Talk:Solid State Drive (SSD) Forensics

From ForensicsWiki
Revision as of 18:07, 22 October 2018 by .FUF (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

There was a question on this discussion page, let's answer it here.

The original data is usually returned (for a "trimmed" block) when a drive doesn't support the DRAT feature or its variants (or when the support is broken). The original data can be "replaced" by null bytes (or something else) occasionally (e.g., a drive can start to return null bytes for a "trimmed" block after a write to another block).

.FUF (talk) 17:50, 22 October 2018 (UTC)