Different flash operations (read / write / erase) have different power requirements. This is probably due to fact that an erase operation requires 4 times the voltage, about 20v, than what a read operation requires, about 5v. So idea is that power consumption gives clues about what a flash drive is doing. I am assuming the same goes for SSDs as it’s the exact same technique used.

Trimmed or zeroed?

Obviously first symptom of a trimmed drive is we’re reading back zeros (or some repeating pattern like 0xFF). But these can be result of writes too.

So what I wanted to test, and these videos are just initial tests to see if there’s any truth in this hypothesis, is if I can detect of a seemingly empty flash drive is zero filled or that translator is wiped as a result of a TRIM like operation. There seems to be a small but measurable difference in power consumption while reading from a zero (or FF pattern, I measured no differences between the two) filled drive and one with a wiped translator (due to TRIM for example). In both cases this flash drive reads back FF pattern.

So it may sound like it is the same thing but it is not. From a data recovery perspective it may be useful to know if the translator was reset rather than the drive being overwritten by zeros: In the first case data may be recoverable, in case of the overwrite it is not.

Testing and spotting differences

I noticed no significant difference in read speeds, this however may be due to test setup and is not what I expected to see. I did notice the line while reading with wiped FTL seems flatter:

I’ll need more tests, I expect read after FTL wipe to be faster than reading from zero or pattern filled drive because the drive with zeroed FTL does not have to actually read the NAND. Interestingly the power consumption tests do seem to support the hypothesis:

There are small but measurable differences in power consumption, first video reads a zero filled drive the 2nd reads after translator is wiped:

We see it frequently go into 0.070+ Amperage. Values appear more volatile compared to value observed during next test.

We see it stays below 0.070+ Amps, seems to stay mainly around 0.066 Amps.

Finally some other interesting results

There are more dramatic differences in consumption between the flash drive being zero or pattern filled (video 1) and the translator being wiped (last video). Note that part of wiping translator process is verifying NAND, so the flash drive is being read as well during that.

Future research

Of course the above is far from conclusive. I tested a single USB flash drive with a cheap inline USB voltage/AMP meter. Ideally I want to test SD Cards and NVMe SSD drives as well. A slightly nicer inline measuring device will allow me to save the data (EDIT: On order).

EDIT: Got an inline Volt/Amp meter with logging feature, result:

It would be cool if we eventually can determine by looking at power consumption if a drive is zero filled or if it does return zeros or a pattern due to the translator being reset. In case it isn’t possible to determine generic values then at least we could get a same model device, zero fill it and compare results with the patient device.

Credits

Although I did consider there could be speed differences between ‘trimmed’ or zeroed space, and after reading about charge pumps in NAND flash memory also differences in power consumption, more recent “finds” made me decide to give it more serious consideration:

First user csava’s in HDDGuru refreshed the idea: https://forum.hddguru.com/viewtopic.php?f=13&t=43834

And recently a member of the datarecovery professionals collective posted a video on ‘glitching’ to ‘hack’ protected NAND flash memory: https://youtu.be/WfkLPKsVmQg