\chapter{  Digital Forensics in USB NVMe SSDs with WriteBlocker}
\label{chpt:df_nvme_ssd_usb_adapters}

\begin{doublespace}
\begin{justify}
%\vspace{-10mm}
\noindent \hspace{50pt} Storage is a vital mechanism that enables a computer system to temporarily or permanently retain data. Computer storage devices store digital information on itself. These devices are ubiquitous, and a fundamental component of most digital devices since they allow users to store all kinds of digital media \cite{computer_storage}.

\noindent \hspace{50pt} There are currently numerous computer storage devices available in the market such as hard drives (HDDs), memory cards, USB flash drives, solid-state drives (SSDs), and non-volatile memory express solid-state drives (NVMe SSDs), to name a few. Until the late 2000s, HDDs had the highest market share in terms of storage devices, but recently there has been a gradual shift towards SSDs \cite{hdd_share}. The shift from using HDDs to NVMe SSDs in digital devices is primarily driven by latter's performance, durability, and reliability, to name a few. Therefore, a user can get his task done ten times faster when using an NVMe SSD compared to an HDD \cite{survey_ssd}.

\noindent \hspace{50pt} Since the NVMe SSD technology is relatively new; there is not much prior sound digital forensic research in this field. Unlike HDD, which stores data on fundamental data storage units called sectors and can be written and rewritten multiple times, NVMe SSD stores data on flash chips internally controlled by the controller chip on the storage device. There are significant discrepancies in the underpinnings between the two forms of storage media, which have serious implications for security and digital forensics. When it comes to conducting file recovery on HDD, we have the certainty of finding the data as it stays on the device's storage unit. Since only the address reference to the stored data is removed after deletion \cite{fsf}, it is not always guaranteed that deleted data is erased from the hard drive. So, when we take a forensics image of an HDD and recover data, we would find the data as long it is not overwritten. On the contrary, this is not the case for NVMe SSD, as the controller chip inside the device is constantly moving data around the flash chips to prolong the life of the storage device. The constant movement of data for elongating the life of an NVMe SSD is achieved by the concept of wear-leveling, which the controller implements autonomously \cite{wear_leveling}. Even if they are not connected, SSDs can sometimes delete data independently. As a result, standard techniques aimed at preserving forensics data on solid-state drives are ineffective. In addition, they could also result in potential evidence being lost, destroyed, or corrupted, thus, making evidence inadmissible in court. \cite{ssd_peter}. 

\noindent \hspace{50pt} To address the problem of file recovery in NVMe SSDs, we conducted a sound forensic analysis on four NVMe SSDs: Samsung, Seagate, Western Digital, and Silicon Power. These storage devices were used inside USB enclosure adapters. We aimed to determine the number of files recovered after they were deleted from these devices. We prepared the NVMe SSDs by installing Windows 10 operating system on them. To recover the files and conduct the forensic analysis, we used AccessData FTK \cite{ftk}, Autopsy, and WinHex \cite{winhex} disk editor. In addition, we explained our forensic findings based on the observations from four the different brands of SSDs with varying controller chips. %We expected these findings to be similar or different, which will be explained further in this study.

%\vspace{-2mm}
\addcontentsline{toc}{section}{Experimental Setup with USB WriteBlocker}
\section*{Experimental Setup with USB WriteBlocker}
\noindent \hspace{50pt} Table \ref{nvme_usb_wb_table1}  below shows the technical specifications of the equipment used throughout the experiment, including the digital forensic workstation and various hardware and software tools. 

\begin{table}[htb]
	%\captionsetup{justification=centering}
	\caption{Equipment used in the experiment.}
	\begin{tabular}{|l|l|} \hline
		\textbf{Tools} & \textbf{Name}  \\ \hline 
		NVMe SSD 1 & Samsung V-NAND SSD 970 Evo Plus\\ \hline
		NVMe SSD 2 & Seagate Barracuda 510 250GB NVMe SSD \\ \hline
		NVMe SSD 3 & Western Digital SN550 250GB NVMe SSD \\ \hline
		NVMe SSD 4 & Silicon Power 3D-NAND NVMe SSD \\ \hline
		Operating System & Windows 10 Pro v21H2  \\ \hline
		Forensic Analysis Tool & AccessData FTK 7.5 and WinHex  \\ \hline
		Forensics Acquisition Tool & AccessData FTK Imager 4.7 \\ \hline
		WriteBlocker & Wiebetech USB 3.0 WriteBlocker \\ \hline
		Workstation & CPU: Intel Xeon W-2123 | RAM : 80GB\\ \hline
	\end{tabular}
	\centering  %this effect table by making it centered.
	 
	\label{nvme_usb_wb_table1}
\end{table}

\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wb_sam_nvme_usb.jpg}
	\caption{Samsung NVMe SSD attached with USB WriteBlocker.}
	\label{fig20}
\end{figure}

\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wb_sg_nvme_usb.jpg}
	\caption{Seagate NVMe SSD attached with USB WriteBlocker.}
	\label{fig21}
\end{figure}

\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wb_wd_nvme_usb.jpg}
	\caption{Western Digital NVMe SSD attached with USB WriteBlocker.}
	\label{fig22}
\end{figure}

\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wb_sp_nvme_usb.jpg}
	\caption{Silicon Power NVMe SSD attached with USB WriteBlocker.}
	\label{fig23}
\end{figure}

\vspace{-10mm}
\addcontentsline{toc}{section}{Specifics of SSDs}
\section*{Specifics of SSDs}

\noindent \hspace{50pt} The experiment was based on four brands of NVMe SSDs, namely Samsung, Seagate, Western Digital, and Silicon Power. This was due to their significant market dominance and reliability \cite{market}. The four brands and the specific models were chosen to reflect a real-life scenario since the specifications of these SSDs mimic the specifications of a typical SSD a user might own. Additionally, the choice of SSDs makes the experiment more meaningful to the digital forensic community as these are the most prominent specifications of SSDs embedded in a laptop or desktop computer. Tables \ref{nvme_usb_wb_table2a} and \ref{nvme_usb_wb_table2b},  list down the name, model, product number (P/N), storage capacity, number of flash chips, type of NVMe flash chip, and the controller information of the NVMe SSDs. 

\begin{table}[H]
%\captionsetup{justification=centering}
\caption{Information of Samsung and Seagate NVMe SSDs used in the experiment.} 
	\begin{tabular}{|l|l|} \hline
		SSD Information & Samsung NVMe Specification 1.3  \\ \hline 
		Name & Samsung NVMe V-NAND SSD 970 Evo Plus  \\ %\hline
			 & NVMe M.2  \\ \hline
		Model & MZ-V7S250  \\ \hline
		P/N & MZVLB250HBHQ  \\ \hline
		Storage Capacity & 250 GB  \\ \hline
		Number of flash chips inside & 2  \\ \hline
		Type of NVMe NAND Flash & 3D TLC NAND   \\ \hline %V-NAND
		Controller information & Samsung S4LR020 | 2117 ARM | Pheonix   \\ \hline
		
		\multicolumn{1}{l}{} \\ \hline		
		
		SSD Information & Seagate NVMe Specification 1.3  \\ \hline 
		Name & Seagate Barracuda 510 250GB NVMe SSD  \\ \hline
		Model & ZP250CM30001  \\ \hline
		P/N & 2NS312-300  \\ \hline
		Storage Capacity & 250 GB \\ \hline
		Number of flash chips inside & 4  \\ \hline
		Type of NVMe NAND Flash & 3D TLC NAND  \\ \hline
		Controller information & SKHynix - H5AN4G6NBJR \\ \hline
	\end{tabular}
\centering  %this effect table by making it centered.
%\justify \footnotesize \textbf{Note}: --------. \\
%\noindent \ding{56} - NVMe -------.
%\textbf{NVMe} - Non-Volative Memory express 
\label{nvme_usb_wb_table2a}
\end{table}
		
\begin{table}[H]
    %\captionsetup{justification=centering}
	\caption{Information of Western Digital and Silicon Power NVMe SSDs used in the experiment.}
	\begin{tabular}{|l|l|} \hline
		SSD Information & WD NVMe Specification 1.4  \\ \hline 
		Name & Western Digital SN550 250GB NVMe SSD  \\ \hline
		Model & WDS250G2B0C-00PXH0/21146P801302  \\ \hline
		P/N & 87161901478830731375399388282263  \\ \hline
		Storage Capacity & 250 GB \\ \hline
		Number of flash chips inside & 4  \\ \hline
		Type of NVMe NAND Flash & 3D TLC NAND  \\ \hline
		Controller information & Sandisk 20-82-10023-A1 | 1015ZKLY0KN \\ \hline
		
		\multicolumn{1}{l}{} \\ \hline		
		
		SSD Information & Silicon Power NVMe Specification 1.3  \\ \hline 
		Name &  Silicon Power 3D-NAND NVMe SSD  \\ \hline
		Model & A-60  \\ \hline
		P/N & SP256GBP34A60M28  \\ \hline
		Storage Capacity & 256 GB \\ \hline
		Number of flash chips inside & 2  \\ \hline
		Type of NVMe NAND Flash & 3D TLC NAND  \\ \hline
		Controller information & Phison PS5013-E13-31|C02102E| TB5V79/ \\
     	                       & 001BB \\ \hline
	\end{tabular}
	\centering  %this effect table by making it centered.
\label{nvme_usb_wb_table2b}
\end{table}

\vspace{-10mm}
\addcontentsline{toc}{section}{Methodology and Experiment Initiation}
\section*{Methodology and Experiment Initiation}
\noindent \hspace{50pt} This section lists down and explains the procedures and configurations we followed and assigned throughout the experiment. %Also, table \ref{nvme_usb_wb_table3} lists down essential timeline information of the experiment.

\begin{enumerate}
	\item The partition scheme used for the NVMe SSDs inside the USB enclosure adapters: \textbf{MBR (Master Boot Record)} \vspace{-11pt}
	\item The number of partitions in each NVMe SSD: \textbf{1} \vspace{-11pt}
	\item The file system of the one partition: \textbf{NTFS} \vspace{-11pt}
	\item Prior to  copying the files to the devices from Digital Corpora \cite{corpora}, we checked the \textbf{TRIM} status in Windows 10 by issuing the following command through the command prompt.
	\vspace{-10mm}
	%\noindent
	\begin{center} 
	\framebox
	{\parbox {\dimexpr\linewidth-2\fboxsep-2\fboxrule}
		{
			{
				\begin{center} 
					\textbf{fsutil behavior query DisableDeleteNotify} \vspace{-11pt}
				\end{center} 
				
				\textit{*If the output is 1, then TRIM is disabled. If the output is 0, then TRIM is enabled.} \\ \vspace{-11pt}
				
				\textbf{To enable TRIM}: fsutil behavior set DisableDeleteNotify 0 \\
				\textbf{To disable TRIM}: fsutil behavior set DisableDeleteNotify 1 \\ \vspace{-11pt}
			}
		}	 
	}	
	\end{center}
\end{enumerate}

\begin{figure}[tbh]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/trim_on.png}
	\caption{The status of TRIM in Windows 10 using fsutil command.}
	\label{fig24}
\end{figure}

\noindent \textbf{Case scenario: TRIM ON from Windows 10 operating system with the USB WriteBlocker}

\begin{enumerate}
	\item We copied the commonly used file types from the Digital Corpora dataset \cite{corpora} to the four NVMe SSDs. %Tables \ref{nvme_usb_wb_table4a}, \ref{nvme_usb_wb_table4b}, \ref{nvme_usb_wb_table5a}, and \ref{nvme_usb_wb_table5b} show the list of files copied to the devices. 
	We used large file sizes to exhaust the storage drives' capacity. \vspace{-11pt}
	
	\item We then kept the files for one day with no user activity by keeping the drive attached to the USB port. \vspace{-11pt}

	\item Next, we deleted (shift+delete) the files from the devices and waited for one day before taking four forensic images of the four NVMe SSDs respectively using the physical USB writeblocker.  \vspace{-11pt}
	\begin{enumerate}
		\item We took four forensic images: three consecutive images with one day gap and last image after a span of four days from the third acquisition.
	\end{enumerate}
	
	\item We analyzed the images in AccessData FTK and Autopsy for the NVMe storage devices. \vspace{-11pt}

	\item We performed file recovery of the deleted files from the forensics images in TRIM ON case. \vspace{-11pt}
	
	\item Based on our results from the file recovery and  WinHex analysis we documented the effects of wear-leveling. \vspace{-11pt}
\end{enumerate}

\noindent \textbf{Case scenario: TRIM OFF from Windows 10 operating system with the USB WriteBlocker}

\begin{enumerate}
	\item Firstly, we disabled TRIM using Windows 10 command prompt before copying the files. \vspace{-11pt}
	
		\item We copied the commonly used file types from the Digital Corpora dataset \cite{corpora} to the four NVMe SSDs. %Tables \ref{nvme_usb_wb_table4a}, \ref{nvme_usb_wb_table4b}, \ref{nvme_usb_wb_table5a}, and \ref{nvme_usb_wb_table5b} show the list of files copied to the devices. 
		We used large file sizes to exhaust the storage drives' capacity. \vspace{-11pt}
	
	\item We then kept the files for one day with no user activity by keeping the drive attached to the USB port. \vspace{-11pt}
	
	\item Next, we deleted (shift+delete) the files from the devices and waited for one day before taking four forensic images of the four NVMe SSDs respectively using the physical USB writeblocker. \vspace{-11pt}
	
	\begin{enumerate}
		\item We took four forensic images: three consecutive images with one day gap and last image after a span of four days from the third acquisition.
	\end{enumerate}
	
	\item We analyzed the images in AccessData FTK and Autopsy for the NVMe storage devices. \vspace{-11pt}
	
	\item We performed file recovery of the deleted files from the forensics images in TRIM OFF case. \vspace{-11pt}
	
	\item Like the TRIM ON case, based on our results from the file recovery and  WinHex analysis we documented the effects of wear-leveling. %\vspace{-11pt}
\end{enumerate}

%\vspace{-10mm}
\newpage
\addcontentsline{toc}{section}{Experiment Results, Analysis, and Discussion}
\section*{Experiment Results, Analysis, and Discussion}

\noindent \hspace{50pt} In this section, we provided the results of the file recovery performed using the AccessData FTK and Autopsy tools. %First, we filled the NVMe SSDs with the most commonly used files from the Digital Corpora dataset \cite{corpora}. We then performed file recovery from the forensically acquired images of the four NVMe SSDs. 
Tables \ref{nvme_usb_wb_table3a} and \ref{nvme_usb_wb_table3b} show the timeline information of forensic image acquisition in both TRIM ON and TRIM OFF cases of Samsung, Seagate, Western Digital (WD), and Silicon Power (SP) NVMe SSDs, respectively. \medskip

\begin{table}[h]
    %\captionsetup{justification=centering}
	\caption{Timeline information of forensic file acquisition.} 
	{\renewcommand{\arraystretch}{1.2}
		\begin{tabular}{|llll|}
			\hline
			\multicolumn{4}{|l|}{\textbf{TRIM ON information}}                                                                                                           \\ \hline
			\multicolumn{1}{|l|}{\textbf{Samsung NVMe}} & \multicolumn{1}{l|}{\textbf{Time}}    & \multicolumn{1}{l|}{\textbf{Seagate NVMe}} & \textbf{Time}    \\ \hline
			
			\multicolumn{1}{|l|}{Copy file date}        & \multicolumn{1}{l|}{7:06 pm 10/18/21} & \multicolumn{1}{l|}{Copy file date}        & 5:38 pm 10/18/21 \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{Delete files}          & \multicolumn{1}{l|}{7:06 pm 10/19/21} & \multicolumn{1}{l|}{Delete files}          & 5:38 pm 10/19/21 \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{1st image}             & \multicolumn{1}{l|}{7:06 pm 10/20/21} & \multicolumn{1}{l|}{1st image}             & 5:38 pm 10/20/21 \\ \hline
			
			\multicolumn{1}{|l|}{2nd image}             & \multicolumn{1}{l|}{7:06 pm 10/21/21} & \multicolumn{1}{l|}{2nd image}             & 5:38 pm 10/21/21 \\ \hline
			
			\multicolumn{1}{|l|}{3rd image}             & \multicolumn{1}{l|}{7:06 pm 10/22/21} & \multicolumn{1}{l|}{3rd image}             & 5:38 pm 10/22/21 \\ \hline
			
			\multicolumn{1}{|l|}{4th image}             & \multicolumn{1}{l|}{7:06 pm 10/26/21} & \multicolumn{1}{l|}{4th image}             & 5:38 pm 10/26/21 \\ \hline
			\multicolumn{4}{|l|}{\textbf{TRIM OFF information}}                                                                                                          \\ \hline
			\multicolumn{1}{|l|}{\textbf{Samsung NVMe}} & \multicolumn{1}{l|}{\textbf{Time}}    & \multicolumn{1}{l|}{\textbf{Seagate NVMe}} & \textbf{Time}    \\ \hline
			
			\multicolumn{1}{|l|}{Copy file date}        & \multicolumn{1}{l|}{7:51 pm 9/29/21}  & \multicolumn{1}{l|}{Copy file date}        & 7:51 pm 9/29/21  \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{Delete files}          & \multicolumn{1}{l|}{7:51 pm 9/30/21}  & \multicolumn{1}{l|}{Delete files}          & 7:51 pm 9/30/21  \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{1st image}             & \multicolumn{1}{l|}{7:51 pm 10/1/21}  & \multicolumn{1}{l|}{1st image}             & 7:51 pm 10/1/21  \\ \hline
			
			\multicolumn{1}{|l|}{2nd image}             & \multicolumn{1}{l|}{7:51 pm 10/2/21}  & \multicolumn{1}{l|}{2nd image}             & 7:51 pm 10/2/21  \\ \hline
			
			\multicolumn{1}{|l|}{3rd image}             & \multicolumn{1}{l|}{7:51 pm 10/3/21}  & \multicolumn{1}{l|}{3rd image}             & 7:51 pm 10/3/21  \\ \hline
			
			\multicolumn{1}{|l|}{4th image}             & \multicolumn{1}{l|}{7:51 pm 10/7/21}  & \multicolumn{1}{l|}{4th image}             & 7:51 pm 10/7/21  \\ \hline
	\end{tabular}}
	\centering  %this effect table by making it centered.
	 
	\label{nvme_usb_wb_table3a}
\end{table}

%\newpage
\begin{table}[h]
    %\captionsetup{justification=centering}
	\caption{Timeline information of forensic file acquisition.} 
	{\renewcommand{\arraystretch}{1.2}
		\begin{tabular}{|llll|}
			\hline
			\multicolumn{4}{|l|}{\textbf{TRIM ON information}}                                                                                                           \\ \hline
			\multicolumn{1}{|l|}{\textbf{WD NVMe}} & \multicolumn{1}{l|}{\textbf{Time}}    & \multicolumn{1}{l|}{\textbf{SP NVMe}} & \textbf{Time}    \\ \hline
			
			\multicolumn{1}{|l|}{Copy file date}        & \multicolumn{1}{l|}{11:22 pm 10/18/21} & \multicolumn{1}{l|}{Copy file date}        & 9:02 pm 10/10/21 \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{Delete files}          & \multicolumn{1}{l|}{11:22 pm 10/19/21} & \multicolumn{1}{l|}{Delete files}          & 9:02 pm 10/11/21 \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{1st image}             & \multicolumn{1}{l|}{11:22 pm 10/20/21} & \multicolumn{1}{l|}{1st image}             & 9:02 pm 10/12/21 \\ \hline
			
			\multicolumn{1}{|l|}{2nd image}             & \multicolumn{1}{l|}{11:22 pm 10/21/21} & \multicolumn{1}{l|}{2nd image}             & 9:02 pm 10/13/21 \\ \hline
			
			\multicolumn{1}{|l|}{3rd image}             & \multicolumn{1}{l|}{11:22 pm 10/22/21} & \multicolumn{1}{l|}{3rd image}             & 9:02 pm 10/14/21 \\ \hline
			
			\multicolumn{1}{|l|}{4th image}             & \multicolumn{1}{l|}{11:22 pm 10/26/21} & \multicolumn{1}{l|}{4th image}             & 9:02 pm 10/18/21 \\ \hline
			\multicolumn{4}{|l|}{\textbf{TRIM OFF information}}                                                                                                          \\ \hline
			\multicolumn{1}{|l|}{\textbf{WD NVMe}} & \multicolumn{1}{l|}{\textbf{Time}}    & \multicolumn{1}{l|}{\textbf{SP NVMe}} & \textbf{Time}    \\ \hline
			
			\multicolumn{1}{|l|}{Copy file date}        & \multicolumn{1}{l|}{10:51 pm 9/29/21}  & \multicolumn{1}{l|}{Copy file date}        & 10:48 pm 9/28/21  \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{Delete files}          & \multicolumn{1}{l|}{10:51 pm 9/30/21}  & \multicolumn{1}{l|}{Delete files}          & 10:48 pm 9/29/21  \\ \hline
			
			\multicolumn{1}{|l|}{Wait for 24 hrs}       & \multicolumn{1}{l|}{Waited}           & \multicolumn{1}{l|}{Wait for 24 hrs}       & Waited           \\ \hline
			
			\multicolumn{1}{|l|}{1st image}             & \multicolumn{1}{l|}{10:51 pm 10/1/21}  & \multicolumn{1}{l|}{1st image}             & 10:48 pm 9/30/21  \\ \hline
			
			\multicolumn{1}{|l|}{2nd image}             & \multicolumn{1}{l|}{10:51 pm 10/2/21}  & \multicolumn{1}{l|}{2nd image}             & 10:48 pm 10/1/21  \\ \hline
			
			\multicolumn{1}{|l|}{3rd image}             & \multicolumn{1}{l|}{10:51 pm 10/3/21}  & \multicolumn{1}{l|}{3rd image}             & 10:48 pm 10/2/21  \\ \hline
			
			\multicolumn{1}{|l|}{4th image}             & \multicolumn{1}{l|}{10:51 pm 10/7/21}  & \multicolumn{1}{l|}{4th image}             & 10:48 pm 10/6/21  \\ \hline
	\end{tabular}}
	\centering  %this effect table by making it centered.
	\label{nvme_usb_wb_table3b}
\end{table}

%\noindent \par \textbf{
%\noindent {\textit{\textbf{\large Samsung and Seagate TRIM ON analysis}}} \medskip
%\vspace{-10mm}
%\newpage
\addcontentsline{toc}{section}{Samsung and Seagate TRIM ON Analysis}
\section*{Samsung and Seagate TRIM ON Analysis}

\noindent \hspace{50pt} The TRIM command allows the operating system to tell the SSD that specific sections are no longer needed. As a result, the SSD controller can now undertake many of the processes required to clear data well ahead of any request from the operating system. These internal procedures could even be carried out when the SSD is under low load, hiding or masking the activity from the user.

\noindent \hspace{50pt} Despite this, the TRIM ON analysis on both the Samsung NVMe and Seagate NVMe SSDs' forensics images showed that all files were recovered using the AccessData FTK and Autopsy tools. However, the controller chip did not act on files under 693 bytes in Samsung NVMe SSD and 696 bytes in Seagate NVMe SSD, respectively. As a result, they were all intact without any content wiped or corrupted. In addition, files greater than 693 bytes in Samsung NVMe, and 696 bytes in Seagate NVMe SSD were all corrupted, i.e., their file contents were all zeroed out and hence were rendered unusable. Tables \ref{nvme_usb_wb_table4a}, \ref{nvme_usb_wb_table4a1}, \ref{nvme_usb_wb_table4b}, and \ref{nvme_usb_wb_table4b1} give the statistics of the different files used from the Digital Corpora dataset and the files recovered from Samsung and Seagate NVMe SSDs in TRIM on case.

\input{chapters/ashar_chapter_06_nvme_usb_wb_table4a}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table4a1}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table4b}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table4b1}

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sam_ton file over 693 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 693 bytes in Samsung NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig25}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig25} shows a snippet of an XML file with regards to the Samsung NVMe SSD TRIM ON case using a USB WriteBlocker. The file which over 693 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered, but the contents of the file were corrupted, making the file unusable, as shown by the zeroes.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sam_ton file under 693 bytes proof-1.png}
	\caption{File, Set-1-xml(15).xml, under 693 bytes in Samsung NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig26}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig26}  shows a snippet of the Set-1-xml(15).xml file with regards to the Samsung NVMe SSD TRIM ON case using a USB WriteBlocker. The file under 693 bytes was opened in the Win Hex tool. As seen from the experimental results, the file was recovered, and the contents of the file were intact.  

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sg_ton file over 693 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 696 bytes in Seagate NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig27}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig27} shows a snippet of an XML file with regards to the Seagate NVMe SSD TRIM ON case using a USB WriteBlocker. The file over 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered, but the contents of the file were corrupted, making the file unusable, as shown by the zeroes.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sg_ton file under 693 bytes proof-1.png}
	\caption{File, Set-1-xml(15).xml,  under 696 bytes in Seagate NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig28}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig28}  shows a snippet of the Set-1-xml(15).xml file with regards to the Seagate NVMe SSD TRIM ON case using a USB WriteBlocker. The file under 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered and the contents of the file were intact.  \medskip

%\vspace{-10mm}
\newpage
\addcontentsline{toc}{section}{Samsung and Seagate TRIM OFF Analysis}
\section*{Samsung and Seagate TRIM OFF Analysis}

\noindent \hspace{50pt} Interestingly, all files were recovered successfully in the TRIM OFF analysis from the four forensics Samsung NVMe and Seagate NVMe SSD images, respectively. This is because the TRIM OFF feature prevents the computer’s operating system from notifying the SSD to erase useless data blocks. Thus, the SSD controller no longer manages all of the available storage space. Hence, in our experiment, the controller chip did not wipe/clear the pages of the storage devices. Therefore, this time the contents of all the files were intact. i.e., files could be opened and worked on regularly. Furthermore, there was no instance of file corruption in the case. Tables \ref{nvme_usb_wb_table4c}, \ref{nvme_usb_wb_table4c1}, \ref{nvme_usb_wb_table4d}, and \ref{nvme_usb_wb_table4d1} show the statistics of different files used and the files that were recovered.

\input{chapters/ashar_chapter_06_nvme_usb_wb_table4c}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table4c1}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table4d}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table4d1}

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sam_toff file over 693 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 693 bytes in Samsung NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig29}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig29} shows a snippet of the Set-1-xml(296).xml file in the Samsung NVMe SSD TRIM OFF case using a USB WriteBlocker. The file over 693 bytes in size was opened in the WinHex tool to be analyzed. As seen from the experimental results, the file was recovered, and the contents of the file were not wiped. \\

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sam_toff file under 693 bytes proof-1.png}
	\caption{File, Set-1-xml(15).xml, under 693 bytes in Samsung NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig30}
\end{figure}
\noindent \hspace{50pt} Figure \ref{fig30}  shows a snippet of the Set-1-xml(15).xml file with regards to the Samsung NVMe SSD TRIM ON case using a USB WriteBlocker. The file under 693 bytes was opened in the Win Hex tool. The file was recovered and intact. Moreover, the file contents were not wiped, as shown in WinHex. 

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sg_toff file over 693 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 696 bytes in Seagate NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig31}
\end{figure}
\noindent \hspace{50pt} Figure \ref{fig31} shows a snippet of the Set-1-xml(296).xml file with regards to the Seagate NVMe SSD TRIM OFF case using a USB WriteBlocker. The file over 696 bytes in size was opened in the WinHex tool. As seen from the experimental results, the file was recovered, and the contents of the file were not wiped out.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sg_toff file under 693 bytes proof-1.png}
	\caption{File, Set-1-xml(15).xml, under 696 bytes in Seagate NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig32}
\end{figure}
\vspace{-5mm}
\noindent \hspace{50pt} Figure \ref{fig32}  shows a snippet of the Set-1-xml(15).xml file with regards to the Seagate NVMe SSD TRIM ON case using a USB WriteBlocker. The fil under 696 bytes was opened in the Win Hex tool. The file was recovered and intact. Moreover, the file contents were not wiped, as shown by the hexadecimal characters.

\pagebreak
\addcontentsline{toc}{section}{Hash Analysis for Samsung and Seagate NVMe SSDs}
\section*{Hash Analysis for Samsung and Seagate NVMe SSDs}
\noindent \hspace{50pt} In this section, we exhibited our findings via MD5 hash values of the files following the TRIM ON and OFF recovery operations. We used the QuickHash hashing tool to generate hash values.

\noindent \hspace{50pt} Initially, the hash value of the original file is displayed, followed by TRIM ON and TRIM OFF MD5 hashes, and file size for Samsung NVMe SSD, shown in figure \ref{fig33}. Similarly, figure \ref{fig34} shows the hash values of the original file, followed by TRIM ON and TRIM OFF MD5 hashes, and file size in the Seagate NVMe SSD case. These figures aim to validate and verify the claims made due to experimental observation.

%\newpage
\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/samsung_hashes.png}
	\caption{Hash values of Set-1-xml(15).xml and Set-1-xml(296).xml files in original dataset, and after recovery from TRIM ON and OFF cases in Samsung NVMe SSD.}
	\label{fig33}
\end{figure}
%\newpage
\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/seagate_hashes.png}
	\caption{Hash values of Set-1-xml(15).xml and Set-1-xml(296).xml files in original dataset, and after recovery from TRIM ON and OFF cases in Seagate NVMe SSD.}
	\label{fig34}
\end{figure}

\noindent \hspace{50pt} Table \ref{nvme_usb_wb_table4e_hash} shows the names of all forensically acquired images, image type, size in kilobytes, MD5 and SHA1 hashes. The hash of all the image files constantly changed through the steps of the experiment. For example, in the case of TRIM OFF, the hash values of all the forensic images changed even though exact files were recovered. In the case of TRIM ON for Samsung and Seagate NVMe SSDs, the hash values of all the forensics images were different. Furthermore, file recovery was impossible when the file size was greater than 693 bytes in Samsung and 696 in Seagate, respectively.

\input{chapters/ashar_chapter_06_nvme_usb_wb_table4e_hash}
%\Needspace{5\baselineskip}

%\noindent \hspace{50pt} Table \ref{nvme_usb_wb_table4e_hash} shows the names of all forensically acquired images, image type, size in kilobytes, MD5 and SHA1 hashes. The hash of all the image files constantly changed through the steps of the experiment. For example, in the case of TRIM OFF, the hash values of all the forensic images changed even though exact files were recovered. In the case of TRIM ON for Samsung and Seagate NVMe SSDs, the hash values of all the forensics images were different. Furthermore, file recovery was impossible when the file size was greater than 693 bytes in Samsung and 696 in Seagate, respectively. 

\newpage
\begin{doublespace}
\addcontentsline{toc}{section}{Western Digital and Silicon Power TRIM ON Analysis}
\section*{Western Digital and Silicon Power TRIM ON Analysis}
\medskip
\noindent \hspace{50pt} The analysis of TRIM ON cases in Western Digital and Silicon Power shows a similar trend in file recovery procedures as seen in the Seagate NVMe SSD. The controller chip did not act on files under 696 bytes in Western Digital and Silicon Power storage devices. As a result, all files under 696 bytes were intact without any file content corruption. However, when the files’ size was greater than 696 bytes in Western Digital and Silicon Power NVMe SSDs, the files’ contents were cleared or zeroed out and hence rendered unusable. Tables \ref{nvme_usb_wb_table5a}, \ref{nvme_usb_wb_table5a1}, \ref{nvme_usb_wb_table5b}, and \ref{nvme_usb_wb_table5b1} show the statistics of different files used and the files that were recovered.

\input{chapters/ashar_chapter_06_nvme_usb_wb_table5a}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5a1}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5b}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5b1}

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wd_ton file over 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 696 bytes in Western Digital NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig35}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig35} shows a snippet of an XML file with regards to the Western Digital NVMe SSD TRIM ON case using a USB WriteBlocker. The file over 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered, and the contents of the file were wiped out.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wd_ton file under 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, under 696 bytes in Western Digital NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig36}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig36} shows a snippet of an XML file with regards to the Western Digital NVMe SSD TRIM ON case using a USB WriteBlocker. The file under 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered and the contents of the file were not wiped.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sp_ton file over 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 696 bytes in Silicon Power NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig37}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig37} shows a snippet of an XML file with regards to the Silicon Power NVMe SSD TRIM ON case using a USB WriteBlocker. The file over 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered, and the contents of the file were wiped out.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sp_ton file under 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, under 696 bytes in Silicon Power NVMe SSD TRIM ON case, with using a USB WriteBlocker.}
	\label{fig38}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig38} shows a snippet of an XML file with regards to the Silicon Power NVMe SSD TRIM ON case using a USB WriteBlocker. The file under 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered, and the contents of the file were not wiped out.

\newpage
\addcontentsline{toc}{section}{Western Digital and Silicon Power TRIM OFF Analysis}
\section*{Western Digital and Silicon Power TRIM OFF Analysis}
%\medskip

\noindent \hspace{50pt}File recovery with TRIM OFF of four forensics Western Digital and Silicon Power NVMe SSD images, using AccessData FTK and Autopsy tools was successful. This happened because the TRIM OFF feature stops the operating system from informing the SSD to erase unusable data blocks. Hence, the NVMe SSD controller no longer oversees the available storage space to its full potential. Therefore, the controller chip did not clear out the pages so the contents of all the files were intact i.e., files could be viewed, opened, and worked on consistently. Furthermore, there was no instance of file corruption in the case. Tables \ref{nvme_usb_wb_table5c}, \ref{nvme_usb_wb_table5c1}, \ref{nvme_usb_wb_table5d}, and \ref{nvme_usb_wb_table5d1} show the statistics of different files used and the files that were recovered.

\input{chapters/ashar_chapter_06_nvme_usb_wb_table5c}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5c1}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5d}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5d1}

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wd_toff file over 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 696 bytes in Western Digital NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig39}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig39} shows a snippet of an XML file with regards to the Western Digital NVMe SSD TRIM OFF case using a USB WriteBlocker. The file over 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered and the contents of the file were not wiped out.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wd_toff file under 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, under 696 bytes in Western Digital NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig40}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig40} shows a snippet of an XML file with regards to the Western Digital NVMe SSD TRIM OFF case using a USB WriteBlocker. The file under 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered and the contents of the file were not wiped out.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sp_toff file over 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, over 696 bytes in Silicon Power NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig41}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig41} shows a snippet of an XML file with regards to the Silicon Power NVMe SSD TRIM OFF case using a USB WriteBlocker. The file over 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered and the contents of the file were not wiped out.

\newpage
\begin{figure}[htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sp_toff file under 696 bytes proof-1.png}
	\caption{File, Set-1-xml(296).xml, under 696 bytes in Silicon Power NVMe SSD TRIM OFF case, with using a USB WriteBlocker.}
	\label{fig42}
\end{figure}

\noindent \hspace{50pt} Figure \ref{fig42} shows a snippet of an XML file with regards to the Silicon Power NVMe SSD TRIM OFF case using a USB WriteBlocker. The file under 696 bytes was opened in the WinHex tool. As seen from the experimental results, the file was recovered and the contents of the file were not wiped out.

\pagebreak
\addcontentsline{toc}{section}{Hash Analysis for Western Digital and Silicon Power NVMe SSDs}
\section*{Hash Analysis for Western Digital and Silicon Power NVMe SSDs}

\noindent \hspace{50pt} In this section, we presented our findings via MD5 hash values of the files following the TRIM ON and OFF recovery operations. We used the QuickHash hashing tool to generate the hash values.

\noindent \hspace{50pt} The hash value of the original file is displayed, followed by TRIM ON and TRIM OFF MD5 hashes, and file size for Western Digital NVMe SSD, as shown in figure \ref{fig43}. Similarly, Figure \ref{fig44} shows the hash values of the original file, followed by TRIM ON and TRIM OFF MD5 hashes, and file size in the Silicon Power NVMe SSD case. The figures aim to validate and verify the claims which were made due to experimental observation.

%\newpage
\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/wd_hashes.png}
	\caption{Hash values of Set-1-xml(15).xml and Set-1-xml(296).xml files in original dataset, and after recovery from TRIM ON and OFF cases in Western Digital NVMe SSD.}
	\label{fig43}
\end{figure}
%\newpage
%\vspace{-2pt}
\begin{figure}[H]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch6_usb_nvme_wb/sp_hashes.png}
	\caption{Hash values of Set-1-xml(15).xml and Set-1-xml(296).xml files in original dataset, and after recovery from TRIM ON and OFF cases in Silicon Power NVMe SSD.}
	\label{fig44}
\end{figure}

\noindent \hspace{50pt} Table \ref{nvme_usb_wb_table5e_hash} contains the names of all forensically obtained images, as well as their types, sizes in kilobytes, and MD5 and SHA1 hashes. Throughout the experiment, the hash of all the image files changed regularly. In the case of TRIM OFF, for example, the hash values of all the forensic images were altered even if exact files were recovered. However, for the TRIM ON case for WD and SP NVMe SSDs, the hash values of all forensics images were different, and file recovery was not feasible when the file size exceeded 696 bytes.
\end{doublespace}
\input{chapters/ashar_chapter_06_nvme_usb_wb_table5e_hash}
%\Needspace{5\baselineskip}
%\vspace{-2pt}
%\noindent \hspace{50pt} Table \ref{nvme_usb_wb_table5e_hash} contains the names of all forensically obtained images, as well as their types, sizes in kilobytes, and MD5 and SHA1 hashes. Throughout the experiment, the hash of all the image files changed regularly. In the case of TRIM OFF, for example, the hash values of all the forensic images were altered even if exact files were recovered. However, for the TRIM ON case for WD and SP NVMe SSDs, the hash values of all forensics images were different, and file recovery was not feasible when the file size exceeded 696 bytes.
\end{justify}
\end{doublespace}