Skip to content

Wear-leveling

Definition

A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell. As a side effect, deleted data may remain in physically distant pages that the file system no longer maps, creating a window for forensic recovery.

Related terms

App sandbox container
An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
iOS Keychain
A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
NAND flash
The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
Plist (property list)
A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
SQLite
A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...

Explained in

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.