Flash Translation Layer (FTL)
Definition
Firmware inside the flash storage controller that maps logical block addresses to physical NAND blocks and implements wear levelling. Deleted files may persist in out-of-mapping physical blocks until the FTL recycles them, creating a window for forensic recovery.
- Location
- Flash storage controller firmware
- Function
- Maps logical block addresses to physical NAND blocks
- Also handles
- Wear levelling
- Forensic relevance
- Deleted data persists in unmapped physical blocks until recycled
Common questions
Why does the FTL complicate forensic recovery compared to a traditional hard drive?+
On a hard drive, logical and physical addressing are essentially the same, so a deleted file's data stays at a predictable location. The FTL's mapping and wear-levelling logic mean physical location no longer matches logical address, and the controller decides when to actually erase or reuse old blocks, outside the examiner's direct control.
How long does deleted data typically survive on flash storage before the FTL recycles it?+
There is no fixed window. It depends on the device's garbage collection algorithm, how much free space remains, and how actively the device is used afterward, which is why examiners try to acquire a device as soon as possible after deletion rather than assuming recoverability.
Related terms
- Baseband Processor
- A separate processor that manages all radio functions: cellular calls, SMS, and data connections. It runs its own real-time OS and holds...
- eMMC (Embedded MultiMediaCard)
- A flash storage standard that packages NAND memory chips and a controller into one soldered module using a parallel interface. Common in...
- Secure Enclave / Trusted Execution Environment (TEE)
- A hardware-isolated execution environment within the SoC that stores device-unique encryption keys and handles cryptographic operations. The encryption key never leaves this...
- System on Chip (SoC)
- A single integrated circuit that combines the application processor, GPU, memory controller, image signal processor, and often the secure enclave. The SoC...
- UFS (Universal Flash Storage)
- A newer flash storage standard using a serial interface that allows simultaneous reads and writes. Faster than eMMC and common in flagship...