.
13. We feel it would be an unwise investment of time for analysts to try to develop workaround procedures that operate against the drive controller behaviour specifically identified in these experiments. It will not be useful; even now, a new firmware has been released for the drive, and newer models are on the market, whose behaviour cannot be known a priori. SSDs are an exceptionally fast-moving target.
14. We think it would be an unwise investment of time to develop procedures for physical asset capture whereby operators attempt to distinguish SSDs from HDDs. This process is difficult due to the similar physical appearance of the drives and the need to gain access to the computer's internals. Also, each SSD might require unique and perhaps complex treatment to try to prevent the operation of garbage collection. Furthermore, it is futile - the present-day development of hybrid disks that incorporate both HDD and SSD technologies is likely to frustrate completely any effort to distinguish SSDs from HDDs at time of capture.
15. We think it would be unwise to assume that irreversible file erasure suggests intent to destroy evidence in cases where a defendant has quick-formatted a drive prior to police seizure. There are reasonable circumstances (viruses, slow performance, upgrading) that might cause normal and innocent people to quick format their drive without realising that garbage collection would cause the appearance of ‘secure deletion’.
16. Breaking open the drive casing to try and disable/remove the drive controller and prevent a garbage collector from running would probably be a very significant technical challenge, given the extent to which the drive controller is bound to the data via the flash translation layer, and given the wide diversity of drives, controllers and memory that exist.
17. Running a live analysis might allow a running garbage collector to delete data unhindered; running a dead analysis might cause a garbage collector to activate in the forensics lab. There is no simple answer to this problem.
18. It will probably be impossible to legislate against garbage collection.
19. It is possible that the issues found in this paper will later come to affect USB flash drives as well; having invested in technology that makes NAND flash systems run much faster, it would be very peculiar if manufacturers failed to adopt it across their product range. The increasing availability of high-speed interfaces for portable media such as USB3 makes it likely that we will see more of these complex, evidence-corroding drive controllers in portable USB drives in future.
20. The natural state of digital storage is not to ‘preserve deleted data’ as magnetic drives have done for the past few decades. Future physical storage technologies can be expected to purge deleted files to improve read and write speeds, if technology allows such a purge to be performed quickly.
21. It seems very unlikely that international manufacturers can be collectively persuaded to provide a universal mechanism to disable garbage collection; if anything, garbage collection is likely to become even more aggressive. Perhaps the genie is already out of the bottle?
Links para este e outros 9 periódicos estão listados em: http://sseguranca.blogspot.com/2010/10/9-periodicos-de-computacao-forense.html
Mais informações:
Muito interessante isto.. nunca imaginaria que o SSD daria tanta dor de cabeca pra quem analisa dados em casos de forense!! kkk
ReplyDelete