Flash Media A Forensics View. Barry Gavrich CS 589 Digital Forensics David Duggan, Bob Hutchinson, Dr. Lorie Liebrock 17 October 2006

Transcription

1 Flash Media A Forensics View Barry Gavrich CS 589 Digital Forensics David Duggan, Bob Hutchinson, Dr. Lorie Liebrock 17 October 2006 Executive Summary Flash media consists of non-volatile memory, which offers a good trade-off for numerous data storage applications. It is available in many form factors for meeting today s high demand for portable storage solutions. Non-volatile memory does not require any power to maintain data stored within a device is located in numerous products: control systems, BIOS memory chips, USB flash drives, flash memory cards for consumer electronics, and many other multimedia devices in use today. In short, flash memory is found in virtually all of today s electronic devices due to its relatively high-density storage capability, along with its ability to withstand numerous environmental factors. Flash memory presents many familiar and new challenges to the field of digital forensics investigations, which is examined here in more depth.

2 Introduction Flash media consists of non-volatile memory, which offers good trade-offs for numerous data storage applications and is available in many form factors for meeting today s high demand for portable storage solutions in both commercial and consumer products. Non-volatile memory does not require any power to maintain data stored within a device and is found in products as diverse as: control systems, BIOS memory chips in computer systems, USB flash drives, flash memory cards for digital cameras and video recorders, game consoles, MP3 players and other multimedia devices such as mobile phones, smartphones, and PDAs. In short, flash memory is used in virtually all of today s electronic devices due to its relatively high-density storage capability, along with its ability to withstand numerous harsh environmental factors such as vibration, moisture, and temperature extremes that affect other types of storage devices. While flash memory provides a good overall solution, it has yet to replace hard disk drive (HDD) technology for storing extremely large amounts of data due to its currently higher overall cost and size per MB of storage. Manufacturing improvements in the area of flash memory is allowing flash memory to gain market share over traditional HDD technologies. Industry trends suggest that flash memory will largely supplant HDDs within the next decade. This paper is focused on the use of flash media in its most common use, that of consumer products, which provide high portability storage for data files, images, and audio / video files. The manufacturing of flash media is governed by Moore s Law, thus leading to increased density of flash media where each new product generation results in smaller, cheaper, faster memory storage per given volume. Flash memory was invented and developed by Toshiba in There are two types of flash memory technologies; NOR which is based on the use of negative OR (NOR) gates, and NAND which is based on negative AND (NAND) gates. Each technology has certain advantages, thus its usage is dictated by the specific memory application requirements. Although both types of flash memory have relatively fast read times, NAND flash has significantly faster write and erase times than that of NOR flash, thus the use of NAND flash has become predominant in today s flash memory cards, particularly for digital camera applications since it is desired to have fast write and erase cycles for use with today s higher megapixel based digital cameras. Another advantage that NAND flash has is that it is also more inexpensive to manufacture and has a higher density per given volume. Conversely, the use of NOR flash is preferred in flash based firmware applications such as computer BIOS schemes, since NOR flash has full random access as in traditional RAM based applications. NAND flash is limited to the sequential access method for addressing the memory. Both types of flash memory have a characteristic that is of primary interest for digital forensics, namely that file deletion is similar to that used in HDD technology where the operating system (OS) merely deletes its references to the file(s) until the disk area needs to be reclaimed for writing new files. Additionally, erasure of data is typically performed on a block device basis with usual physical layer block sizes of 64, 128, or 256 KB. Memory structures For either type of flash to be useful, memory structures must be implemented for each. NOR memory structures can be configured in a standard ROM memory mode, thus operating through the use of address mapping configured by a higher level device or controller and can support execute-in-place memory. The software application handles all bad block management of the memory structure. When the memory structure is in its write and erase mode, the memory structure is controlled via the Common Flash memory Interface (CIF), an open standard designed and developed by a consortium comprised of AMD, Fujitsu, Intel, and Sharp. NAND memory structures are configured as standard block devices where the block is considered the atomic unit for storage purposes at this abstraction level. Typical block sizing is either 512 or 2048 bytes in most common applications, similar to those of HDDs. Each block has a few bytes within the block reserved for overhead use in storing error detection and correction checksums, again, similar to that of HDD technology. The most common application of NAND memory is for the use of USB flash drives and memory cards. 2

3 Types of Flash Media Flash media is available in many form factors, but only the more commonly used forms will be described here. The flash media types enumerated here have similar memory structures supporting standard filesystems including Windows FAT32 and NTFS, Apple HFS, and Linux (typically ext2 and ext3). From a forensic standpoint, most flash media devices can be analyzed using a number of existing digital forensic tools available today. Command line tools and tool kits such as Sleuth Kit / Autopsy, EnCase, SafeBack, and others provide a large array of tools for analyzing storage mediums at various layers and performing forensic duplications. Compact Flash (CF) cards were first developed in 1994 by SanDisk using NOR memory originally, but have migrated to a NAND memory basis in current production schemes. CF cards are similar to PCMCIA or CardBus technologies and use the PCMCIA-ATA interface. CF cards also contain an onboard IDE controller for communicating to the memory itself, similar to HDDs. CF cards with storage capacities of up to 8GB are common today. SmartMedia (SM) cards were first developed in 1995 by Toshiba using the more inexpensive and higher density NAND memory. SM card technology is significantly smaller than that of CF as it lacks an onboard controller. Thus, the electronic device using the SM card must control the memory directly. SM cards are limited to a maximum capacity of 128MB. This format has been replaced largely by Secure Digital cards in most small portable consumer devices due to its smaller form factor and higher capacity. Secure Digital (SD) cards were first developed by a consortium consisting of Matsushita, SanDisk, and Toshiba in The term Secure refers to the technology s inclusion of encryption hardware to allow for Digital Rights Management (DRM) in the format, but is not used in most applications. Neither CF nor SM technologies support any form of DRM. Similar to SM cards, the SD format requires the electronic device to control the memory directly. SD cards with storage capacities of up to 8GB are common today. An even smaller version of the SD card has become popular for use in next generation mobile phones and GPS units, namely microsd cards. This format has high future potential for two reasons. It is currently the smallest mass produced form factor at 11 x 15 x 1 mm, making it ideal for ultra portability and use in personal communication devices. Second, microsd cards have the capability to support Near Field Communication (NFC) technology. NFC holds the promise of allowing two portable devices to communicate directly when in close proximity (maximum range of 20 cm, typically less than 2 cm) in the 13.56MHz RF band. SD cards with storage capacities of up to 2GB are common. While there are a number of other varieties of flash media, the above types represent the bulk of the current market types in common use for non-volatile portable storage devices. Many of these form factors can be utilized in place of other older technologies via the use of adapters that allow a smaller but electrically compatible device to be placed into a larger form factor card slot (e.g., a microsd can be placed in an SD card adapter for use in SD card applications). Many notebook computers have a PCMCIA and/or SD card slot available, thus allowing users to transfer data between flash media cards and the host computer relatively easily. Another related technology that is being exploited for use in PDAs and MP3 players, is that of microdrives. While microdrives are not flash memory based, they are similar in nature as they are miniature HDDs that can fit in a CF type II card slot in an electronic device. A number of MP3 players are being introduced that utilize 1 or 0.85 microdrives for storage purposes. Since they are designed to fit the CF form factor and standards, these drives also support the ATA command interface natively. Microdrives supporting larger than 4GB of storage are formatted using FAT32, NTFS, or Linux filesystems. Two other dominant form factors for flash media are those of USB flash drives and flash based MP3 players. USB flash drives and MP3 players are generally based on using NAND memory technology and can support filesystem types such as FAT32, NTFS, HFS, and Linux filesystems. USB flash drives would normally be considered in the same category as flash media cards regardless of their physical packaging, as a number of the products today are being unbundled from their traditional USB stick" shape. This 3

4 leaves MP3 players as a more unique form factor based on the balance of the supporting electronics making up the player. Our concern here though is strictly with the flash memory itself, which is accessed by various connectivity interfaces depending on the manufacturer of the device. Problem Description The growing use of flash media presents a significant challenge in both the number and types of devices that can provide data storage capabilities. While much of the digital forensics field has been focused on the analysis and study of HDD technologies, it is becoming a baseline requirement that the digital forensics community become as experienced with supporting forensic investigations of non-hard disk technologies such as flash media devices. Currently, many of the same problems exist with flash media as in traditional HDDs. Examining both allocated and unallocated space, searching for deleted files, and analyzing slack space is a tedious and time consuming task. With the widespread use of flash memory in its numerous form factors, its high portability, ease of concealment due to its small size, criminal and corporate investigators are being challenged to seek new and innovative ways to perform digital forensics investigations for recovering deleted and hidden data that can be used to prove criminal intent or activities. With flash memory devices being configured as block devices, the use of standard filesystem structures modified for flash memory operations has become the norm. The initial filesystem developed by Microsoft, was the Flash File System 2 (FFS2), which was an MS-DOS equivalent architecture. Subsequently, the PCMCIA trade group drove the next generation specification for the Flash Translation Layer (FTL), which has the device appear as a FAT filesystem to the host device. Similar filesystems have been developed for use with Linux kernels, namely the Journaling Flash File System (JFFS), JFFS2, and Yet Another Flash File System (YAFFS). The YAFFS is capable of interfacing with non-linux kernels such as Microsoft s WinCE platform, which is used for a number of small portable devices such as PDAs, smartphones, and handheld PCs. Flash memory exhibits a unique phenomenon in that the memory cells that physically store the 0 and 1 bits can wear out from constant write and erase cycles. Even though the standard industry guarantee is that a flash memory device will support one million (1,000,000) write / erase cycles, many flash devices experience premature failure prematurely due the constant write / erase cycles to a limited area within the memory structure. To help counter this phenomenon, wear-leveling was introduced in modern systems to cause the write / erase cycles to be spread throughout the memory structure so as to increase the overall lifespan of the flash media. Wear-leveling is generally implemented at the hardware level so as to keep the data layer consistent with established filesystems. Potentially, wear-leveling can be reverse engineered and leveraged so that an individual desiring to hide data could carve out a portion of the memory structure so as to not be used during normal write / erase cycles. If 100MB of storage on an 8GB flash media device were carved out for data hiding purposes, this would represent 1.25% of the card s total memory structure. A casual observation of the memory contents could easily miss this hidden portion, which could hide a significant amount of data. Solutions Flash media can be interrogated through the respective host environment (e.g., digital camera, MP3 players), or in a standalone fashion for devices that have the capability of being inserted into a computer interface (e.g., USB, SD, or CardBus connection). Unfortunately once many of these devices are connected to a computer via their interface cable or inserted into the host computer itself, the host computer OS writes overhead data to the flash memory in preparation for communication, thus possibly ruining the integrity of the media prior to an investigation being carried out. Use of a standalone controller or dedicated media drive bay that keeps the flash memory isolated is a popular method for performing forensic investigations. The OnSpec 90C46D is an ATA/ATAPI is a flash media read/write controller that supports up to twenty-seven different form factors for flash memory cards. It is compatible with Windows 95B/98/2000/XP, Apple OS X, and Linux v2.4 or later kernels. Another unit available is the OmniFlash Uno4 (7-4-1), an IDE/ATAPI compliant drive system that provides the capability to support CF, SM, SD, microsd, and microdrive units in a 3.5 drive bay of a desktop 4

5 computer. It is compatible with Windows 95B/98/NT4.0/2000/XP, MS-DOS, and Linux v2.4 or later kernels. These two hardware solutions give a forensic investigator a good choice for analyzing the flash memory contents using both open source and commercially available tool kits. This allows the investigator to use already familiar tools to make qualified forensic duplicates and perform a digital forensics investigation following established procedures for preserving the integrity of the data. Future Practice and Research Current industry trends indicate the increased use of flash memory in many applications. As the manufacturing density increases, flash memory disks will come into mainstream use, eventually replacing today s HDDs. Samsung began shipping notebook computers in May 2006 incorporating a 32GB NAND flash memory solid state disk (SSD) in lieu of a traditional HDD. These new 1.8 SSDs are capable of reading from the device at 53MB per second (300% faster than current HDD technology), and writing to the device at 28MB per second (150% faster than current HDD technology). Power consumption is greatly reduced, thus extending the overall operating time of the notebook. Additionally, SSD devices can survive much more rugged environments than traditional HDDs such as severe impact forces and liquid contamination of the notebook itself. Overall, the demand for memory products is increasing, but probably none more than that of non-volatile memory for use in highly portable handheld devices. Figure 1 provides the projected growth of flash memory requirements in the marketplace. The largest growth areas for flash memory will be in mobile phone, music players, and imaging. Figure 1. NAND flash consumption, current and forecast Current manufacturing technology of flash memory uses 2-bit/cell storage also referred to as multi level cell (MLC) fabrication technology. Rapid progress is being made for commercializing the next generation of 4-bit/cell storage capacity. Announcements have been made by two industry suppliers: Msystems is projecting the fabrication of 4-bit/cell NAND flash in the near future, and similarly an announcement by Spansion for producing 4-bit/cell NOR flash memory by the end of 2006, with 16GB devices being delivered in From a forensics viewpoint, the advent of SDD technology will help to mitigate these problems associated with HDD technology, thus saving valuable time that is presently spent in repairing damaged drives and applying it to the forensic investigation itself. This will allow for a faster overall turn-around time for performing the forensic analysis portion of a given investigation. Additional research will need to be applied to flash memory technologies to strive to improve forensic investigation capabilities within the ever increasing capacity of the flash memory device. 5

6 Bibliography Wikipedia, Flash media, Memorex, Reference guide for flash media, WhitePaper_Reference_Guide_Flash_Mar06.pdf New Technologies Inc. (NTI), Processing flash media, Wikipedia, Memory card, OnSpec Electronic Inc., ATA / ATAPI / PCMCIA storage, CompuApps Inc., OmniFlash products, IDE% htm Samsung, Samsung electronics launches the world s first pcs with nand flash-based solid state disk, HowStuffWorks, How flash memory works, Msystems, msystems' x4 technology: 4-bit/cell NAND usage impossible? possible!, 6E3C8278CE69/0/ x4_technology_white_paper.pdf Spansion, Spansion announces mirrorbit(r) quad technology - world's first 4-bit-per cell flash memory, 6