5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)

5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)

Quick Answer: When acquiring Redundant Arrays of Independent Disks (RAID), investigators must image member drives individually and assemble them via virtual reconstruction by defining six parameters: RAID level, member disk order, stripe size, starting offset, parity distribution, and rotation direction. Parity in RAID 5 relies on the XOR ($\oplus$) boolean function, allowing bit-for-bit reconstruction of a single failed disk. Solid-State Drives (SSDs) introduce severe anti-forensic challenges: because NAND flash cannot overwrite in place, the OS issues the ATA TRIM command upon file deletion. In modern Deterministic Read Zero after TRIM (DZAT) drives, the Flash Translation Layer (FTL) immediately returns 0x00 for deallocated clusters, rendering traditional unallocated file carving useless even when residual data physically persists in un-erased NAND blocks.

---

RAID Architectures & Forensic Mechanics

Enterprise servers, storage area networks (SAN), and network-attached storage (NAS) devices aggregate physical disks into logical arrays to achieve high throughput and fault tolerance. In forensic investigations, seizing or analyzing a RAID array presents unique challenges:

• Never rely on live controller rebuilds: Rebuilding an array onto a hot-spare drive modifies timestamps, recalculates parity, and permanently destroys deleted file artifacts.
• Acquire individual physical bit-stream images: The investigator must clone each physical drive independently using hardware write-blockers, then reconstruct the array virtually in a forensic workstation (using FTK Imager, EnCase, X-Ways, or Linux mdadm).

+-------------------------------------------------------------------------+
|                        COMMON RAID CONFIGURATIONS                       |
+-------------------------------------------------------------------------+
| RAID 0: Block Striping (No parity; 0 fault tolerance; maximum speed)    |
| RAID 1: Mirroring (100% redundancy; 1 to N-1 drive fault tolerance)    |
| RAID 5: Distributed Single Parity (XOR parity; 1 drive fault tolerance) |
| RAID 6: Dual Distributed Parity (P+Q parity; 2 drive fault tolerance)  |
| RAID 10: Striped Mirrors (1+0; nested performance + mirror redundancy)  |
+-------------------------------------------------------------------------+

Technical Comparison of RAID Levels

---

Mathematical Parity in RAID 5 & Reconstruction Mechanics

RAID 5 distributes single parity across all member drives, rotating the parity block across each consecutive stripe to eliminate write bottlenecks. Parity is calculated using the Exclusive-OR (XOR, represented as $\oplus$) logic gate.

XOR Boolean Principles

• $0 \oplus 0 = 0$
• $0 \oplus 1 = 1$
• $1 \oplus 0 = 1$
• $1 \oplus 1 = 0$

Rule: If the number of 1s is odd, the result is 1. If the number of 1s is even, the result is 0.

The Reconstruction Proof

Assume a 4-disk RAID 5 array where Stripe 0 holds data blocks on Disk 0, Disk 1, Disk 2, and the Parity block on Disk 3:
$P = D_0 \oplus D_1 \oplus D_2$

Now suppose Disk 1 physically fails. Because XOR is commutative and associative, the missing data on Disk 1 is mathematically recovered by XORing all surviving disks with the parity block:
$D_1 = D_0 \oplus D_2 \oplus P$

                    WORKED RAID 5 RECONSTRUCTION EXAMPLE
-------------------------------------------------------------------------
Disk 0 (Data 0):   1 1 0 0 1 0 1 0  (0xCA)
Disk 1 [FAILED]:   ? ? ? ? ? ? ? ?  (Missing Data to Reconstruct)
Disk 2 (Data 2):   1 0 1 0 0 1 1 1  (0xA7)
Disk 3 (Parity P): 1 1 1 1 0 0 0 1  (0xF1)
-------------------------------------------------------------------------
Step 1: Compute D0 XOR D2:
        1 1 0 0 1 0 1 0  (D0)
    XOR 1 0 1 0 0 1 1 1  (D2)
    -------------------
        0 1 1 0 1 1 0 1  (Intermediate Result)

Step 2: XOR Intermediate Result with Parity P:
        0 1 1 0 1 1 0 1  (Intermediate Result)
    XOR 1 1 1 1 0 0 0 1  (Parity P)
    -------------------
        1 0 0 1 1 1 0 0  (0x9C) ====> Reconstructed Data for Disk 1!

---

Virtual RAID Reconstruction Parameters

To reassemble an array virtually without the original controller hardware, an investigator must determine six structural parameters:

+-------------------------------------------------------------------------+
|                 THE SIX RAID RECONSTRUCTION PARAMETERS                  |
+-------------------------------------------------------------------------+
| 1. RAID Level:           Architecture (0, 1, 5, 6, 10)                  |
| 2. Disk Sequence:        Logical ordering of member drives (Disk 0..N-1)|
| 3. Stripe Size (Depth):  Block size per disk (e.g., 64 KB, 128 KB)      |
| 4. Starting Offset:      LBA where array payload begins (skipping RAID  |
|                          controller configuration headers)              |
| 5. Parity Distribution:  Symmetric vs. Asymmetric                       |
| 6. Parity Rotation:      Left (backward) vs. Right (forward)            |
+-------------------------------------------------------------------------+

Parity Rotation & Distribution Schemes

In RAID 5, the parity block moves to a different physical disk on each successive stripe. The four classic parity layouts are:

1. Left Symmetric (Backward Dynamic): Parity starts on the last disk (Disk $N-1$) for Stripe 0 and moves left (backward: $3 \to 2 \to 1 \to 0$). Data blocks continue numbering sequentially across surviving disks without interruption. This is the default standard in Linux software RAID (mdadm).
2. Left Asymmetric (Backward Static): Parity moves left, but after passing the parity block, the data block sequence resets back to the lowest-numbered disk in that stripe.
3. Right Symmetric (Forward Dynamic): Parity starts on Disk 0 for Stripe 0 and moves right (forward: $0 \to 1 \to 2 \to 3$). Data blocks continue sequentially.
4. Right Asymmetric (Forward Static): Parity moves right, and data blocks reset to the lowest-numbered disk.

   LEFT SYMMETRIC (mdadm default)           LEFT ASYMMETRIC
 Disk 0  Disk 1  Disk 2  Disk 3       Disk 0  Disk 1  Disk 2  Disk 3
+-------+-------+-------+-------+    +-------+-------+-------+-------+
| Data0 | Data1 | Data2 | Par 0 |    | Data0 | Data1 | Data2 | Par 0 |
| Data3 | Data4 | Par 1 | Data5 |    | Data4 | Data5 | Par 1 | Data3 |
| Data6 | Par 2 | Data7 | Data8 |    | Data7 | Par 2 | Data6 | Data8 |
| Par 3 | Data9 | Data10| Data11|    | Par 3 | Data9 | Data10| Data11|
+-------+-------+-------+-------+    +-------+-------+-------+-------+

Forensic Techniques for Determining Parameters

• Determining Disk Order: Inspect LBA 0 of each image. The disk holding the MBR, Protective MBR, or GPT header is typically Disk 0. Examine contiguous data structures (such as the NTFS Master File Table $MFT, where each record is exactly 1,024 bytes). If $MFT record 0 is on Disk 0, record 1 is on Disk 0, but record 64 appears on Disk 1, the drive order and stripe size become immediately apparent.
• Determining Stripe Size: Scan member images for large, contiguous files (e.g., JPEGs, PDFs). Identify the hex offset where the file structure abruptly breaks off on Disk 0 and resumes on Disk 1. The difference between the start offset and the break offset equals the Stripe Size (commonly 64 KB = 128 sectors, or 128 KB = 256 sectors).
• Determining Starting Offset: Many hardware controllers (HP Smart Array, LSI MegaRAID, Dell PERC) reserve the first 1 MB to 2 MB (LBA 2048 or 4096) on each member disk for controller firmware metadata and event logs. The virtual reconstruction must start at this offset rather than physical sector 0.

Solid-State Drive (SSD) Forensics & Architectural Challenges

Solid-State Drives (SSDs) store data using non-volatile NAND flash memory chips. While SSDs present themselves to the operating system as standard block devices indexed by Logical Block Addresses (LBA), their internal physical architecture behaves radically differently from magnetic media, creating the toughest anti-forensic challenge in modern digital forensics.

NAND Flash Organization: The Page vs. Block Dilemma

NAND flash memory is organized into a strict physical hierarchy:

• Cell: Stores electrical charges (electrons) in floating-gate or charge-trap transistors. Categorized by density: SLC (1 bit/cell), MLC (2 bits), TLC (3 bits), QLC (4 bits).
• Page: The smallest physically readable and writeable (programmable) unit. Typically sized at 4 KB, 8 KB, or 16 KB.
• Block: A collection of consecutive pages (typically 128 to 512 pages, spanning 2 MB to 8 MB). The block is the smallest unit of erasure.

+-------------------------------------------------------------------------+
|                    THE CARDINAL RULE OF NAND FLASH                      |
+-------------------------------------------------------------------------+
| Reads occur at the:     PAGE level (e.g., 4 KB)                         |
| Writes occur at the:    PAGE level (e.g., 4 KB)                         |
| Erasures occur ONLY at: BLOCK level (e.g., 256 Pages = 1 MB - 4 MB)     |
| In-place overwriting is IMPOSSIBLE: You cannot rewrite a page without   |
| erasing the entire block first!                                         |
+-------------------------------------------------------------------------+

When a file is modified, the SSD controller cannot overwrite the existing physical page. Instead, it writes the updated data to an entirely new, freshly erased physical page, marks the old physical page as stale (invalid), and updates its internal mapping table.

The Flash Translation Layer (FTL)

The Flash Translation Layer (FTL) is a proprietary firmware operating system running on the SSD's onboard microcontroller. It sits between the host interface (SATA/NVMe) and the raw NAND flash chips. The FTL maintains a dynamic lookup table mapping the host's Logical Block Addresses (LBA) to the actual Physical Block/Page Addresses (PBA).

Wear Leveling Algorithms

NAND flash cells can only withstand a finite number of Program/Erase (P/E) cycles before the insulating oxide layer breaks down permanently (typically 30,000–100,000 cycles for SLC; 1,000–3,000 cycles for TLC; 500–1,000 cycles for QLC). To prevent premature drive failure, the FTL executes Wear Leveling:

• Dynamic Wear Leveling: Routes new incoming writes to blocks with the lowest erase counts.
• Static Wear Leveling: Proactively moves stagnant, rarely modified data (e.g., operating system system files) out of low-erase blocks into higher-wear blocks, freeing up low-wear blocks for dynamic write cycles.
• Forensic Implication: A specific logical sector does not correlate to any fixed physical location on the NAND flash. Physical pages are continuously shifted across the flash matrix without operating system knowledge.

Garbage Collection (GC)

Because NAND flash cannot overwrite pages in place, the drive would eventually run out of writeable pages. The FTL resolves this through Garbage Collection (GC):

1. The controller scans for blocks containing a high proportion of invalid (stale) pages.
2. It reads the remaining valid pages from that block and copies them into an entirely new, erased block.
3. It applies a high-voltage pulse to the entire original block, erasing all pages back to 1s (0xFF).
4. The erased block is returned to the pool of available free blocks.

[!CAUTION] The Autonomous Firmware Threat: Garbage Collection is controlled internally by the SSD firmware microcontroller—not by the operating system. When an investigator connects a seized SSD to power (even through a hardware write-blocker), the SSD microcontroller boots its own firmware. If left powered on in an idle state, the controller's internal Garbage Collection will autonomously erase stale NAND blocks, permanently destroying deleted file remnants.

---

The ATA TRIM Command & Deterministic Zeroing (DZAT)

On magnetic hard drives, deleting a file merely unlinks its directory pointer and marks its clusters as unallocated in the file system allocation table ($Bitmap in NTFS). The actual magnetic data remains indefinitely until overwritten by a future file.

On SSDs, this historical behavior causes severe write performance collapse. Because the SSD controller does not parse file system tables, it cannot know that a file was deleted; it assumes those LBAs still contain valid data and continues copying them during Garbage Collection, causing severe Write Amplification.

To solve this, storage committees introduced the ATA TRIM command (standardized as DATA SET MANAGEMENT in ATA/ATAPI-8) and its counterparts: SCSI UNMAP for enterprise SAS drives and Dataset Management / Deallocate in NVMe.

                    THE DESTRUCTIVE LIFECYCLE OF TRIM
+-------------------------------------------------------------------------+
| 1. User Deletes File: OS marks clusters unallocated in $Bitmap.         |
| 2. OS Issues TRIM:   OS passes deallocated LBA range to SSD controller. |
| 3. FTL Unmaps LBA:   FTL severs LBA-to-PBA mapping; marks PBA as stale.  |
| 4. DZAT Takes Over:  Any subsequent host read to that LBA returns 0x00. |
| 5. GC Erasure:       Controller erases physical NAND block in background.|
+-------------------------------------------------------------------------+

The Three Types of TRIM Read Behavior

The ATA specification defines three distinct levels of read behavior following a TRIM command:

1. Non-Deterministic TRIM: Successive read requests to trimmed LBAs may return old residual data, new data, or random values.
2. Deterministic Read after TRIM (DRAT): Read requests to trimmed LBAs return a consistent, deterministic data pattern (e.g., all 0xFF or a fixed vendor pattern).
3. Deterministic Read Zero after TRIM (DZAT): Read requests to trimmed LBAs strictly return all zeros (0x00). This is the universal standard across modern consumer and enterprise SSDs (Samsung, Western Digital, Crucial, Intel).

The Forensic Crisis of DZAT

DZAT presents a catastrophic challenge to traditional digital forensics:

• The Illusion of Empty Space: When a suspect deletes a folder of incriminating documents on a TRIM-enabled SSD and empties the Recycle Bin, the operating system issues a TRIM command. The FTL immediately severs the LBA pointers.
• Imaging Returns Zeros: If a forensic investigator captures a physical bit-stream image (E01 or RAW) using FTK Imager or dd, the imaging software sends standard ATA/NVMe read commands to each LBA. When the drive controller reaches the unallocated LBAs, the FTL immediately serves pure zeros (0x00).
• Carving Fails Completely: File carving utilities (Foremost, Scalpel, PhotoRec) searching for file headers (0xFF 0xD8 0xFF for JPEG, %PDF- for PDF) in the unallocated space find only gigabytes of contiguous 0x00 bytes. The examiner mistakenly concludes that the data was securely wiped, even though the raw data may still physically exist on the NAND chips awaiting Garbage Collection.

---

Advanced Forensic Recovery & Extraction Workarounds

When investigating SSDs where critical evidence has been deleted, traditional forensic imaging tools connected to standard write-blockers are insufficient. Forensic practitioners employ specialized mitigation protocols:

1. Live System TRIM Suppression

If triaging a live system before powering down, an investigator can immediately disable OS-level TRIM notification to prevent future TRIM commands from firing during investigation:

# Query Windows TRIM status (0 = Enabled, 1 = Disabled)
fsutil behavior query DisableDeleteNotify

# Immediately disable NTFS and ReFS TRIM execution on a live system
fsutil behavior set DisableDeleteNotify 1

2. Suppressing Power to Prevent Garbage Collection

Because Garbage Collection executes during idle power states, examiners must never leave an acquired SSD connected to power while idle. The drive must remain unpowered until the exact moment of imaging, and imaging should proceed at maximum throughput.

3. Vendor Technological Mode (Factory Safe Mode)

Hardware forensic engineering suites like the ACE Laboratory PC-3000 SSD bypass the drive's normal SATA/NVMe operating interface:

• The examiner connects to the SSD's printed circuit board (PCB) and bridges designated hardware diagnostic test points (Safe Mode jumpers) to prevent the SSD microcontroller from loading its internal microcode.
• The PC-3000 software uploads custom manufacturer technological loaders directly into the drive's RAM buffer.
• This grants low-level access to the drive's Service Area, allowing the examiner to read raw NAND flash memory directly, bypassing the FTL translation table and DZAT masking.
• Stale pages that have been trimmed but not yet erased by Garbage Collection can be fully recovered from the raw physical dump.

4. Chip-Off Forensics

When SSD firmware is completely unresponsive or controller-level commands fail, examiners utilize destructive chip-off forensics:

1. The SSD PCB is mounted in an infrared or hot-air surface-mount rework station.
2. The BGA (Ball Grid Array) or TSOP NAND flash chips are desoldered at controlled temperatures (~220°C to 240°C) to prevent silicon die destruction.
3. The desoldered NAND chips are cleaned and placed into specialized chip programmer sockets (such as the UP-828 or PC-3000 Flash).
4. A complete physical dump of every page, block, and spare area (containing ECC bytes) is extracted.
5. Specialized flash reconstruction software (Rusolut Visual NAND or SoftCenter Flash Extractor) mathematically simulates the proprietary FTL algorithm, wear leveling rotations, and XOR data scramblers to reconstruct the logical file system.