Wear-Leveling
Definition
A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell. As a side effect, deleted data may remain in physically distant pages that the file system no longer maps, creating a window for forensic recovery.
- Function
- Distributes writes across flash memory cells
- Purpose
- Prevents premature failure of any single cell
- Forensic effect
- Deleted data may persist in unmapped pages
- Relevant to
- Mobile device and SSD examinations
Common questions
Why does wear-leveling make flash recovery harder than recovery from a hard drive?+
The controller, not the file system, decides which physical cells hold which logical data, and it remaps blocks continuously. An examiner cannot rely on a simple logical-to-physical map the way they can with a magnetic disk, so recovery depends on chip-level access or controller support.
Can wear-leveling cause data recovered from a device to be incomplete or misleading?+
Yes. Because old, unmapped pages may hold partial or stale versions of a file, recovered fragments should be validated against file system metadata and other pages rather than treated as a complete, current copy.
Related terms
- App Sandbox Container
- An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
- iOS Keychain
- A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
- NAND Flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
- Plist (Property List)
- A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...