Forensic media and the indexical value of digital memory

Table of content

1. Introduction
2. Memory on-line. Forensic media and the indexical value of digital memory.
2.1 Investigating memory
2.1.1 Hard disk memory: HDDs
2.1.2 Flash memory: SSDs
2.2 The indexical value of digital memory
3. Conclusion
References

1. Introduction

While the German Minister for Inner Affairs, Building and Homeland Horst Seehofer recently called for a general monitoring of the gamer scene in response to the anti-Semitic shooting on the Jewish community in Halle / Saale, it quickly came to attention that state law enforcement is facing structural challenges in dealing with online media investigation. [1] This not only concerns the well-disputed social usage of digital media, as in the radicalization in digital environments of political niches. Despite previous policies, as a general data retention, [2] or the implementation of cyber-crime departments in the German intelligence services Bundesnachrichtendienst and Verfassungsschutz, the call for a general suspicion of a primarily digitally formed and operated community such as “the gamer scene” raises several questions on current epistemology of forensic approaches to media. The main concern being raised here seems to be, at least from a media-scientific perspective, how media inherits potential deviances at its very core, and how its potentiality is likely to be overseen, both by law enforcement, computer forensics, but also in our daily use. Likewise, following the tope of immateriality of digital media reinforces a belief that traces left online were not as much indexical as their counterparts in the physical world. [3] Not only is it questionable, what “online” stands in for, here, but it also neglects the fact that cyber forensics have already developed practices of employing mechanisms and tools for investigating evidence and digital crime scenes.

Whereas online radicalizations and formation of political deviant groups have been widely discussed in terms of belief, social movements, representation and cultural framing in Social Sciences, Anthropology and Cultural Studies, the research in Computer Sciences, especially in the fields of Information and Communication Security, Cyber Forensics and Information Sciences have primarily focused on computational methods of surveillance, crime investigation and prevention, of what is often summed up under the term cyber-crime. A techno-media perspective, on the other hand, that focuses on forensic aspects of media, and looks on media conditions in forensic terms as a deviant media practice and knowledge has been largely neglected in this research area.

Matthew Kirschenbaum’s 2008 research Mechanisms. New Media and the Forensic Imagination is a pioneer piece of work that analyses computer forensics in regard to their media epistemology. However valuable his extension of Kittler’s three basic media conditions towards a media forensic is, his work jeopardizes in times where hard drives in form of SATA disks gradually disappear from personal computer hardware and are replaced by flash memory SSDs, even further with online storage on servers and virtual storage solutions. Whereas his argumentation towards a physical forensic evidence on hard disk drives still applies in forms of inscription and magnetic polarization, flash memory technology and their appliances in computer forensics stress new challenges in media forensics. In the following paper, I am pursuing to emphasize the question on how forensic media has evolved from hard drive disk to flash memory in terms of tracing indexical physical evidences. For that matter, I will argue alongside Kirschenbaum’s forensic media theory and expand it to contemporary storage technologies in flash memory. With the topic being very expansive, I formerly had the ambition to argue alongside all of Kittler’s three basic media conditions (memory, transmission and processing) but soon discovered that including all three would exceed the frame of this paper. This is why I will focus on digital memory and Kittler’s media condition on memory primarily. Furthermore, I unfortunately cannot exceed my work to the hybrid and virtual modes of storage as they occur in servers and cloud memory. Lastly, I will try to arrange the outcome towards a proposal that compliments the outcomes with a media forensic and notion of indexical value in digital memory.

2. Memory on-line. Forensic media and the indexical value of digital memory.

Investigating digital objects may, at first glance, sound anachronistic. In times of iCloud, G-Drive, basically all online storage providers, the search for digital evidence seems more promising than ever. Where, especially in Germany, a vast majority of citizens articulate concerns and grievances about their private data and the marketization of personal user data, the turn towards displacing personal data on corporate servers emerges to become the contemporary standard in end-user applications and devices. On the other hand, cybercrime is no longer only reserved to those few individuals who hail from a background in computer sciences, or informatics. The mundane implementation of online services, enabled through front-end applications and private (not always legal) providers, organize and perform acts that formerly only remained to a social group we earlier called hackers. Furthermore, social media as means of online communication and tool of social formation, enables those to participate in nonconform online behavior who precedingly had no access to deviant online actions, such as in inciting server raidings. The pressure for law enforcement to investigate in digital realms led to the inevitable foundation of computer forensic departments in state law enforcement internationally.

Employing the term deviant as a descriptive mode of operation in digital media usage, I am referring to the phenomenon of a potentiality of the internet: it’s original implementational idea of academic exchange versus the everyday reality of end-users, that is, as Parikka and Sampson describe: the contradiction between the ideals of a reinvigorated public sphere—an electronic agora for scientists, academics, politicians, and the rest of civil society — and the reality of a network overflowing with pornography, scams, political manipulation, piracy, chat room racists, bigots, and bullies. [4] Likewise, I will share their idea of trying to include the mode of nonconformity, or in their words “anomalous” [5] processes as in implicit horizon of the digital. [6] By referring to it rather as deviant media usage, I am not trying to stress a difference towards a normative behavior, but on the contrary, I am trying to juxtapose the diametrically opposed mechanisms being at play in memory devices, and furthermore how they formalize their own forms of deviated media. We will see in the following investigation of flash memory that deviance is the mode of operation that takes place within these storage devices. Last but not least, the topos of the digital contaminating society, or vice versa, has become as much a normative articulation as it has been a discursive attitude, in both postmodern identity politics and conservative endeavors of legislating media: Labeled as the “1990s hype of ‘the [Deleuzian] rhizome’” [7] from Parikka and Sampson, or exemplified by the Cybernetic Culture Research Unit:

[Wiener’s] propaganda against positive feedback - quantizing it as amplification within an invariable metric - has been highly influential, establishing a cybernetics of stability fortified against the future. There is no space in such a theory for anything truly cyberpositive […]. Cybernetics was itself to be kept under control, under a control that was not itself cybernetic. [8]

This notion neglects the conditions in which media materializes in our mundane usage of computers and memory devices. As Kirschenbaum notes, the physical inscription that takes place on the medium is a forensic tool.9 Yet a contagious act, we will see, is hardly achievable as storage devices are sturdily built and microscopically engineered to be nearly impenetrable to physical human contamination in their default mode. [10] In flash memory even, the state of inscription cannot be unambiguously determined rather than deleted as a whole. Yet, for Kirschenbaum, an indexical inscription still takes place and forms a retrievable evidence of an individual on digital magnetic memory devices. [11] “Medien bestimmen unsere Lage” [12] in the most ambitious sense, as in forensic media, they form “scientific evidence and the construction of a rhetorical argument” [13] that can be legally laid to one’s charges in court, and lest decide on the outcome of such. In consequence, media is not solely addressing forensic evidence but also changes formal symbols in the way they execute data storage on physical devices, as we will see in Kirschenbaum’s theory.

The anachronism will even escalate towards probabilistic considerations in flash memory, where the conception of mechanical time itself is no longer in a clear, linear state. The question of deviation and index will reoccur in different memory devices presented. More than these concerns would articulate a normative of media, the deviances of modes of operation indicate a profound relation between the material index and the surrounding discursive. As much as magnetic memory devices show an indexical correlation towards its mode of inscription for Kirschenbaum, flash memory and hybrid memory devices cannot be examined solely in mechanical terms as they have implemented features that run under the theoretical premises of quantum-mechanics and are far from being detectable in linear inscription. Forensic media, we will see, relies on a concept of indexicality that cannot be limited to observable evidence (in their second order). In the following I will look at different methods and technologies on different electronic devices that are employed to function as digital memory on computational instruments.

2.1 Investigating memory

In his afterword to Aufschreibesysteme 1800 – 1900, Friedrich Kittler summarizes his discourse networks in relation to the indexical value of inscription:

Weil es Sprachen ohne Spur und d. h. ohne Spur von Schrift nicht gibt, fällt die ‚kommunikative Vernunft‘ mit der ‚instrumentellen‘, ihrem vorgeblichen Gegenteil also, immer schon zusammen. [14]

According to Kittler, media memory developed in three distinct phases, from the necessity of imprinted authorship in bibliography, to non-alphabetical inscription with the gramophone and phonograph, to compound media inscription in digital media. [15] Inscription here takes place in form of memory with and implicit forensic value. For Kittler, it is not accidental that the rise of criminalistics as a separate field of science that focuses on forensic interest of singular criminal events [16] evolved in the 19th century: “Der Tod des Menschen und Spurensicherung der Körper sind eins. […] An dieser nachgerade kapillaren Kontrolle [technischer Medien des 19. Jahrhunderts] geht das Individuum von 1800, das ja bloß ein individuelles Allgemeines war, wahrhaft zugrunde.” [17] Technical media, and especially measuring and inscription devices of the 19th century, like the phonograph, did not only enable a mere alphabetic transfer, but for Kittler, also created means of storing unconscious and aesthetic features that not solely transmit an index in form of a bibliographic imprint as it was in a Gutenberggalaxis. [18] Besides Kirschenbaums argumentation towards a history of inscription as form of bibliography, Kittler’s notion implies that media could not become forensic before it was able to store these singular indexes. [19]

However, this idea of media helps to build a fundamental understanding of media being able to transport evidence physically. Moreover, Kirschenbaum’s Mechanisms relies on this concept of “textual and technical primitives of electronic writing” [20] more than it would reject Kittler’s analysis as a whole. [21] Where Kittler’s discourse network includes discursive materiality, Kirschenbaum undergoes a project of strictly dividing between forensic materiality and formal materiality. As forensics “rest upon the principle of individualization […], the idea that no two things in the physical world are ever exactly alike”, [22] the formalism, or discourse, is founded upon “symbols to be set and reset, set and reset, on again and off again […]”, [23] creating “procedural friction[s].” [24] These friction are not arbitrary, however. They form alongside the media conditions of “the twin textual and technological bases of inscription (storage) and transmission (or multiplication)”, [25] rather than they would in the form of distinction between hardware and software. [26] For Kirschenbaum’s forensics this means, in other words, that no evidence can be admissible if the correlation between the index and an alleged actor is not linear.

Horst Völz used the indication of memory as “On-line-Medien” [27] to describe the functioning of digital storage. By reconfiguring the word online as a medium-being-on-the-line, one can profit by enhancing the connection of the digital and a form of linearity, whereas the term online simply resonates as something that is or takes places on the internet. For Völz, on-line media are objects that rely on a second device to be put in compliance with, in order for a medium to articulate itself (such as displaying devices.) [28] For digital media, a strict topography of writing and reading data on a medium is crucial, so that data can be structurally inscribed. On-line media is not necessarily online. On-line media rather is formalized and in compliance as linearity. From this perspective, this linearity guarantees investigation of digital memory as physical evidence. In its most radical consequence, this linearity has impact on the discourse and outcome of a juridical trial. The inscription is physically on-line with the medium and a second actor and becomes its traceable index. [29]

The technology of digital memory can be roughly divided into two categories. The first group is summarized as hard disk drive, or HDD. These are frequently installed as Serial Advanced Technology Attachment drives, or simply SATA. In their broadest definition, their operating principle relies on electro-mechanical rotation and magnetic polarization of a film. The other category of memory minimizes the mechanical features and favors an electronic solid-state compound on its macro design. These kinds of digital memory devices are being referred to as flash memory, most prominently in the form of SSD, or solid-state drives. Kirschenbaum argues that for HDDs “a written trace, digital inscription is invisible to the naked eye”, the mechanical operations and magnetic polarization of an HDD platter “is not instrumentally undetectable or physically immaterial.” [30] Indeed, for HDDs that were favorably internalized in personal computers until recently, it is valid to say that the materiality of such storage is one that can be traced on a microscopic level in form of polarized ferrous material. [31] In the following, I will analyze both categories, HDDs and SSDs in more detail and stretch the material differentiation between them. By doing so, I want to examine how inscriptions, and thus indexical values, occur in these systems that can be used as forensic evidence. Lastly, I will recapitulate on the indexicality in both technologies that differ vastly in their approaches and epistemological consequences.

2.1.1 Hard disk memory: HDDs

To understand how evidence can be preserved on hard drives, it is, first of all, important to understand the electro-mechanical building concept of hard drive disks. As traces are not necessarily sole digital data in form of symbolic binary bits, forensic traces can be discovered on within the device as physical evidence. [32] Kirschenbaum’s distinction between forensic and formal materiality is helpful to understand the microscopic dimension of “the smallest inscribed unit”. [33] As HDDs are a magnetic storage medium, the inscription takes place on a level of 10µn, a physical threshold that when undergoing, no sufficient magnetic force can be hold any longer. [34]

An HDD is basically a platter which contains a magnetic film, and an actuator which carries all reader/writer heads that fly above the spinning platter. [35] As the spinning platter also contains a film that is coated with ferrous material, they also contain the stored data in form of magnetic polarization of the film. While the head is located just a few millimeters flying above the front and back side of the film, the inscription takes place on both sides of the film and inscribes solely through magnetic force. In fact, the film is even protected from mechanical trauma as it carries an extremely thin layer of carbon finish on the ferrous coat that serves as a protective sheath. While the platter is spinning it creates a small air cushion that keeps the head in place and, thus, the magnetic force of the head either attracts the electromagnetic ferrous coat creating a physical elevation on the film, or it can also be the case that the reader/writer head exerts the same polar force as on the given piece of film, pushing the ferrous material back down on the film and creating a flat surface. However, the head does not read a singular magnetic dipole but instead functions by detecting the procedural change between elevations and flat surfaces while the platter is spinning. [36] During the change of polarized fields, the electro-magnetic head is either induced with an electronic impulse from the film while reading, or induces a magnetic impulse on the film to polarize the film. This means that singular inscription can take place while the head is operating as a detector of the stream of all magnetic fields in temporal and spatial differentiation to each other. [37]

As inscription takes place on both sides of the film, and often several different platters are stacked upon within one device, a precise mapping of the platters is needed to find the exact location of polarization of one singular inscription. Thus, platters are divided into tracks and sectors: “There is no portion of the volumetric space of the drive that is left unmapped by an intricate planar geometry […].” [38] While the platter is organized concentric, the circular allocations are called tracks. [39] The tracks are subdivided into sectors, while “many systems use two or more sectors, called cluster, as their basic storage unit […].” [40] This coordinate system is inscribed within each device as an impenetrable servo codes, inaccessible for end-users to manipulate or alter. [41]

Nonetheless, it is wrong to assume that stored digital data would be located at one singular sector. [42] Files are distributed on different sectors that are usually sized with blocks of 4096 bytes. [43] The result of these fixed lengths of clusters is that “even a one byte file – a single ASCII character – will require the allocation of a full 4096-byte cluter to store.” [44] The remainder of storage is typically filled with RAM, Random-Access Memory, that is volatile in HDDs, meaning that stored RAM information will be lost when the hard drive is taken off from power voltage. [45] When inscription takes place, the sector is not deleted. What the organization of disk space does instead, is “legislating the writing space of the drive”, [46] and thus, “flagg[ing] [the] space now available for reuse”47 so that data actually remains on the drive as long as it has not been overwritten. This allocation of partialized information leaves “remains of earlier files” [48] at the end of such clusters, referred to as disk slack. As seen, the concept of HDDs relied on electro-mechanical precision where the “head may also be off just enough that the magnetic field is strong enough to erase the old data, but not strong enough to successfully record the new data.” [49] Whereas the magnetic polarization may be invisible to the human eye, through the use of magnetic force microscopy, the elevations and singular inscriptions can be very well detected on the physical material. [50]

In computer forensics, evidence in the form of digital inscription can be acquired from the physical matter as well as their formal materiality. Employing magnetic field microscopy, “shadow data in a lab […] and the recovered fragments can be pieced together to reconstruct parts of the original data.” [51] However, due to its nature of distributed allocations, digital evidence – just as physical evidence – is always at risk of being tampered with, or even obliterated. [52] As digital forensic researcher Eoghan Casey states, comparable similarities between digital securing of evidence and investigation of traditional crime scenes exist: Only a small portion of this amalgam might be relevant to a case, making it necessary to extract useful pieces, fit them together, and translate them into a form that can be interpreted. […] When a person instructs a computer to perform a task […] the resulting activities generate data remnants that give only a partial view of what occurred. [53]

Securing evidence relies on traditional methods, such as very mundane practices of containing devices in secured bags from the physical location of acquisition, [54] as well as more sensitively computational methods that compliment digital features, in retrieving uncorrupted data from a device “[t]o authenticate digital evidence, [so] it [is] necessary to assess its reliability.” [55] For Kirschenbaum, “computer forensics [in one definition] consists ‘the preservation, identification, extraction, documentation, and interpretation of computer data.’” [56] Moreover, Kirschenbaum’s project relies heavily on countering “the dominant perception of immateriality” [57] of digital objects. Investigations in traditional, as well as digital crime scenes, unfold alongside similar processes of “[c]rime scene preservation”, “[c]rime scene survey”, “[c]crime scene documentation”, “[c]rime scene search and collection”, and “[c]rime scene reconstruction[.]” [58] On both fields, “the majority of artifacts of forensic significance remain latent” [59] unless examined under “controlled laboratory setting[s] to locate files, metadata, or fragments […].” [60]

One way of securing digital evidence is by recovering memory on the storage device. As described before, information is inscribed on HDDs via magnetic force alongside a precise allocation on the ferromagnetic film. The allocation allows within a time-critical mode of operation by simply locating a ‘deleted’ file on the storage media after its entry has been stripped from the FAT [as the organization of allocation on Windows personal computers] but before any new data has been written to the same location. [61] Hereby, explicit stored files, as well as metadata, “ambient data” [62] such as temporary and auto-save files, swap space (the inscription of RAM on the HDD “as extension to the RAM”), [63] and slack space can be recovered to “testify to its past presence.” [64] The possibility of altering evidence on digital devices is a common difficulty encountered in digital forensics:

One of the perpetual challenges that commonly introduces error into forensic analysis is evidence dynamics. [That] is any influence that changes, relocates, obscures, or obliterates evidence, regardless of intent between the time evidence is transferred and the time the case is adjudicated […]. Forensic examiners will rarely have an opportunity to examine a digital crime scene in its original state and should therefore expect some anomalies. [65]

Deviances of data, therefore, pose a challenge for “a complete and accurate copy of digital evidence [that] was acquired, and that is has remained unchanged since it was collected.” [66] The integrity of data is therefore often tried to maintained by creating a “so-called bitstream image of the original file system.” [67] These bitstream images function as documentation of actual occurrences on the storage device. [68] Hash algorithms allow them to become a controlled documentation where any alteration will be compromised in a change of a numeric hash value. [69] When demonstrated, these hash values “can be compared with those on the original hard drive to ensure that specific files are not impacted[.]” [70]

However, it is not impossible to deviate from these security measures: While it may be technically possible to create the conditions in which electronic writing can subsist without inscription and therefore vanish without a trace, those conditions are not the medium’s norm but the special case, artificially induced by an expert with the resources, skill, and motive to defeat and expert investigator. [71] As we will see in the following section, the medium’s norm is in fact not one of stable inscription as Kirschenbaum argues, since in flash memory, solid indexes are not exactly traceable in flash drives, neither do they have observable fixed locations, but rather probabilistic allocations.

2.1.2 Flash memory: SSDs

Hard disk drives have been the main technology of digital storage since the 1980s, [72] and due to the fact that flash memory only popularized in the last years, Kirschenbaum’s analysis only interjects on the advancement of flash memory, referring to a Samsung laptop that “debuted […] with 32MB of flash memory storage – but had no hard drive.” [73] Due to the fact that today most servers run at least with hybrids of SSDs and HDDs, that cellphones mainly solely rely on flash memory, as well as USB drives, their negation in terms of forensic media should be caught up with. Furthermore, cloud services seem to offer an even broader understanding of forensics as their location is significantly distant from users whereas with hard drives on personal computers can be more easily traced back into the possession one singular individual. [74] Furthermore, the aspect of individual possession becomes blurry when no human actor is at work of leaving incriminating evidence, but instead when the deviation originates from a computational, or algorithmic entity. These networked arrays of storage are developing into more and more complex distributions of data, however, I will firstly focus on flash memory devices, as their emergence is predominantly omnipresent in today’s digital media.

Whereas in HDDs volatile memory is lost after sufficient access to power input, such as with RAM on the remaining space lengths of clusters, in flash memory is based on nonvolatile electrically erasable programmable read-only memory, or EEPROM technology. [75] Reading/writing on flash memory is significantly faster than on hard drive disks, due to the fact that solid-state device, or SSDs, do not – as the name already suggests – rely on spinning plates to inscribe data. [76] More contradictory seems to be the fact that an SSD does not employ a drive, or disk at all. In its solid-state, the flash memory is not only more robust against external impacts compared to the rather delicate electro-mechanical accuratesse of HDDs, it is also organized on NAND or NOR flash architecture, “named after the basic logical structures of these chips” [77] that resemble NAND and NOR logical gates, and function completely electronically. However, to function non-volatile, transistors for NAND flash memory are usually conceptualized on floating-gate transistors, FGMOS, that, compared to regular MOSFET transistors, remain their stored one bit information in their cells when taken off from a power input. These transistors are memory cells that are aligned serially as a circuit and create a block of traditional emulated 512 – 4096 bytes and are addressed in a straight bitline. [78]

As here, addressing an arrayed bitline always requires addressing the full block, flash memory is vulnerable to degenerate during the writing process, as the electronic impulses cause damage to the protective isolation layer of the floating gates. [79] To understand this corrosion, it is important to be aware of the architecture of floating gates as the smalling memory cells in NAND flash memory devices. To function non-volatile, floating gates hold an electronic isolation between source and drain. This isolation keeps its electric charge when turned off from a power input. Because of the isolation, the gate is “floating” between source and drain, allowing no electric current between source, gate and drain in classical physical mechanics. Remaining voltage is treated in relation to a higher voltage applied, to signify either being an open or a closed gate. This is made possible by turning to account the quantum-mechanical tunneling effect that enables electrons to travel through the isolation layer towards the gate, and drain, and thus, to reverse the assignment of positive charge and negative charge – or 1 and 0 in binary -- creating a gate that can one time be closed when applied with voltage, and one time stand in for an open gate. This way, binary information can still be stored in the memory cell, even without power supply, and “actually provides a memory to store information for >10 years while the power supply is turned off”. [80] Now, as flash memory is only addressable by addressing the full block, the tunneling and flow of electrons though the memory cells wear out the isolation material, resulting in the gradual loss of information and degradation. As this may only happen during writing, the amount of write cycles is limited and finite on a SSD. [81] Writing, in case of digital storage, of course also means deleting in the form of re-writing, but not reading data.

Whereas some flash memory units employ multiple bit cells, meaning that one cell can store more than one bit, blocks typically reserve a remaining amount of storage capacity “used for storing metadata such as error-correcting codes.” [82] Not quite analogous to HDDs disk slack, this additional space in SSDs is moreover used to “detect and correct these errors” [83] that occur during the process of degradation of the memory cells. Another difference lies in the microscopic conceptualization of flash memory compared to hard drive disks: While physical polarization on magnetic films could still be made visible via electronic microscopy, the charge of flash cells does not directly indicate if the gate is open or not, as its states can interchange procedurally. Furthermore, the allocation of data does not require motoric change of an actuator, nor spinning of disks, so that file allocation is mainly designed to emulate the conditions of preceding HDD technology rather than it would technically rely on this design. [84] Where in disk memory, singular cells can be addressed by the procedural functioning of induced electro-magnetic force from and in the reader/writer head, flash memory has to cope with its tendency to “cause a block to deteriorate”, by distributing the writing process “over the full range of physical blocks” [85] to minimize the wear-off. [86] This mechanism also allows investigators to profit from what may first seem like a forensic difficulty of SSDs, that is the erasure of complete blocks when turning off or booting a device storing on flash drive. [87] As the all-over distribution of writing creates duplicates of former and present files constantly, deleted contents can be found displaced and fragmented on the full range of a flash memory. [88] However, “the arrangement of blocks in flash can be very different from the way blocks are arranged on magnetic storage media.” [89]

A physical inscription still takes place on flash memory, although it does not appear as clearly structured as in hard disk drives. As we have discussed, in HDDs polarizations on the magnetic film can be made visible by electronic microscopy. With flash memory cells, it is likewise possible to examine the gate in a nanometer spectrum. However, due to the nature of quantum-mechanic characteristics of its mode of operation in which electrons tunnel through the isolation barrier, no topological change can be detected even under a microscope. Physical detection could only take place by measuring the voltage of each individual flash memory cell. And by doing so, results would be far from self-descriptive, as the state of the floating gate alternates between closed and open without any direct correlation to its remaining electronic charge. One time the remaining voltage can be a 1, the next time a 0. For that reason, it would be necessary to translate each combination as if trying to solve an encrypted code. More dramatically in digital forensics even, to complement Heisenberg’s uncertainty principle, the measurement of the remaining voltage could alter the state of the gate so that information might be lost. It gets even more complex when looking at multi-level storage cells that contain not only one but two, or more bits. Nonetheless, the corrosive voltage forms a stream of electrons that tunnel through the isolation forms clear physical traces so that the storage device will determinedly fail after a certain amount of writing operations.

Where in hard drives, the digital value is a second-order representation physically inscribed on a magnetic matter, [90] binaries in flash memory do not represent a singular material value but can instead physically point to two values. The fundamental difference to magnetic disk drives, thereby, lies in the fact that floating gate technology relies on the quantum-mechanical theorem of the tunneling effect that serve as explanation of electrons passing through the isolation layer into the gate. [91] Here, an indexical value cannot be pinpointed at precisely as the nature of electrons is subject to possibilities rather than observable, fixed physical locations. The tunneling effect is what enables a flash drive to become a non-volatile storage. It is not a streaming flow of electrons that tunnel through the isolated layer of the gate, but rather a jump of the electron over the potential barrier into the floating gate.

By adjusting electronical properties of the gate, it is possible to increase an electron’s energy and chance to overcome the potential barrier and jump to the gate. This method, called hot carrier injection, uses remaining voltage in the gate that is located above the tunnel between source and drain, and accelerates a potential electron with additional energy. [92] In flash drives, the binary byte thus becomes an uncertainty where the gate can be tunneled to create a non-volatile storage that reverses its allocation of being open or closed. Once, a negative charge can close the gate, another time, a negative charge can close the gate. [93] As Kirschenbaum’s theory of forensic media is based on understanding bytes as physical evidence, his analysis seems to be more applicable to magnetic hard drives. It becomes rather ambiguous for flash memory storage, as their very electronical condition almost refuses to be examined in its materiality and location. However, on the informational level, other methods, such as creating bitstreams of flash memory is still a possible and for digital forensics even desirable mode of investigation. [94] Favorably, Kirschenbaum’s notion on Kittler that “[f]ormally, there is no essential state of the discourse network” [95] realizes itself in terms of technological applications of quantum-mechanics as it is the case with floating gates and quantum tunneling, where we have to accept a probabilistic location rather than an observable, or even a clearly inscribed index.

Flash memory is usually used in personal computers, cell phones, USB-flash drives. In servers, hybrids of HDDs and SSDs are commonly used that complement each other by profiting from the long-durational writing endurance of HDDs, and the data rate of flash memory. As Casey distinguishes, the term computer forensics “became problematic as more evidence was found on networks and mobile devices […].” [96] In network environments and with cell phones, even virtual storage is being emulated in lining different devices together. [97] Besides the problem of gaining access to servers that lie in other countries, collecting evidence from network infrastructures underlies an even more time critical difficulty than on personal computers as traffic is distributed fast and stored often in volatile memory. [98]

2.2 The indexical value of digital memory

As we have seen, several different memory technologies are used today. They all have different benefits and disadvantages in storing data, and, vice versa, for retrieving evidence in digital forensics. As for hard drive disks, memory is physically as well as digitally on-line, in Völz’s definition, meaning that the allocation of data is both detectable on a microscopic level and in an array of lined up blocks of polarized ferric, and at the same time addressable as a linear coordinate system on servo codes of the drive. Most importantly, singular memory cells can be addressed and written upon in HDDs.

For HDDs as memory on-line, as Kirschenbaum attests, “[t]he impulse toward equating subjective identity with personal data stores is emerging as one of the most dramatic features of contemporary discourse networks”, [99] the indexical value does not solely rely on physical inscription on the hard drive, but moreover, on the allocation to an individual being who consciously or unconsciously leaves traces of individuation on their memory device. The accumulation of data is already employed to generate a profile of users online in the form of adversarial algorithms that suggest products based on one’s purchase history or online search queries, [100] as well as in criminalistic case analysis where a criminal profile can be drafted that may correlate with comparative cases and statistical data. [101]

Digital memory is not solely securing individualized data on physical storage devices but is also becoming advancingly more virtual and distributed. Flash memory drives are merely physically observable without altering their stored information, nor topographically visible in regard to their state of charge. While flash memory promises a physical stability from mechanical impact or trauma, it also comes along with a higher vulnerability in its operational performance endurance. The increasing deterioration while writing on flash devices hints towards an indexical inscription, yet it is extremely complex to conclude a forensically useful material form of index. Due to its nature of erasing full blocks of information, indexical evidence is more likely to be found in the form of symbolic bits via bitstreams rather than as physical inscription. Especially the fact that a single memory cell cannot be addressed, but can solely be overwritten or “deleted” through a bitline flash memory technology is fundamentally different to magnetic disk storage. Functioning exclusively through electrons, not magnetic fields, floating gates in flash memory are subjected to quantum-mechanical processes where indexical values can only be constitute a probability, not a fixated observable inscription. As Yuk Hui argues in On the Existence of Digital Objects:

In […] the irreversibility of time in quantum mechanics, Prigogine criticized the fact that in theoretical physics, there is no place for history. He doesn’t mean the history of science but rather the fact that the concept of the past always consists of the presence of time itself, which is also what we call the ‘technical reality.’ Especially for a highly unstable system, it doesn’t make much sense to give descriptions in terms of trajectory because physical motion effectively becomes meaningless; yet it is possible to describe the system in terms of partitions. When it is described in partitions, we can only know it in terms of phase space rather than in its exact state, which means we have to understand it according to a different time from that of classical mechanics[.] [102]

For that matter, Kirschenbaum’s Mechanisms – as its name already suggests – cannot be easily translated to memory devices in which classic mechanics do not properly apply any longer. Although he already suggested that “computer forensics is carried out with computers, so there is a kind of Heisenberg principle at work”, [103] it is not only a form of individualization on a storage device that carries out significance, but the mode of inscription is to be regarded within a dynamic understanding of time. In reference to Heidegger, Hui suggests a “topological time” that “demand[s] a material view of time in the digital milieu, one that compliments the critique of clock time.” [104] When it comes to media that does not work in the classic mechanic understanding of physics, it moreover questions the underlining conceptualization of time. In Kirschenbaum’s forensics, the indexical value stands in for an historically and materially precise inscription, but in quantum environments flash memory cannot uphold these requirements, “for with time, what is retained is not simply physical matter […] but rather something of a specific ‘order.’” [105] As the medium on-line correlates to a “geometrical intuition of time as a line that runs from one end to another [as] metrical”, [106] it could be argued that the mode of temporal operation in flash memory runs in dynamics rather than through linearity - compared to its hard drive counterpart that is allocated, read and written in a mode of alignment.

We could even argue that Kirschenbaum’s distinction between forensic and formal materiality might reflect these properties. The deviation from a clear material inscription on flash memory might also introduce a “discursive relation” [107] in Kirschenbaum’s understanding of formal materiality. As Kirschenbaum’s work definition of formal materiality develops around the idea that symbols are exposed to changes in different states, [108] they form “procedural friction[s]” [109] rather than “individualization inherent in matter[.]” [110] As the state of electrons in the floating gate can only be estimated in probability, they cannot be allocated precisely, nor is it possible to detect a clearly readable index on the physical matter with electrons in their quantum state. Where on magnetic memory devices, microscopy can still serve to visualize inscription as a measuring device [that] suspends human perception from the limitation of its own subjectivity and culturality [sic], […] we take into account that an measuring configuration is itself marked by the historic index of its own epoch. [111] The historical impossibility of measuring electrons that unfold in their quantum-mechanism renders the indexical value in flash memory – their level of uncertainty - an “the accompanying noise” [112] as Wolfgang Ernst has described the index in digital media. He is suggesting that “[t]he indexical basis […] is no longer space but time (and its time-axis manipulation[.])” [113] Arguably, Kirschenbaum unfolds an understanding of forensic imagination in which “[s]torage […] is all about creating a systemized space in which this activity [“a desire to speak with the dead” “through objects in the present”114] can unfold.” [115] In a state of uncertainty, floating gates are more comparable to statistics rather than indexes, and thus would complement Kirschenbaum’s notion of a forensic imagination. When he argues that “the popular dramatization of forensics as criminalistics […] is […] a mere caricature of the forensic imagination, which is […] generative” [116] he is also referring to a discourse of materiality that is increasing created of “absences [that] will become more palpable” [117] as the indexical value is formally dematerialized.

“[T]o look beyond the mere appearance of objects themselves[,]” [118] Hui employs Heidegger’s classification of objects as Vorhandenes and Zuhandenes. Without wanting to dig too deep into Heidegger’s terminology, the suggested distinction may be helpful because it underlines a spatial-temporal logic of the different properties of devices we encountered here. Hui’s reading of Heidegger’s terminology understands the Verhandene as a scientific, almost goal-oriented instrument, whereas the Zuhandene unravels not so much through its directly designed purpose but through Umgang, meaning both putting a device into operational practice and implying a way of bypassing its primary purpose. [119] We cannot conclude from an index of an object to it as a Vorhandenes: “[I]n the antiquity museum, we don’t see the exact past of the object (e.g., who exactly was using the tool, when exactly it was used), but we nevertheless ‘see’ what is retained there as past [as] […] historicity.” [120] The same applies to digital memory devices where a historicity can stand in for a forensic imagination:

[i]f we were to find something remaining, it would likely be some record or trace acknowledging that something did exist […] previously or perhaps take the form of missing links and bugs generated during the course of its disappearance. [121]

In this past section, I wanted to present some of these pitfalls that occur when trying to apply Kirschenbaum’s theory to flash memory devices, as they employ a completely other Umgang, to use Heidegger’s term. As we have seen, the question of an indexical value of digital memory is far from being easily resolvable by mechanisms. The question comes along a variety of new problems, such as temporal and spatial complexities, and the question of the Existence of Digital Objects itself.

3. Conclusion

Hard drive disks and flash memory devices show quite fundamental differences when applied with Kirschenbaum’s theory of mechanisms. In case of the latter, it even suggests being inapplicable to the extent that forensic media works along a range of orders of what may be suggested as indexical. Due to their magnetic functioning, HDDs can demonstrate physical inscription in the form of polarized, elevated ferrous material under electronic microscopy. The design of flash memory is inherently different as they work fully electronic and have memory cells installed that are not detectable in their functioning state due to quantum-mechanical effects that are utilized. Kirschenbaum’s differentiation between forensic and formal materiality can partly conduct these phenomena as discourse surrounding the physical condition of memory devices. Nonetheless, the theorem of imperative inscription in digital memory becomes at least questionable when looking at contemporary, non-magnetic storages.

In further research, it would be interesting to look into digital memory that is organized in networked solutions, such as serves, data base centers and virtual storage in cloud computing. Not only is the question of indexicality questionable while the majority of servers lie in corporate property. Mobile devices expand the dislocation from memory devices even further through mainly using cloud storage and at the same time being Zuhandenes, at hand as the clumsy German word Handy suggests.

1 See Die Bundesregierung der Bundesrepublik Deutschland: Antwort auf kleine Anfrage: Rechtsextremistische Inhalte und Amoklauf-Ankündigungen auf Internet-Spieleplattformen. Drucksache 19/9624 (24.04.2019). Köln: Bundesanzeiger Verlag, 2019.

2 The Law on the Revision of Telecommunication Monitoring and other Undercover Investigation Measures and on the Implementation of EU-Directive 2006/24/EC came into effect in 2008, only to be annulled by the Federal Constitutional Court two years later, as well as the succeeding lawVerkDSpG in 2017.

3 See Kirschenbaum, Matthew: Mechanisms. New Media and the Forensic Imagination. Cambridge: MIT Press, 2008. p. 43.

4 Parikka, Jussi; Sampson, Tony D. [Hrsg.]: The Spam Book. On Viruses, Porn and Other Anomalies from the Dark Side of Digital Culture. New York: Hampton Press, 2009. p. 7.

5 Parikka, Sampson, 2009. p. 3.

6 See Parikka, Sampson, 2009. p. 7.

7 Parikka, Sampson, 2009. p. 9.

8 Plant, Sadie; Land, Nick: Cyberpositive. In: Fuller, Matthew [Hrsg.]: UNNATURAL. Techno-Theory for a Contaminated Culture. London: Underground, 1994. N. pg.

9 Kirschenbaum, 2008. p. 41.

10 See Kirschenbaum, 2008. p. 60: „simply run it [the hard drive] over with a tank, as the NSA originally suggested, though modern data recovery abounds with seemingly miraculous stories of data extracted from hard drives subjected to near-Biblical levels of fire, flood, and blunt force trauma.”

11 See Kirschenbaum, 2008. p. 10.

12 Kittler, Friedrich: Grammophon, Film, Typewriter. Berlin: Brinkmann und Bose, 1986. p. 3. 1

3 Kirschenbaum, 2008. p. 21.

14 Kittler, Friedrich: Aufschreibesysteme 1800 – 1900. Dritte Auflage, München: Wilhelm Fink Verlag, 1995. [1985] p. 520.

15 See Kittler, 1995. p. 148: „Das Aufschreibesystem von 1800 arbeitet ohne Phonographen, Grammohone und Kinematographen. Zur seriellen Speicherung/Reproduktion serieller Daten hat es nur Bücher, reproduzierbar schon seit Gutenberg.“

16 Instead of criminology, a field of science that focuses more broadly on crime within a social, broader field of actors.

17 Kittler, 1995: p. 298-299.

18 See Kittler, 1995: p. 148: „Mechanische Apparaturen zur Klangspeicherung wie jene Vokalautomaten Kempelens oder Spalanzanis bleiben Kuriosa oder Provisorien; mechanische Apparaturen zur Reproduktion serieller Bilder desgleichen. […] Und solange das Speichermedium Buch ohne Konkurrenz bleibt, glauben die Leute seinem unmöglichen Versprechen.“

19 See Kirschenbaum, 2008. p. xiii-xiv.

20 See Kirschenbaum, 2008. p. xiii

21 See Kirschenbaum, 2008. p. 5. 22 Kirschenbaum, 2008. p. 10.

23 Kirschenbaum, 2008. p. 11, emphasis in original.

24 Kirschenbaum, 2008. p. 13.

25 Kirschenbaum, 2008. p. 15.

26 See Kirschenbaum, 2008. p. 13.

27 Völz, Horst: Grundlagen der Information. Berlin: Akademie Verlag, 1991. p. 412.

28 See Völz, 1991. p. 370.

29 See Kittler, 1995. p. 360: „Jedes Medium, das Verborgnes [sic] zutage bringt und Vergangnes [sic] zu reden zwingt wirkt durch Spurensicherung am Tod des Menschen mit.“

30 Kirschenbaum, 2008. p. 74.

31 See Casey, Eoghan: Digital Evidence and Computer Crime. Forensic Science, Computers, and the Internet. Third Edition, Cambridge: Academic Press, 2011. [2000] p. 447.a

32 See Kirschenbaum, 2008. p. 60.

33 See ibd. p. 61: „Thus while bits are the smallest symbolic unit of computation, they are not the smallest inscribed unit, a disjunction that underscores the need to distinguish between forensic and the formal […].”

34 See Kirschenbaum, 2008. p. 62.; See Völz, 1991. p. 399 – 400.

35 See Casey, 2011. p. 114.

36 See Kirschenbaum, 2008. p. 90.

37 See Kirschenbaum, 2008. p. 89 – 90; p. 94.

38 Kirschenbaum, 2008. p. 92.

39 See Casey, 2011. p. 447.

40 Casey, 2011. p. 448, emphasis in original.

41 See Kirschenbaum, 2008. p. 92.

42 See Kirschenbaum, 2008. p. 93.

43 See Kirschenbaum, 2008. p. 92.

44 See Kirschenbaum, 2008. p. 52.

45 For SSDs, as we will see in the following section, RAM is increasingly organized as non-volatile storage.

46 Kirschenbaum, 2008. p. 94.

47 Kirschenbaum, 2008. p. 50.

48 Kirschenbaum, 2008. p. 52.

49 Kirschenbaum, 2008. p. 64.

50 Kirschenbaum, 2008. p. 68.

51 Casey, 2011. p. 499.

52 See Kirschenbaum, 2008. p. 45; Casey, 2011. p. 25 – 26.

53 Casey, 2011. p. 25.

54 See Casey, Eoghan [Hrsg]: Handbook of Digital Forensics and Investigation. Cambridge: Academic Press, 2009. p. 395.

55 See Casey, 2011. p. 61.

56 Kruse, Warren G.; Heiser, Jay G.: Computer Forensics: Incident Response Essentials. Boston: Addison-Wesley, 2002. p. 2. Cited from Kirschenbaum, 2008. p. 45 – 46.

57 Kirschenbaum, 2008. p. 76.

58 Casey, 2011. p. 191.

59 Casey, 2011. p. 191.

60 Kirschenbaum, 2008. p. 46.

61 Kirschenbaum, 2008. p. 51.

62 Ibd. 63 Ibd. 64 Kirschenbaum, 2008. p. 52.

65 Casey, 2009. p. 9, emphasis in original.

66 Casey, 2011. p. 60.

67 Kirschenbaum, 2008. p. 53.

68 See Kirschenbaum, 2008. p. 53.

69 See Kirschenbaum, 2008. p. 55.

70 Casey, 2011. p. 60.

71 Kirschenbaum, 2008. p. 50.

72 See Kirschenbaum, 2008. p. 74.

73 Kirschenbaum, 2008. p. 107.

74 See Kirschenbaum, 2008. p. 107: “the hard drive is not so much confronted with obsolescence as it is with further displacement, no longer even residing in the same physical machine the user lays hands on.”

75 See Casey, 2009. p. 387 – 388.

76 See Casey, 2011. p. 448.

77 Casey, 2011. p. 388.

78 Casey, 2009. p. 388.

79 See Ito, Takashi; Taito, Yashuiko: SONOS Split-Gate eFlash Memory. In: Hidaka, Hideto [Hrsg.]: Embedded Flash Memory for Embedded Systems. Cham: Springer, 2018. p. 244: “Various defects in the insulator film significantly affect the reliability of flash memory. […] Not only hard defects, which are introduced in the fabrication process, but also soft defects occur by stress of repeated program/erase cycles, thus causing reliability to deteriorate.”

80 Hidaka, Hideto: Applications and Technology Trend in Embedded Flash Memory. In: Hidaka, Hideto [Hrsg.]: Embedded Flash Memory for Embedded Systems. Cham: Springer, 2018. p. 7.

81 See Kono, Takashi; Saito, Tomoya; Camauchi, Tadaaki: Overview of Embedded Flash Memory Technology. In: Hidaka, Hideto [Hrsg.]: Embedded Flash Memory for Embedded Systems. Cham: Springer, 2018. p. 38 – 39.

82 Casey, 2009. p. 388. 83 Casey, 2009. p. 388.

84 See Casey, 2011. p. 390.

85 Casey, 2009. p. 390.

86 See Casey, 2011. p. 448.; also: Casey, 2009. p. 388: “Modern NAND flash relies on error-correcting codes, stored in the spare area bytes, to detect and correct these errors. If errors cannot be recovered, a block is marked bad and another block is used instead.”

87 See ibd.; also: Casey, 2009. p. 392.

88 See Casey, 2009. p. 429.; also: Casey, 2009. p. 388: “these systems are mostly built in such a way that deleted files are only marked in the FAT as deleted but can still be retrieved.”

89 Casey, 2009. p. 418.

90 See Kirschenbaum, 2008. p. 89 – 99.

91 See Kono et al., 2018. p. 35.

92 See Kono et al., 2018. p. 43.

93 See Ankerhold, Joachim: Tunneling of Quantum Bits. In: Ankerhold, Joachim: Quantum Tunneling in Complex Systems. Berlin, Heidelberg: Springer, 2007. p. 34.

94 See Casey, 2011. p. 482.

95 Kirschenbaum, 2008. p. 106.

96 See Casey, 2011. p. 37.

97 See Kirschenbaum, 2008. p. 108.

98 See Casey, 2009. p. 15.

99 Kirschenbaum, 2008. p. 102.

100 See Fuller, Matthew; Goffey, Andrew: Toward An Evil Media Studies. In: Parikka, Jussi; Sampson, Tony D. [Hrsg.]: The Spam Book. On Viruses, Porn and Other Anomalies from the Dark Side of Digital Culture. New York: Hampton Press, 2009.p. 154.

101 See Caloyannides, Michael A.: Privacy Protection and Computer Forensics. Second Edition, Norwood: Artech House, 2004. p. 59.; p. 317.

102 Hui, Yuk: On the Existence of Digital Objects. Minneapolis: University of Minnesota Press, 2016. p. 181.

103 Kirschenbaum, 2008. p. 157, emphasis in original.

104 Hui, 2016. p. 180.

105 Hui, 2016. p. 181.

106 Hui, 2016. p. 181.

107 Hui, 2016. p. 18.

108 See Kirschenbaum, 2018. p. 11.

109 Kirschenbaum, 2018. p. 13.

110 Kirschenbaum, 2018. p. 10.

111 Ernst, Wolfgang: Digital Memory and the Archive. Minneapolis: University of Minnesota Press, 2016. p. 61.

112 See Ernst, 2016. p. 64.

113 Ernst, 2016. p. 155.

114 Kirschenbaum, 2008. p. 251.

115 Kirschenbaum, 2008. p. 251.

116 Kirschenbaum, 2008. p. 256.

117 Kirschenbaum, 2008. p. 259.

118 Hui, 2016. P. 111.

119 See Hui, 2016. p. 111.

120 Hui, 2016. p. 182.

121 Hui, 2016. p. 110.

References

Ankerhold, Joachim: Tunneling of Quantum Bits. In: ders.: Quantum Tunneling in Complex Systems. Berlin, Heidelberg: Springer, 2007. S. 34 – 37.

Die Bundesregierung der Bundesrepublik Deutschland: Antwort auf kleine Anfrage: Rechtsextremistische Inhalte und Amoklauf-Ankündigungen auf Internet-Spieleplattformen. Drucksache 19/9624 (24.04.2019). Köln: Bundes-anzeiger Verlag, 2019.

Caloyannides, Michael: Privacy Protection and Computer Forensics. Second Edition, Norwood, MA: Artech House, 2004.

Casey, Eoghan: Digital Evidence and Computer Crime. Forensic Science, Computers, and the Internet. Dritte Auflage, Cambridge: Academic Press, 2011. [2000]

Casey, Eoghan [Hrsg.]: Handbook of Digital Forensics and Investigation. Cambridge: Academic Press, 2009.

Ernst, Wolfgang: Digital Memory and the Archive. Hrsg.: Parikka, Jussi. Minneapolis: University of Minnesota Press, 2013.

Hidaka, Hideto [Hrsg.]: Embedded Flash Memory for Embedded Systems. Cham: Springer, 2018:
________ Hidaka, Hideto: Applications and Technology Trend in Embedded Flash Memory. p. 7 – 28.
________ Ito, Takashi; Taito, Yashuiko: SONOS Split-Gate eFlash Memory. p. 209 – 244.
________ Kono, Takashi; Saito, Tomoya; Yamauchi, Tadaaki: Overview of Embedded Flash Memory Technology. P 29 – 74.

Hui, Yuk: On the Existence of Digital Objects. Minneapolis: University of Minnesota Press, 2016.

Kittler, Friedrich: Aufschreibesysteme 1800 – 1900. Dritte Auflage, München: Wilhelm Fink Verlag, 1995. [1985]

Kittler, Friedrich: Grammophon, Film, Typewriter. Berlin: Brinkmann und Bose, 1986.

Kruse, Warren G.; Heiser, Jay G.: Computer Forensics: Incident Response Essentials. Boston: Addison-Wesley, 2012.

Parikka, Jussi; Sampson, Tony D. [Hrsg.]: The Spam Book. On Viruses, Porn and Other Anomalies from the Dark Side of Digital Culture. New York: Hampton Press, 2009:
________ Fuller, Matthew; Goffey, Andrew: Toward An Evil Media Studies. p. 141 – 159.
________ Parikka, Jussi; Sampson, Tony D.: On Anomalous Objects of Digital Culture. An Introduction. p. 1 – 21.

Plant, Sadie; Land, Nick: Cyberpositive. In: Fuller, Matthew [Hrsg.]: UNNATURAL. Techno-Theory for a Contaminated Culture. London: Underground, 1994. (Unpaginiert.)

Völz, Horst: Grundlagen der Information. Berlin: Akademie Verlag, 1991.