NAND Flash Erase Block
Definition
The minimum unit that can be electrically erased in NAND flash memory. Erase blocks are larger than write pages (often 256 KB to 4 MB). The OS writes at page granularity but erases at block granularity, so a block containing deleted sectors cannot be cleared until all live pages in the block have been relocated.
- Definition
- Minimum electrically erasable unit in NAND flash
- Typical size
- 256 KB to 4 MB
- Write granularity
- Page (smaller than an erase block)
- Forensic implication
- Deleted-page data can persist until the whole block is erased
Common questions
Why can deleted data sometimes still be recovered from NAND flash?+
Because erasure only happens at the block level, a page marked deleted by the file system may remain physically intact on the chip until the controller decides to erase and reclaim the whole block containing it, which can leave recoverable data present for some time after logical deletion.
What is the relationship between erase blocks and garbage collection?+
Garbage collection is the controller process that relocates any still-live pages out of a block, then erases the entire block so it can be reused; this is what eventually removes deleted data at the physical level, and its timing is controller-dependent and not directly controlled by the examiner.
Does TRIM affect erase block behavior?+
TRIM tells the controller which logical pages are no longer needed by the file system, letting garbage collection skip relocating them and erase the containing block sooner, which speeds up permanent removal of deleted data and reduces the window in which forensic recovery is possible.
Related terms
- File-Based Encryption (FBE)
- An Android encryption model introduced in Android 7.0 in which each file is encrypted with a separate key derived from the user...
- SQLite Free Page
- A database page that SQLite has placed on an internal free-page list after a row deletion. The page retains its original content...
- Thumbnail Cache
- A store of small preview images generated by the OS or applications when media is first viewed. On Android the primary cache...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
- Wear Levelling
- A flash controller algorithm that distributes write operations across all blocks evenly to prevent any single block from wearing out prematurely. A...