Exploring Forensic Implications of the Fusion Drive

Authors

Shruti Gupta, Purdue UniversityFollow
Marcus Rogers, Purdue UniversityFollow

Prior Publisher

The Association of Digital Forensics, Security and Law (ADFSL)

Abstract

This paper explores the forensic implications of Apple’s Fusion Drive. The Fusion Drive is an example of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Data is moved between the drives automatically to maximize system performance. This is different from traditional caches because data is moved and not simply copied. The research included understanding the drive structure, populating the drive, and then accessing data in a controlled setting to observe data migration strategies. It was observed that all the data is first written to the flash drive with 4 GB of free space always maintained. If data on the magnetic drive is frequently accessed, it is promoted to the flash drive while demoting other information. Data is moved at a block-level and not a file-level. The Fusion Drive didn’t alter the timestamps of files with data migration.

References

AppleInsider. (2013). Apple’s mac shipments decline in u.s. as pc market slows. Retrieved 2013-03-11, from http://appleinsider.com/articles/ 13/01/10/apples-mac-shipments -decline-in-us-as-pcmarket-slows

Apple support. (2013). Retrieved 2013-01-28, from {http://support.apple.com/kb/ HT5446}

Bazzani, K. (2010, March 24). Hybrid-device storage based on environmental state. Google Patents. (US Patent App. 12/730,838)

Beebe, N. L., Stacy, S. D., & Stuckey, D. (2009). Digital forensic implications of zfs. digital investigation, 6 , S99--S107.

Denning, P. J. (2005). The locality principle. Communications of the ACM , 48 (7), 19--24.

Duplessie, S. (2004). A blueprint for tiered storage. [White Paper]. Retrieved from http://images.apple.com/xserve/ raid/pdf/ Tiered\ Storage\ Whitepaper.pdf

Fairbanks, K. D., Lee, C. P., & Owen III, H. L. (2010). Forensic implications of ext4. In Proceedings of the sixth annual workshop on cyber security and information intelligence research (p. 22).

Garfinkel, S. L., & Migletz, J. J. (2009). New xml-based files: implications for forensics (Tech. Rep.). DTIC Document.

Hayes, D. R., & Qureshi, S. (2009). Implications of microsoft vista operating system for computer forensics investigations. In Systems, applications and technology conference, 2009. lisat’09. ieee long island (pp. 1--9).

Hutchinson, L. (2012). Achieving fusionwith a service training doc, ars tears open apples fusion drive. Retrieved 2013-03-11, from http://arstechnica.com/apple/2012/ 11/achieving-fusion-with-a-service -training-docars-tears-open-apples -fusion-drive/2

NetMarketShare. (2013). Operating system market share. Retrieved 2013-03-11, from http://www.netmarketshare.com/ operating-system-marketshare.aspx

Peron, C. S., & Legary, M. (2005). Digital anti-forensics: emerging trends in data transformation techniques. In Proceedings of.

Purcher, J. (2012). Apple fulfills patent with the imac’s new fusion drive. Retrieved 2013-02-15, from http://www.patentlyapple.com/ patentlyapple/2012/10/ apple-fulfills-patent-with-the -imacs-new-fusion-drive.html

Schuster, A. (2008). The impact of microsoft windows pool allocation strategies on memory forensics. digital investigation, 5 , S58--S64.

Shimpi, A. (2013). A month with apple’s fusion drive. Retrieved 2013-01-28, from http://www.anandtech.com/show/ 6679/ a-month-with-applesfusion-drive

Solomon, J., Huebner, E., Bem, D., & Sze˙zynska, M. (2007). User data persistence in physical memory. Digital Investigation, 4 (2), 68--72.

Stein, P. (2012). Fusion drive on older macs? yes! Retrieved 2013-03-28, from http://jollyjinx.tumblr.com/

Recommended Citation

Gupta, Shruti and Rogers, Marcus (2014) "Exploring Forensic Implications of the Fusion Drive," Journal of Digital Forensics, Security and Law: Vol. 9 , Article 12.
DOI: https://doi.org/10.15394/jdfsl.2014.1177
Available at: https://commons.erau.edu/jdfsl/vol9/iss2/12