The Repository @ St. Cloud State

Open Access Knowledge and Scholarship

Culminating Project Title

Comparing SSD Forensics with HDD Forensics

Date of Award


Culminating Project Type

Starred Paper

Degree Name

Information Assurance: M.S.


Information Assurance and Information Systems


Herberger School of Business

First Advisor

Mark B. Schmidt

Second Advisor

Lynn Collen

Third Advisor

Sneh Kalia

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License.

Keywords and Subject Headings

Digital Forensics, SSD Forensics, HDD Forensics, SSD vs HDD, Data Recovery, SSD Autopsy


The technological industry is growing at an unprecedented rate; to adequately evaluate this shift in the fast-paced industry, one would first need to deliberate on the differences between the Hard Disk Drive (HDD) and Solid-State Drive (SSD). HDD is a hard disk drive that was conventionally used to store data, whereas SSD is a more modern and compact substitute; SSDs comprises of flash memory technology, which is the modern-day method of storing data. Though the inception of data storage began with HDD, they proved to be less accessible and stored less data as compared to the present-day SSDs, which can easily store up to 1 Terabyte in a minuscule chip-size frame. Hence, SSDs are more convenient and user-friendly, where, in contrast, HDDs often require some degree of technical knowledge. However, since SSDs are still a relatively new phenomenon, it has proved to create myriads of problems in the digital forensics department. Since, SSDs are still a more modern concept, the tools that digital forensics employ to investigate evidence obtained from HDDs are not proving to be as efficient; this is primarily due to the fact that data in flash memory drives can only be written if the data unit or data block is erased, ergo, an erase operation occurs every time before something is written into the flash memory. Therefore, the aim of this research is to critically analyze the results obtained by running forensic tools on an HDD and SSD; the results would pertain to the image generated from the HDD and SSD.