CHFI Storage Forensics and File System Analysis Practice Question
Which THREE of the following present unique challenges for forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select THREE.)
⚠ Common exam trap
A common misconception is that TRIM, garbage collection, and wear leveling are the only SSD-specific challenges, while candidates may incorrectly assume that slack space analysis or fragmentation are also unique to SSDs, when in fact they are common to both HDDs and SSDs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wear leveling that moves data around the NAND chips
Option B is correct because SSD controllers implement wear leveling, which continuously relocates logical blocks across physical NAND pages to spread erase cycles, so a logical address no longer maps predictably to a fixed physical location and traditional imaging/address-based recovery assumptions break down. Option D is correct because garbage collection runs in the background, copying valid pages into new blocks and erasing blocks containing stale data, which can destroy deleted-file remnants before an examiner images the drive and can alter the drive contents after acquisition. Option E is correct because the TRIM command (ATA DATA SET MANAGEMENT / SCSI UNMAP) notifies the SSD that deleted LBAs are no longer needed, prompting the controller to erase those NAND blocks and making deleted data unrecoverable, unlike HDDs where deleted clusters typically persist until overwritten. Option A is not a unique SSD challenge, since 512-byte sector emulation (512e/4Kn) and slack space issues also arise on modern HDDs and are not specific to flash media. Option C is not unique either, as fragmentation from file system aging occurs on HDDs as well and is actually mitigated on SSDs by the flash translation layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Slack space analysis due to 512-byte sector emulation
Why it's wrong here
SSDs present wear-levelling and TRIM challenges, not slack-space issues tied to 512-byte emulation; that emulation concerns logical versus physical sector reporting, not slack analysis itself. The option tempts because slack space is a classic HDD forensic artefact. On SSDs, controller-level remapping and garbage collection obscure deleted data instead.
- ✓
Wear leveling that moves data around the NAND chips
Why this is correct
Wear levelling spreads writes across NAND chips by relocating data to fresh blocks, so a file's physical location changes independently of the file system. This breaks the assumption that logical addresses map predictably to physical ones, complicating data recovery and timeline reconstruction.
- ✗
Fragmentation due to file system aging
Why it's wrong here
Fragmentation from file-system aging affects HDDs and SSDs alike, so it is not unique to SSDs. The option tempts because fragmentation is a familiar storage concern, and analysts associate it with forensic recovery difficulty. SSD-specific challenges instead stem from wear levelling, TRIM, and the controller's out-of-band garbage collection, which relocate or erase blocks independently.
- ✓
Garbage collection that consolidates valid data and erases stale blocks
Why this is correct
SSD controllers run garbage collection in the background, consolidating valid pages and erasing stale blocks without host involvement. This can destroy deleted data and alter the drive's logical-to-physical mapping before imaging, so the examiner cannot rely on the physical layout remaining stable.
- ✓
TRIM command that erases deleted data blocks
Why this is correct
The TRIM command lets the operating system tell the SSD controller which blocks are no longer needed, prompting near-immediate erasure. Deleted files may therefore be unrecoverable within seconds, unlike HDDs where residual data persists until overwritten.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.