NAND Flash Wear Leveling
Definition
The SSD controller's policy of spreading writes across physical blocks so no single block wears out first. The side effect for forensics is that the physical block holding a file may have nothing to do with the logical block the OS sees.
- Purpose
- Spread writes across physical blocks to prevent uneven wear
- Managed by
- SSD controller
- Forensic implication
- Physical block location may not match logical block seen by the OS
- Related concept
- NAND flash erase block
Common questions
Why does wear leveling complicate a forensic disk image comparison?+
Because the controller remaps logical addresses to different physical cells over time to spread wear evenly, two disk images taken at different times can show identical logical content while the underlying physical layout has changed, and a raw physical dump does not correspond directly to sector-level file locations the way it does on a traditional hard drive.
Can wear leveling cause remnants of old data to remain accessible in unexpected ways?+
Yes, because a logical write does not always overwrite the same physical cells as the previous version, older physical copies of data can persist in blocks the OS considers free or reallocated, which is why flash forensics often requires chip-level or controller-level analysis rather than relying on standard logical imaging alone.
Does wear leveling apply the same way to all flash-based storage?+
The general principle applies across NAND-based SSDs and similar flash media, but the specific algorithm, remapping table structure, and how much of it is exposed to forensic tools varies by controller manufacturer and firmware, so recovery techniques are not uniformly portable across devices.
Related terms
- BIOS / UEFI
- Firmware on a flash chip on the motherboard that runs at power-on, initialises hardware, and hands control to a bootloader. UEFI is...
- Chipset (PCH)
- The motherboard logic that bridges CPU, RAM, PCIe lanes, SATA, USB and the firmware (UEFI/BIOS). On Intel boards the Platform Controller Hub;...
- CMOS Battery
- A small lithium cell (typically CR2032) that keeps the real-time clock and a few firmware settings alive when the system is unplugged....
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...