CHFI Storage Forensics and File System Analysis Practice Question
Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives? (Select 3)
⚠ Common exam trap
The CHFI exam often tests the misconception that SSDs behave like HDDs in terms of data persistence and imaging speed, leading candidates to incorrectly select options about platters or rotational latency instead of recognizing the unique firmware-level challenges of TRIM, garbage collection, and wear leveling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TRIM command may permanently erase deleted data
Option A is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller which LBAs are no longer in use, allowing those flash pages to be erased during idle garbage collection, so deleted data may be irrecoverably gone rather than merely unallocated as on an HDD. Option D is correct because garbage collection operates autonomously in the background, erasing whole flash blocks that still contain remnants of deleted files, so evidence can disappear between the time of seizure and acquisition. Option E is correct because wear leveling transparently relocates logical blocks to different physical NAND pages to spread erase cycles, breaking the fixed LBA-to-physical-sector mapping that forensic tools rely on and complicating file-system and deleted-file reconstruction. Option B is wrong because SSDs use NAND flash memory, not magnetic platters, so degaussing is inapplicable (and would not affect flash). Option C is wrong because SSDs have no rotating platters or actuator arms, so rotational latency is not a factor; they are generally faster to image than HDDs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TRIM command may permanently erase deleted data
Why this is correct
The TRIM command instructs the SSD controller to immediately erase blocks of data marked for deletion, bypassing the file system’s logical deletion. This destroys residual data at the physical NAND flash level, unlike HDDs where deleted files remain on platters until overwritten. This satisfies the stem’s constraint of a challenge specific to SSD forensic analysis, as TRIM prevents recovery of deleted files.
- ✗
SSDs have platters that can be degaussed to destroy data
Why it's wrong here
This is incorrect because SSDs have no magnetic platters at all; they store data in NAND flash cells as trapped electrical charge, not as magnetic domains. Degaussing is a method for erasing magnetic media such as traditional HDDs by randomizing the magnetic alignment, but it has no effect on the charge state of NAND transistors. Therefore, an SSD cannot be 'degaussed to destroy data' in the same way an HDD can, making this a false statement rather than a forensic challenge.
- ✗
SSDs are slower to image because of rotational latency
Why it's wrong here
This is wrong because SSDs contain no rotating platters and no read/write heads, so rotational latency is a purely mechanical delay known only to HDDs. SSDs access data electronically from NAND flash memory, which gives them near-instant access times and generally faster imaging performance than HDDs. While some SSDs may exhibit slower imaging due to controller bottlenecks or USB interfaces, rotational latency is not a factor.
- ✓
Garbage collection can erase blocks containing deleted files before acquisition
Why this is correct
This is correct: modern SSDs employ garbage collection, a background process that reclaims pages by erasing entire blocks that contain invalid (deleted) data. When a file is deleted, the SSD controller may proactively erase those physical blocks to maintain a pool of free space, permanently destroying the residual data before an investigator can image the drive. Because this occurs autonomously at the flash translation layer, it can erase evidence that would have remained recoverable on an HDD.
- ✓
Wear leveling moves data across blocks, complicating file system analysis
Why this is correct
This is correct: wear leveling is a technique used by SSD controllers to distribute program/erase cycles evenly across all NAND flash blocks, preventing early failure of heavily used cells. As a result, the controller constantly moves logical data to different physical locations, breaking the traditional one-to-one correlation between logical block addresses and physical sectors. For forensic analysis, this means data fragments may be scattered across the device and file system artifacts may not reside where conventional evidence recovery tools expect, requiring extra effort to reconstruct evidence.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.