CHFI Storage Forensics and File System Analysis Practice Question
Which THREE of the following are challenges specific to SSD forensics compared to HDD forensics?
⚠ Common exam trap
EC-CHFI often tests the distinction between HDD-specific features (like platter rotation and magnetic remanence) and SSD-specific challenges, so candidates mistakenly select HDD-related options because they sound technical, but they do not apply to solid-state drives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Garbage collection that automatically erases stale blocks
Option A is correct because SSD garbage collection proactively erases blocks containing stale or invalid pages in the background, so data that would remain recoverable on an HDD platter can be destroyed without any user action. Option B is correct because the TRIM command tells the SSD controller which LBAs are no longer in use, allowing those flash pages to be erased and making deleted data unrecoverable far faster and more thoroughly than on an HDD. Option C is correct because wear leveling relocates data across NAND blocks to spread erase cycles, so logical-to-physical mapping changes constantly and forensic tools cannot rely on fixed physical locations the way they can with HDD platters. Option D is not correct because platter rotation and magnetic remanence are characteristics of HDDs, not SSD-specific challenges. Option E is not correct because controller-based compression is not a defining SSD forensic challenge in the way garbage collection, TRIM, and wear leveling are, and it is not marked as a correct answer here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Garbage collection that automatically erases stale blocks
Why this is correct
Garbage collection is a background process in SSD controllers that consolidates valid data into fewer blocks and then erases entire blocks containing stale pages. Because it runs autonomously without any operating system command, it can physically erase data from deleted files before an investigator can image the drive, destroying remnants that might otherwise be recovered through file carving or chip-off analysis.
- ✓
TRIM command causing data erasure
Why this is correct
The TRIM command is an ATA interface instruction sent by the OS after file deletion, telling the SSD that specific logical block addresses are no longer in use. In response, the SSD's firmware immediately invalidates and schedules those physical pages for erasure, permanently removing the deleted data. Unlike garbage collection, TRIM is directly tied to the delete operation and can make deleted file contents unrecoverable almost instantly, even with advanced forensic tools.
- ✓
Wear leveling algorithms that relocate data
Why this is correct
Wear leveling algorithms spread write operations evenly across all flash memory blocks to extend SSD lifespan, frequently relocating and rewriting data without changing logical addresses. This means a file's data can be physically scattered across many blocks and moved during idle time, overwriting formerly free space and degrading the integrity of contiguous remnants. Such relocations complicate forensic analysis because logical-to-physical mappings change dynamically, making traditional recovery based on file system metadata unreliable.
- ✗
Platter rotation causing magnetic remanence
Why it's wrong here
Platter rotation is exclusive to hard disk drives, where data is stored magnetically on spinning platters and remnants can persist as magnetic fields after deletion. SSDs have no platters and store data in non-volatile NAND flash cells, so magnetic remanence and degaussing concerns do not apply. Thus, this option is incorrect because it describes an HDD-specific artifact that has no equivalent in solid-state storage.
- ✗
Controller-based compression reducing data size
Why it's wrong here
While some SSD controllers do apply data compression to increase effective capacity and reduce write amplification, the compression is handled transparently within the controller and is fully reversible during read operations. The compressed data itself is not a barrier to forensic recovery, as the original logical bytes can be reconstructed if the controller's algorithm is understood. Therefore, compression is not a challenge unique to SSD forensics; the real difficulties come from autonomous erasure and address remapping, not from data being merely compressed.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.