期刊名称：Journal of Digital Forensics, Security and Law
印刷版ISSN：1558-7215
电子版ISSN：1558-7223
出版年度：2014
卷号：9
期号：2
页码：12
出版社：Association of Digital Forensics, Security and Law
摘要：This paper explores the forensic implications of Apple’s Fusion Drive. The Fusion Drive is an example of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Data is moved between the drives automatically to maximize system performance. This is different from traditional caches because data is moved and not simply copied. The research included understanding the drive structure, populating the drive, and then accessing data in a controlled setting to observe data migration strategies. It was observed that all the data is first written to the flash drive with 4 GB of free space always maintained. If data on the magnetic drive is frequently accessed, it is promoted to the flash drive while demoting other information. Data is moved at a block-level and not a file-level. The Fusion Drive didn’t alter the timestamps of files with data migration.
关键词：file system; forensics; fusion drive; mac; digital forensics; computer forensics.
