Journal of Digital Forensics, Journal of Digital Forensics,

Security and Law Security and Law

Volume 9 Number 2 Article 12

2014

Exploring Forensic Implications of the Fusion Drive Exploring Forensic Implications of the Fusion Drive

Shruti Gupta Purdue University

Marcus Rogers Purdue University, rogersmk@purdue.edu

Follow this and additional works at: https://commons.erau.edu/jdfsl

Part of the Computer Engineering Commons, Computer Law Commons, Electrical and Computer

Engineering Commons, Forensic Science and Technology Commons, and the Information Security

Commons

Recommended Citation Recommended Citation Gupta, Shruti and Rogers, Marcus (2014) "Exploring Forensic Implications of the Fusion Drive," Journal of Digital Forensics, Security and Law: Vol. 9 : No. 2 , Article 12. DOI: https://doi.org/10.15394/jdfsl.2014.1177 Available at: https://commons.erau.edu/jdfsl/vol9/iss2/12

This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of Scholarly Commons. For more information, please contact commons@erau.edu.

(c)ADFSL

Exploring Forensic Implications of the Fusion Drive JDFSL V9N2

EXPLORING FORENSIC IMPLICATIONS OF THE

FUSION DRIVEShruti Gupta and Marcus Rogers

Purdue University401 N. Grant St., IN 47906, Unites States

{shruti,rogersmk}@purdue.edu

ABSTRACT

This paper explores the forensic implications of Apple’s Fusion Drive. The Fusion Drive is anexample of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Datais moved between the drives automatically to maximize system performance. This is differentfrom traditional caches because data is moved and not simply copied. The research includedunderstanding the drive structure, populating the drive, and then accessing data in a controlledsetting to observe data migration strategies. It was observed that all the data is first written to theflash drive with 4 GB of free space always maintained. If data on the magnetic drive is frequentlyaccessed, it is promoted to the flash drive while demoting other information. Data is moved at ablock-level and not a file-level. The Fusion Drive didn’t alter the timestamps of files with datamigration.

Keywords: file system, forensics, fusion drive, mac, digital forensics, computer forensics.

1. INTRODUCTION

A digital investigation can potentially involveany kind of operating system or file system. Maccomputers from Apple are gaining prominence.As of 2012, they were the 3rd largest manufac-tured personal computers (AppleInsider, 2013).In the United States, the Mac OS X operat-ing system represents 10% of the market shareand globally it represents 7% (NetMarketShare,2013). Digital investigations are based on manytechnical and non-technical judgments. If theenvironmental factors are different from the nor-mal scenarios then it might lead to errors injudgment (Peron & Legary, 2005). Thus, it isimportant for the investigating officers to be wellinformed about systems that are different fromthe norm even in small ways. Therefore, evenwith PCs leading the market, there is a needto be technically sound with the functionalityof Mac OS X operating systems to be able toretrieve all information from it.

Apple Inc. introduced the Fusion Drive inDecember 2012 with their Mac-mini and iMacmodels (Hutchinson, 2012). The Fusion Driveconsists of a flash drive and a magnetic drive,which appears to be one single logical drive tothe end-user. This can have many forensic im-plications related to the structure of the drive,the location of the files and the timestamps onthe files. This paper explores the challengesthat might be presented to forensic investiga-tors as they face the Fusion Drive (FD). Thepaper first gives a background about the tech-nical specifications of the fusion drive. It thenexplores other research studies that have similargoals. The next section describes the natureof the methodology that was used. The paperconcludes with observations seen from the studyand the conclusions that can be drawn from it.

c© 2014 ADFSL Page 145

This work is licensed under a Creative Commons Attribution 4.0 International License.

JDFSL V9N2 Exploring Forensic Implications of the Fusion Drive

2. BACKGROUND

In 2010, Apple filed a patent (Bazzani, 2010)describing a hybrid drive technology that onlinesources suggest implements the Fusion Drive(Purcher, 2012). The patent describes a storagedevice that combines flash memory with a mag-netic drive. It also mentions that the addressspace might be dynamically allocated based onthe nature of the usage activity on the driveand the nature of the applications being used.However, this is where the similarity with theFD ends. The patents claims that data storageis mainly allocated based on the environmentalstate of the drive. Example of change in theenvironmental state includes change in tempera-ture, vibration of the drive or acceleration of thedrive. This hasn’t been mentioned in any litera-ture related to the Fusion Drive. The patent alsomentions that all data is written to the hard diskdrive (HDD) first and then if there is a changein the state of the HDD, data can be writtento the flash memory. This appears to be con-trary to the functioning of the FD, which seemsto write all data to the solid-state drive (SSD)first. Thus, while there are similar features, theauthors do not believe that the patent filed in2010 explicitly describes the Fusion Drive.

The Fusion Drive essentially implements theconcept of auto-tiered storage, which is not newby any means. Tiered storage simply impliesthat data is hierarchically sorted by the systemaccording to predetermined factors, to maximizesystem performance (Duplessie, 2004). In autotiering, the user is not involved in the storagedecisions. The concept of hierarchical storagemanagement has always existed in the main-frame world. While it is still commonly used inthe mainframe world, the concept of tiered stor-age is still new in personal computers (Duplessie,2004).

However, tiering should not be confused withcaching. Tiering and caching are similar con-cepts that have roots in the principle of localityof reference. It involves identifying a neighbor-hood in which a particular object operates, andoptimizing the system performance within thatneighborhood by manipulating the computation

of the system (Denning, 2005). However, unliketraditional SSD architectures, the Fusion Drivedoes not use the concept of caching (Shimpi,2013). The total capacity of the FD is the com-bined sum of the capacity of the hard driveand the flash drive. This is the main differ-ence between the FD and existing technologieslike Intel’s Smart Response Technology (SRT).Caching mechanisms like SRT algorithmicallydetermine what things should be mirrored upfrom the HDD onto the SSD. In this caching sce-nario, the default location of the data is alwaysthe HDD with the SDD being used as a writecache. In caching, the main interaction is donewith the hard drive and the solid-state drive isused to enhance performance.

In the Fusion Drive, the solid-state drive isthe device that the user mainly interfaces andthe magnetic drive is used to add to the stor-age capacity of the solidstate drive (Hutchinson,2012). Also, while SSD caches mostly allocatedata based on the frequency of read access, theFD appears to take write accesses into consider-ation while allocating storage for data. To sumit up, the technology at a higher level is verysimilar to other Original Equipment Manufac-turers (OEM) that use hybrid drives in theirPCs. The main difference lies in the capacity ofthe flash memory and the underlying softwarelayer (Shimpi, 2013).

The Fusion Drive is available with capaci-ties of 1 TB and 3 TB. The Mac mini or theiMac can have the 1 TB drive while the 3 TBcan only be seen on the 27-inch iMac. As men-tioned earlier, the FD combines a solid-statedisk (128GB Samsung PM830) and a traditionalhard disk (2.5 or 3.5) using the Core Storagetechnology. Core Storage is a logical volumemanager that allows the operating system totreat multiple physical disks as a single volumeand it was first seen in the Lion operating sys-tem (Shimpi, 2013). It aims to combine thespeed of the flash memory with the capacity ofthe magnetic drive. Four main Core Storagecalls are employed for the data-migration ac-cording to the activity shown by the commandfs usage. These are RdChunkCS, WrChunkCS,RdBgMigrCs, and WrBgMigCS. These calls are

Page 146 c© 2014 ADFSL

Exploring Forensic Implications of the Fusion Drive JDFSL V9N2

made sequentially and form the crux of the auto-tiering happening on the drive. Data is movedin blocks of 128 KB between the drives. Whilethe data structures that store usage data are notknown, the drive is not using Hot File Clusteringseen on earlier Macs that use solid state drives(Hutchinson, 2012). Later sections discuss moreabout the granularity of the data being moved.

The documentation provided by Apple men-tions that only one additional partition couldbe added to the FD. This partition would beadded to the HDD and it wont have any fusioncapabilities. There is no way to add partitionson the SSD (Apple Support , 2013). The Recov-ery partition, which can be seen on operatingsystems succeeding OS X 10.7, is contained inthe HDD. This has implications that the systemcan still boot in case the flash memory crashes.

3. PREVIOUS RESEARCH

The broad scope of the paper is to examinethe forensic implications of auto-tiered storagethat uses different types of storage devices. Asmentioned earlier, auto-tiered storage has beencommonly used in mainframes since the lastdecade but there isn’t much literature that dealsspecifically with the forensic significance of auto-tiered storage or technical specifications of Fu-sion Drive operation. For lack of more related lit-erature, the literature review addresses researchstudies that discuss the forensic implications ofa new technology.

Beebe, Stacy, and Stuckey (2009) examinedthe forensic implications of the ZFS file systemby SunMicrosystems. Just like the Fusion Driveby Apple, ZFS differed from the conventionalsystems in terms of functionality, disk layout,architecture etc. The researchers present anoverview of the new file system and then discussthe implications it might have for the foren-sic community. Schuster (2008) conducted astudy to examine the effect of the pool alloca-tion strategies used by Microsoft Windows onforensic examination. To study this, the authordesigns an experiment in a controlled environ-ment where snapshots of memory are taken overa period of time with new processes being in-

voked in a systematic manner. This allowed himto study the changes in the memory with eachnew process being invoked.

Fairbanks, Lee, and Owen III (2010) exploredthe forensic implications of the EXT4 file system.In typical fashion for these studies, they presentan overview of the file system highlighting thechanges from older systems. They then performa controlled experiment where they populate thefile system with known files and attempt to over-write all the files with zeroed information. Theauthors observed that while it appears that alldata has been over-written, traces of the test filecan still be seen. They discuss the functionalityof the file system that can be attributed to thisanomaly and discuss the forensic implications ofthe findings. Hayes and Qureshi (2009) explorethe forensic implications of the Vista operatingsystem, which was new at the time. They out-line the new features of the operating system andthe forensic implications of the features. Specifi-cally they discuss the changes to the NTFS filesystem, which includes modifications to the logfiles and security mechanisms like the inclusionof encryption and changes in the metadata.

Lastly, Garfinkel and Migletz (2009) publishedresearch related to the forensic significance ofthe new XML file formats. They explored thefile structures related to the new document for-mats and present ways in which these aid digitalinvestigation by contributing to better methodsin data carving and data recovery.

4. METHODOLOGY

The aim of the research was to understand thechanges in the forensic process brought aboutby using the Fusion Drive. There were threemain goals of the research:

• Identify how the disk structure of the Fu-sion Drive differs from traditional drives

• Identify the data movement strategy be-tween the drives

• Identify how the movement of the databetween the two disks affects the modify-access-create (MAC) times.

c© 2014 ADFSL Page 147

JDFSL V9N2 Exploring Forensic Implications of the Fusion Drive

The setup consisted of a 2012 iMac with a3.1TB storage capacity on the Fusion Drive run-ning Mac OS X version 10.8.2. The testingenvironment did not emulate a real life situationwith a user freely accessing data and applica-tions on the system. On the contrary, the testenvironment was extremely controlled while ma-nipulating the movement of selected data. Thecorresponding disk activity was observed to un-derstand the underlying storage allocation strat-egy. Schuster (2008) used a similar approachfor his research.

4.1 Identifying the Structure of theDisks

The first step was to analyze the available detailsof the drive on the system that could be used todistinguish between the two physical disks. Asseen in Figure 1, the main storage informationfor the hard drive simply shows one drive whilementioning the presence of both the drives.

If we go to Disk Utility as seen in Figure 2,we see the device configuration of both the drives.This menu gives more details about the hardwareconfiguration of both the drives including thedrive interface type and the capacity of eachdrive. However, it does not provide informationabout current data usage on the drives or thenames allocated to the individual drives. Finally,the diskutil command was used to identify thenotations used for the individual drives. Theoutput is discussed in the Results section.

4.2 Analyzing the Movement ofData

A similar study to analyze the data movementstrategy of the FD was published in a web logby Stein (2012) . In the present study, the drivewas populated with 200 GB in the form of 20folders with each folder containing 100 files of10 MB each. Random data was written usingdd command with /dev/urandom as the inputfile. The drive initially had approximately 100GB used. Disk activity was monitored using theiostat command, which shows rates at whichdata is being transferred to a particular disk.

As a next step, certain files were repeatedlyaccessed and the data migration activity was

observed. Files were also accessed at both block-level and file-level to estimate the granularityof the data being moved. (Solomon, Huebner,Bem, & Szezynska, 2007) has used a similarapproach to study persistence of data in memory.They made controlled changes to the system andtook snapshots of the memory to analyze howthe allocation changes with system changes thatemulate a users usual behavior on the system.

5. RESULTS

This section outlines the results obtained fromthe experiment. It also presents some discus-sion about the importance of the results andsiginificance of the same.

5.1 Identifying the Structure of theDisks

Figure 3 shows the output of using the diskutilcommand in the terminal. We can see the no-tations that are used for the individual drives.In this particular drive, the flash drive is calleddisk0 and the magnetic drive is called disk1.Again, we can see the individual disk capacitiesbut we cannot see the individual disk utiliza-tion. The logical volume that combines disk0and disk1 is called disk2. Many commercial diskanalysis tools were employed to see how thedrives are detected and all of them representedthe disks as a single logical drive. A tool callediStat Menus showed the presence of multipledisks in the disk activity graph but any infor-mation about data storage was represented ona single logical volume.

5.2 Analyzing the Movement ofData

As data was pushed to the logical drive, it wasnoticed that all the writes were directly made tothe SDD till about 20 GB. After that the writeswere directly going to the HDD. Since the size ofthe SDD is 20 GB, we can deduce that all writesgo to the SDD first till the SDD is full and thenthe data continues to be written to the HDD.Figure 4 illustrates this, where the shift in diskactivity between writing to the flashmemory andthe hard drive is seen. The first three columnsshow the disk activity for the SDD and the next

Page 148 c© 2014 ADFSL

Exploring Forensic Implications of the Fusion Drive JDFSL V9N2

Figure 1 Device Storage Information Shown Under Storage Menu

Figure 2 Device Storage Information Under the Disk Utility Menu

three columns show the disk activity for theHDD.

As soon as the last file was created, activitywas seen on both drives (Figure 5) with data be-ing read from disk0 (SDD) and being written todisk1 (HDD). The direction of data movement isestimated using the command fs usage, whichis indicated by the Core Storage read/write calls(Figure 6). This indicates data being transferredfrom the flash drive to the magnetic drive. Thisis done for around 4GB, which verifies the claimsthat the flash memory keeps a buffer area of 4GB open for incoming files (Shimpi, 2013).

In the next step, to see how data is promoted

form the hard drive to the flash drive, we sim-ulated a scenario where a user accesses certainfiles frequently. The files from folders 15-20 wereassumed to be the files accessed frequently. Thefirst megabyte from folders 15-20 was read con-tinuously in a loop. This was done once all readactivity had ceased from any previous steps. Asmentioned earlier, each folder contained 10 GBof random data; so 50 GB of random data wasbeing read continuously. As data is read fromthe files, it is first read from the HDD and thenactivity is seen both in the hard drive and theSSD. This is probably because as data is con-tinuously read in a loop, it is promoted to the

c© 2014 ADFSL Page 149

JDFSL V9N2 Exploring Forensic Implications of the Fusion Drive

Figure 3 Output of the diskutil Command Showing Both Drives

flash drive. The activity again moves back toSDD, which indicates that the promoted datais being read from the flash drive now. Thesethree transitions can be seen in Figure 7.

After the data-reading loop is stopped, thereis activity between the flash memory and theHDD where data is written to the HDD (Figure8). This is the FD demoting other data to freethe 4 GB space on the flash drive.

The data-reading step is repeated again. How-ever, this time the whole file is read insteadof simply the first megabyte from each file. Itcan be seen in Figure 9 that the first MB istaken from the SSD and the rest is read fromthe HDD. This shows us two interesting features.First that the data previously read was indeedmoved to the SSD (in the form of 1 MB fromeach file) and secondly that the data is moved

Page 150 c© 2014 ADFSL

Exploring Forensic Implications of the Fusion Drive JDFSL V9N2

Figure 4 Output of the iostat Command Showing Transfer of Activity from the Flash Drive (disk0)to the Magnetic Drive (disk1)

Figure 5 Disk Activity Seen on Both Drives When Data is Being Transferred from the Flash Driveto the Magnetic Drive to Free 4 GB

Figure 6 Core Storage Calls Indicating the Direction of Data Movement

at blocklevel and not file level.

Between each step, the purge command wasused to flush out the cache. It was seen that ifdata is being read from previously being storedon the cache then the FD does not promote thedata from the HDD. In another words, cachecontents are not taken into consideration forstorage allocation. Lastly, the MAC times of

the files were observed and it was seen that asdata is moved between disks, the MAC timesdo not show any anomalous behavior. It hasalready been established that everything in theFusion Drive gets written to the flash drive first.Thus the created time remains the time at whichdata is first created on the flash drive.

c© 2014 ADFSL Page 151

JDFSL V9N2 Exploring Forensic Implications of the Fusion Drive

Figure 7 Disk Activity Showing Data Being Promoted from the Magnetic Drive to the Solid StateDrive

Figure 8 Disk Activity Showing the Flash Drive Freeing up Space After Reading Stops

6. CONCLUSIONS

The biggest impact of the Fusion Drive on theforensic methodology would likely be the changein the imaging process. While the drive wasnot tested with existing Mac tools, it is mostlyexpected that imaging the Fusion Drive wouldneed specialized tools that can recover data fromtiered storage. Imaging of the Fusion Drive

would probably be similar to the imaging pro-cess used for RAID storage systems. Beforethe advent of the Fusion Drive, tiered storagewas not commonly seen in home computers, andhence not a big concern for law enforcement(Duplessie, 2004). The large capacity of thedrive (3.1 TB) will also present challenges toimaging the drive but this is not specific to theFusion Drive. Increasing storage capacity is an

Page 152 c© 2014 ADFSL

Exploring Forensic Implications of the Fusion Drive JDFSL V9N2

Figure 9 Disk Activity Showing 1 MB of File Read from SSD and Rest from Magnetic Drive

old problem that the forensic community hashad to deal with.

The study also showed that multiple factorsimpact the allocation of data. Unlike with con-ventional SSD caches, the presence of data inthe flash memory does not indicate that thedata was frequently accessed. As seen by themanipulations, all data is written to the flashdrive first. Data can be promoted or demotedbased on the amount of space needed on theflash drive and cannot be explicitly related tothe usage of the data. Thus, the location of thedata does not provide much information aboutits usage. If data is moved to the HDD andthen moved back to the SSD, it could be anindicator that the data was accessed frequentlybut this would be an estimate relative to otherfiles. Also, with lack of documentation aboutdata movement strategies, there might be otherfactors like the environment state mentioned inthe patent (Bazzani, 2010) that determine theallocation of data. Therefore, at this stage it isunlikely that much forensic significance can beattributed to the location of data on either ofthe drives.

The granularity level of the data movementsuggests that parts of the same file can exist onboth drives at the same time. Thus, if one ofthe drives gets corrupted, it might be difficultto reconstruct the data. However, all data iswritten to the flash drive first. This includes

all applications, personal files, cookies, etc. Theflash drive has a capacity of around 120 GB.Thus, if the Fusion Drive shows less than 120GB being used, it is possible that all the data isstored on the flash drive solely. The observationsalso show that the MAC times are not a concernwith a Fusion Drive, as MAC times are notimpacted by the data migration between thedisks. The timestamps retained the value whenthey were first written to the flash drive and didnot alter even when the files were transferredbetween disks.

Every new technology comes with new chal-lenges for the forensic examiners. The FusionDrive is not much different. The challenges asso-ciated with the Fusion Drive mostly seem relatedto imaging the drive. With more informationbeing available about the data allocation algo-rithm, it might be possible to attribute forensicimportance to the data location. Other thanthese observations, based on documentation cur-rently available, the Fusion Drive does not seemto provide any advantages or disadvantages toforensic examination.

Future work in this area would involve imag-ing and indexing of the Fusion Drive with com-monly used forensic tools compatible with Maccomputers. Also, with frequent changes in tech-nology, it would be interesting to note any mod-ifications to the architecture and data migrationalgorithms used in Fusion Drives, and the rami-

c© 2014 ADFSL Page 153

JDFSL V9N2 Exploring Forensic Implications of the Fusion Drive

fications of these changes.

REFERENCES

AppleInsider. (2013). Apple’s mac shipmentsdecline in u.s. as pc market slows.Retrieved 2013-03-11, fromhttp://appleinsider.com/articles/

13/01/10/apples-mac-shipments

-decline-in-us-as-pcmarket-slows

Apple support. (2013). Retrieved 2013-01-28,from {http://support.apple.com/kb/

HT5446}

Bazzani, K. (2010, March 24). Hybrid-devicestorage based on environmental state.Google Patents. (US Patent App.12/730,838)

Beebe, N. L., Stacy, S. D., & Stuckey, D.(2009). Digital forensic implications of zfs.digital investigation, 6 , S99--S107.

Denning, P. J. (2005). The locality principle.Communications of the ACM , 48 (7),19--24.

Duplessie, S. (2004). A blueprint for tieredstorage. [White Paper]. Retrieved fromhttp://images.apple.com/xserve/

raid/pdf/

Tiered\ Storage\ Whitepaper.pdf

Fairbanks, K. D., Lee, C. P., & Owen III, H. L.(2010). Forensic implications of ext4. InProceedings of the sixth annual workshopon cyber security and informationintelligence research (p. 22).

Garfinkel, S. L., & Migletz, J. J. (2009). Newxml-based files: implications for forensics(Tech. Rep.). DTIC Document.

Hayes, D. R., & Qureshi, S. (2009).Implications of microsoft vista operatingsystem for computer forensicsinvestigations. In Systems, applicationsand technology conference, 2009. lisat’09.ieee long island (pp. 1--9).

Hutchinson, L. (2012). Achieving fusionwith aservice training doc, ars tears open applesfusion drive. Retrieved 2013-03-11, fromhttp://arstechnica.com/apple/2012/

11/achieving-fusion-with-a-service

-training-docars-tears-open-apples

-fusion-drive/2

NetMarketShare. (2013). Operating systemmarket share. Retrieved 2013-03-11, fromhttp://www.netmarketshare.com/

operating-system-marketshare.aspx

Peron, C. S., & Legary, M. (2005). Digitalanti-forensics: emerging trends in datatransformation techniques. InProceedings of.

Purcher, J. (2012). Apple fulfills patent withthe imac’s new fusion drive. Retrieved2013-02-15, fromhttp://www.patentlyapple.com/

patentlyapple/2012/10/

apple-fulfills-patent-with-the

-imacs-new-fusion-drive.html

Schuster, A. (2008). The impact of microsoftwindows pool allocation strategies onmemory forensics. digital investigation, 5 ,S58--S64.

Shimpi, A. (2013). A month with apple’s fusiondrive. Retrieved 2013-01-28, fromhttp://www.anandtech.com/show/

6679/

a-month-with-applesfusion-drive

Solomon, J., Huebner, E., Bem, D., &Szezynska, M. (2007). User datapersistence in physical memory. DigitalInvestigation, 4 (2), 68--72.

Stein, P. (2012). Fusion drive on older macs?yes! Retrieved 2013-03-28, fromhttp://jollyjinx.tumblr.com/

Page 154 c© 2014 ADFSL