Hi
Longtime lurker, first time poster.

Since "swapping PCB's" turned into "swapping chips" several years ago, I do mainly filesystem and logical recoveries now (with the occasional broken USB or power connector replacement).

I've been waiting for a reliable solution for complete bit by bit imaging of SSD's and still haven't seen anything. I understand that forensics are stumped with things like TRIM and garbage collection changing the state of the drive just by powering it on but I am only concerned with recovery.

The solution I need would be some combination of copying the flash translation layer (FTL) and copying the contents of the raw NAND flash chips.

So far, I've been lucky and have been able to do recoveries by just reading what the FTL gives me as a regular HDD but I am worried that someday there may be problems with SSD's that will require a deeper analysis of the contents. Specifically, getting the state of everything the first time I power it on so that I can get deleted data or partitions before the drive automatically makes them unavailable or in the event of repairable damage to the structure of the data in the FTL.

Maybe I'm asking for something that will never be necessary but with the increase in consumer SSD's I've been asked to work on, I'd like to be prepared

I have seen papers about techniques for bypassing the FTL to securely erase the NAND chips but nothing about reading them directly. Does anyone know of anything that can access SSD's on this level for imaging/recovery purposes?

Thanks in advance,
James

Pc3000 flash ssd+ pc3000 udma can do it on partial controller.

Thanks.

I see that they recently upgraded it last month so that there are a few models of SSD's that can have the RAM dumped without unsoldering the Flash chips from the board and putting them in a reader.

Have you used this? How easy is it to work with the RAM dump, I mean, does it try to organize it for you or do you have to always carve out the data/filesystem yourself?
Their website went down for me before I could find any info on that.

James