李晓宁-New Intel SSD Capabilities and Disk Forensics.pdfVIP

New Intel Solid State Drive Capabilities and Disk Forensics 鈥 Xiaoning Li (Intel Labs) 鈥 Benjamin W. Boyer (Intel) ISC 2016 Forensics Forum Solid State Drives Modern SSDs typically contain a layer of SSD abstraction between the host and the Host Interface backing media. There are multiple reasons for this, from wear levelling, Algorithms, Abstraction, thermal management, and performance Wear Levelling, etc. algorithms, to abstracting away quirks of the actual storage media. Of particular interest for this prototype is the resultant fact that a given host鈥檚 Media Media logical block address (LBA) can actually Media be stored in any location in the backing Media media. What if we could save a snapshot of the data in the device at an arbitrary point in time ? SSD Internal Checkpoint 飪 By leveraging the media abstraction SSD subsystems of our SSDs, we created new functionality that allows a system to mark a Host Interface checkpoint of the device contents at a given moment in time. Algorithms, etc. 飪 Subsequent I/O operations do not overwrite the data present at time of Checkpoint checkpoint. Abstraction 飪 Changes can be inspected after the fact. Pre-Checkpoint Data Post-Checkpoint Data 飪 The entire change set can be quickly Media Media reverted to the checkpointed state. Media