Monitoring Device Current to Characterize Trim Operations of Solid-State Drives

Solid-state drives (SSDs) are pervasive in modern computing and have supplanted hard disk drives in many applications. Substantial changes in architecture have brought about not only improvements in speed and energy usage but also new security concerns. The presence of proprietary firmware onboard SSD controllers in particular raises the possibility that data believed by a user or operating system to be deleted physically remains on the drive and can thus be recovered. This security issue has a direct application to malware detection, digital forensics, and consumer privacy. To begin to address this, we propose a novel, noninvasive side-channel approach to infer the SSD trim operation. We demonstrate that it is possible to infer the trim operation with better than 99% accuracy using current probe measurements in conjunction with machine learning techniques. We find that the sampling frequency can be reduced to 200 kSps while maintaining greater than 80% of the total power in the 0-1 MHz band. The classifier accordingly uses only information in the frequency range between 0 and 100 kHz in achieving its high accuracy. We also validate our current probe measurement technique by comparing it with an in-line resistor.