Inferring File System of Solid State Drives based on Current Consumption

Abstract

With the increasing demand for faster reliable secondary storage, Solid State Drives (SSDs) have provided a viable replacement for Hard Disk Drives (HDDs). SSDs contain NAND flash memory components and a processor that executes firmware at the device level to optimize performance. The on-board processor and firmware handle operations such as garbage collection and encryption with no visibility to the user. Therefore, classifying SSD internal behavior can help identify compromised devices. This paper utilizes high precision measurements of power used by an SSD via an oscilloscope, to infer a drive's file system format. We consider four file systems (NTFS, exFAT, FAT32 and EXT4) and demonstrate that frequency analysis of power consumption can identify the system in use. In particular, we show that transforming the frequency-domain power signature with principal components analysis can produce a small number of highly predictive features. Using a k-NN classifier, we then demonstrate that these features enable an SSD's power signature to identify the correct file system 94.3 percent accuracy on a Samsung SSD and with 96.5 percent accuracy on a Crucial SSD.