CHFI Storage Forensics and File System Analysis Practice Question

Which TWO of the following are challenges in SSD forensics compared to traditional HDD forensics? (Choose two.)

⚠ Common exam trap

EC-Council often tests the misconception that TRIM is a challenge only for deleted data recovery, but candidates must also recognize wear leveling as a separate, equally critical challenge that affects the forensic recovery of both deleted and existing files.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Wear leveling distributes data across blocks, making it harder to recover specific files

Option B is correct because wear leveling is an SSD controller function that deliberately writes data to different physical NAND blocks to spread erase cycles evenly, so logical addresses no longer map predictably to physical locations and file fragments become scattered, making recovery of specific files far harder than on an HDD where LBAs map directly to fixed platters/sectors. Option C is correct because the TRIM command, issued by the OS (e.g., via ATA DATA SET MANAGEMENT or SCSI UNMAP), tells the SSD controller that deleted blocks are no longer needed, allowing garbage collection to erase them almost immediately, which destroys residual data that would otherwise remain recoverable on an HDD until overwritten. Option A is wrong because SSDs are fully compatible with standard forensic imaging tools such as dd, FTK Imager, and EnCase; the challenge is write-blocking and controller behavior, not tool compatibility. Option D is wrong because capacity is not a forensic challenge unique to SSDs, and SSDs are not inherently larger than HDDs. Option E is wrong because physical damage resistance is not a recognized forensic challenge distinguishing SSDs from HDDs in this context.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SSDs are not compatible with forensic imaging tools
Why it's wrong here
SSDs are fully compatible with industry-standard forensic imaging tools—tools such as dd, FTK Imager, and EnCase access storage at the logical block level via ATA/SATA or NVMe commands, so they can acquire a complete bit-for-bit image from an SSD just as from an HDD. The real hurdle is not compatibility, but the SSD controller’s Flash Translation Layer, which may reorder or remap physical blocks during imaging, making the image only a logical snapshot of data that is concurrently moving underneath. Thus, the premise of incompatibility is false.
✓
Wear leveling distributes data across blocks, making it harder to recover specific files
Why this is correct
In order to prolong NAND flash lifespan, the SSD’s firmware uses wear leveling to dynamically remap logical block addresses across different physical memory cells, so a file's sectors are not stored contiguously or predictably in physical flash. Since the Flash Translation Layer hides the current physical location of each logical block, forensic carving tools that reconstruct files based on contiguous clusters or expected sector order are often defeated. Additionally, wear leveling may copy data to new blocks while the old block is erased, further destroying remnants of previously deleted files before the examiner ever acquires the drive.
✓
TRIM command causes deleted data to be erased quickly
Why this is correct
When a file is deleted, the operating system sends an ATA TRIM command or NVMe Deallocate command to mark the associated logical blocks as invalid, allowing the SSD’s garbage-collection process to erase the corresponding physical NAND pages immediately or in the near background. In contrast to a traditional HDD, where deleted data remains physically intact until overwritten, TRIM causes the flash cells to be cleared of data, drastically shrinking the forensic recovery window to the time between file deletion and the next TRIM/garbage-collection cycle. This makes 'deleted file recovery' a race against the drive’s own housekeeping routines, and most consumer operating systems issue TRIM by default.
✗
SSDs have larger storage capacity than HDDs
Why it's wrong here
Capacity is a physical attribute, not a forensic challenge—larger HDDs (up to 20 TB) exist in the enterprise market, and SSDs typically cost significantly more per gigabyte, making them less common for extreme-capacity storage. Even if an SSD were larger, the only impact would be longer imaging durations and larger evidence file sizes, which equally applies to similarly sized HDDs. Therefore, storage capacity is not a distinguishing problem unique to solid-state media.
✗
SSDs are more resistant to physical damage
Why it's wrong here
It is true that SSDs, lacking spinning platters and moving read/write heads, can survive physical shocks and drops that would instantly destroy an HDD. However, from a forensic standpoint, this physical durability is an advantage, not a hindrance—it means the media is more likely to be healthy and collectible. The actual forensic difficulties are all logical and firmware-driven, including wear leveling, TRIM, and garbage collection, which have nothing to do with the drive’s tolerance to physical damage.

Go deeper

CHFI Storage Forensics and File System Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question