Digital Astro-Forensics: the Final Frontier - Semantic Scholar

Digital Cosmo-Forensics: the Final Frontier? Richard E Overill and Jantje A M Silomon Department of Informatics, King’s College London, Strand, London WC2R 2LS, UK {richard.overill | jantje.a.silomon}@kcl.ac.uk

Abstract In this paper we study the likelihood that digital forensic evidential traces could be corrupted or otherwise compromised by extra-terrestrial physical processes and their epiphenomena. Specifically, we consider cosmic rays with solar, galactic and extragalactic origins. The potential of such cosmic rays or radiation to alter the individual bits of current memory devices (hard disc ferromagnetic grains, conventional CMOS RAM and SSD Flash memory) is investigated using scaling and statistical techniques. Our memory model for this study permits the incorporation of error correcting codes (ECC) such as Hamming single error correction, double error detection (SEC-DED) logic. The available data enables a quantitative determination of a strong upper bound on the frequency (or probability) of such potentially evidence compromising, naturally occurring events to be made. The relevance of our findings for proactively blocking a number of potentially mountable legal defence stratagems is discussed in the context of both in vivo and post mortem digital forensics.

Keywords: digital memory devices; high-energy impacts; extra-terrestrial sources; digital forensic evidence compromise.

1. Introduction and Background A vital aspect of the forensic recovery and preservation of digital evidence for possible future use at trial is that the contents of any recovered or bit-for-bit copied memory device has not been altered between its seizure and its forensic examination. Standard precautions include the use of write-blockers and adherence to rigorous chain of custody procedures. However such standard precautions do not directly allow for spontaneous alterations to the digital evidence as a result of the impact of high-energy radiation or particles of extra-terrestrial origin on the memory device. In order to protect against accidental bit flipping, memory devices are routinely equipped with additional bits implementing a Hamming error correcting code (ECC), typically single error correction double error detection (SEC-DED) [1]. Thus only more-than-two-bit errors would go undetected, and it is generally accepted that under virtually all normal terrestrial conditions for data processing and data communication operations the likelihood of such errors occurring is vanishingly small.

However, the recent technical literature [2] makes it clear that the unavoidable corollaries of the continuing scaling of memory devices according to Moore’s law are that the voltage or charge threshold between their bistable states decreases and that the number of memory bits susceptible to a single high-energy impact increases. This leads us to pose the following question: do any current memory technologies exhibit vulnerabilities to transient single event upsets (SEUs or ‘soft errors’) affecting more than two bits which could realistically compromise their forensic evidential value? Before attempting to answer this question it is necessary to clarify one point. We are not concerned here with permanent damage to memory modules, such as may be caused by terrestrial lightning strikes or power grid spikes, since these are readily detectable by means of self-test diagnostic circuitry. Our focus here is on events that may potentially alter digital evidence without leaving a detectable forensic trace, and hence might form the basis for a future legal defence stratagem, similar in spirit to the Trojan horse defence [3-5].

2. Cosmic Rays Cosmic rays, a term originally coined by Robert Millikan around 1914, refer to a variety of extra-terrestrial phenomena. Primary cosmic rays comprise mainly protons (hydrogen nuclei, about 90%) and alpha particles (helium nuclei, about 10%). Their sources include the Sun, particularly during maxima in the 11-year solar cycle, our galaxy, particularly from black hole(s) located near its centre, and extremely distant extra-galactic objects such as active galactic nuclei (AGNs), quasi stellar objects (QSOs) and (potentially) gamma ray bursters (GRBs). The solar wind and the terrestrial atmosphere screen the Earth’s surface from cosmic rays with energies below about 0.1GeV. Hence early interest in the effects of cosmic rays was mostly limited to the avionics and space industries. Higher energy cosmic rays are transformed by interaction with atmospheric nitrogen and oxygen atoms to produce secondary cosmic rays, ultimately consisting mainly of electrons, muons, neutrons and protons at ground level. It should be noted that because charged particles stream towards the geomagnetic poles there is a pronounced latitude dependence of the ground level cosmic ray flux. It is also known that the cosmic ray flux is far from isotropic. Due to the directional nature of the distant sources the Earth may pass through cones of ejecta as it orbits the Sun and as the solar system revolves around the galactic centre, leading to ground level cosmic ray showers of heightened intensity from time to time. The energy spectrum of cosmic rays is known to take the form of a power law: N(E) = K.E-α where N(E) is the number of particles with energy E. A log–log plot of N(E) vs. E yields a straight line with gradient –α (see Figure 1) and it is found experimentally

that 2.8 < α < 3.0, depending on the cosmic ray source [6]. Note that the number of cosmic ray particles increases exponentially towards lower energies. Major early studies of the effects of ground level cosmic rays on digital systems were published by Ziegler and co-workers at IBM [7–11]. These studies showed that ground level cosmic rays (and particularly high-energy neutrons) were capable of penetrating 50m of concrete [8], and that on average a cosmic ray impact resulting in an SEU occurred about once a month in 256MB of RAM [9]. In addition, more recent studies have reported that individual SEUs are responsible for MBUs (multiple bit upsets) in which as many as 13 separate bits of 90nm SRAM were flipped [12], with almost 55% of all neutron impacts resulting in MBUs of some form [13]. The aim of this paper is to revisit the available data in the light of the continuing scaling trends in memory technologies over the intervening years, and to investigate whether the revised data may have implications for current digital forensics practice.

3. Memory Technology Scaling The experimental and theoretical IBM study [9] of the effects of ground level cosmic rays on digital circuits was completed in 1995. Given the continuing operation of Moore’s law over the intervening 16 years we would anticipate a 216/2 = 256-fold scaling in memory area technology to have taken place. Thus the revised figure would be that on average a cosmic ray impact resulting in an SEU would occur about once a month in 1MB of RAM, due solely to the area scaling effect. However, this figure does not take into account the reduction in electronic charge that accompanies the area scaling. The gate oxide thickness has to scale in approximate proportion to the dimensions of the channel length and the gate controlled depletion width in order to control the ‘short channel effect’ and to maintain a good sub-threshold cut-off slope [14]. Therefore the critical charge (Qcrit), defined as the minimum charge required to be injected into a circuit in order to induce an SEU, would scale approximately as 256-3/2 = 2-12. This in turn implies that cosmic ray impacts with correspondingly lower energies would be capable of causing an SEU. It is now convenient to re-write the cosmic ray energy spectrum power law in terms of probabilities: p(E) = C.E-α where C is the probability normalisation factor: The complementary cumulative distribution function (CCDF) of the cosmic ray energy spectrum also takes the form of a power law [15]: P>(E’) = C/(α-1).E’-(α -1)

and represents the probability of a cosmic ray having an energy E greater than some threshold energy E’. The ratio of the CCDFs representing the proportion of cosmic ray particles with energies greater than Qcrit/212 and the proportion with energies greater than Qcrit: P>(Qcrit /212):P>(Qcrit) = (212)(α-1) = 224, for α=3, gives the increase in the number of cosmic ray particles capable of causing an SEU due to the reduction in Qcrit. In order to incorporate the effect of an ECC such as Hamming SEC-DED it is necessary to find the ratio of the proportion of cosmic rays capable of causing an MBU of at least 3 bits to the proportion capable of causing an SEU. Under the assumption that most MBUs are caused by a single high-energy SBU, rather than a shower of several lower-energy SBUs [12], this ratio is given by: P>(3Qcrit /212):P>(Qcrit /212) = 3-(α-1) = 1/9, for α=3. Thus, combining the effects of area scaling, charge scaling and the mitigating presence of SEC-DEC ECC logic, we find a strong upper bound on the rate of cosmic ray induced undetectable SBU events to be 0.7 per second per MB of CMOS RAM.

4. Discussion of Results It needs to be stressed from the outset that our result represents a worst case. Firstly, not every interaction with a sufficiently energetic cosmic ray will necessarily result in an SEU, let alone an MBU. For example, the angle of incidence determines the degree of energy transfer into the memory device. An orthogonal interaction will dump virtually all the energy whereas a grazing interaction will offload virtually none. Specifically, if all angles of incidence are equally probable then: Et = E.sinθ = 2E/π, on average, where 0 < θ < π/2 is the angle of incidence and Et is the transferred energy. Secondly, we have taken the worst case value of α=3, whereas using α=2.8 would have reduced the result significantly. Thirdly, we have assumed that Moore’s law has continued to operate inexorably throughout the16 year period (1995 – 2011), doubling the memory bit density every two years, whereas in fact there is some evidence for a falling-off in the past decade [16]. Finally, it is very unlikely that a SEU causing an MBU of 3 bits would have an energy as low as 3Qcrit since a proportion of the energy would be dispersed between the MBUs. However, as chip feature sizes continue to move into the deep nanoscale region, the effects of both quantum mechanical tunneling of electrons and Boltzmann thermal

noise excitation of electrons could contribute to charge leakage which would have the effect of reducing Qcrit still further [14]. In addition to the use of ECCs, another partial mitigation strategy is bit interleaving, a data organisation scheme where physically contiguous bits do not belong to the same logical byte or word. Then if a cosmic ray strikes a physically contiguous sequence of bits, which is the most likely scenario, the logical ECCs have an improved chance of detecting the MBU. The discussion so far has focussed mainly on CMOS SRAM and DRAM memories since most of the available cosmic ray SEU data relates to these technologies. With regard to non-volatile SSD Flash memory, which usually employs NAND- or NORbased solid state circuit technology, a similar Moore’s law scaling trend has been observed, and similar area and charge scaling considerations apply, although the detailed nanoscale SEU mechanisms differ somewhat [16]. In the case of conventional hard disk ferromagnetic grains, completely different soft error mechanisms are operative since magnetisation, rather than charge, is used to represent each bit. To our knowledge, no systematic studies comparable with those for RAM and SSD memory have been undertaken to determine whether or not cosmic ray impacts are capable of producing hard disk soft errors. However, in order to generate the transient magnetic fields required to cause a HD SEU, accelerated charged particles (alpha particles, protons) of sufficiently high energy need to be produced at the HD surface. A viable mechanism for achieving this is currently not known. Note that we have not considered here the effects of alpha particles ejected from the immediate chip packaging as a result of radioactive decay since they are known to be more than an order of magnitude smaller than the cosmic ray effects [8].

5. Summary and Conclusions A comprehensive solution to the cosmic ray SEU issue is straightforward in principle. A hash of all the bits of the memory device needs to be performed immediately upon seizure of the device, and repeated immediately before and immediately after the forensic examination of the bit-for-bit copy of the device in order to ensure that data and meta-data integrity has been maintained. Without this assurance a wily defence counsel might (under some circumstances) be able to plausibly claim that the integrity of the recovered digital evidence had not have been preserved beyond all reasonable doubt. It appears that non-volatile SSD Flash memories from USB drives, digital cameras, mobile phones and similar devices should be the primary focus for post mortem evidential integrity assurance. However, with recent developments in in vivo (‘live’)

digital investigations in mind we also highlight the need to consider its use in CMOS SRAM and DRAM forensics.

References [1] R W Hamming, Error Detecting and error correcting codes, Bell Syst. Tech. J., 26 (2) (April 1950), 147–160. [2] P Hazucha and C Svensson, Impact of CMOS technology scaling on the atmospheric neutron soft error rate, IEEE Trans. Nuclear Science, 47 (6) (December 2000) 2586–2594. [3] D Haagman, and B Ghavalas, Trojan Defence: A Forensic View, Digital Investigation, 2 (1) (2005) 23–30. [4] B Ghavalas and A Philips, Trojan Defence: A Forensic View, part II, Digital Investigation, 2 (2) (2005) 133–136. [5] S Mason, Trusted Computing and Forensic Investigations, Digital Investigation, 2 (3) (2005) 189–192. [6] J D Hague, B R Becker, M S Gold and J A J Matthews, Power laws and the cosmic ray energy spectrum, http://arxiv.org/abs/astro-ph/0610865 [7] J F Ziegler and W A Lanford, Effect of cosmic rays on computer memories, Science 206 (4420) (1979) 776–788. [8] J F Ziegler, The effect of concrete shielding on cosmic ray induced soft fails in electronic systems, IEEE Trans. Electron. Devices, 28 (5) (1981) 560–565. [9] J F Ziegler et al., IBM experiments in soft fails in computer electronics (1978 – 1994), IBM J. Res. Devel., 40 (1) (January 1996) 3–18. [10] J F Ziegler. Terrestrial cosmic rays, IBM J. Res. Devel. 40 (1) (January 1996) 19–39. [11] J F Ziegler, Terrestrial cosmic ray intensities, IBM J. Res. Devel., 42 (1) (January 1998) 117–139. [12] R Naseer and J Draper, Parallel double error correcting code design to mitigate multi-bit upsets in SRAMs, Proc IEEE European Solid State Circuits Conference (ESSCIRC), (2008) 222–225. [13] Z Wang, M Karpovsky & K J Kulikowski, Design of memories with concurrent error detection and correction by non-linear SEC-DED codes, J. Electron. Test., 26 (2010) 559–580.

[14] D Rittman, CMOS nanometer scaling limited, Tayden Design (July 2006). [15] M E J Newman, Power laws, Pareto distributions and Zipf's law, Contemp. Phys., 46 (5) (2005) 323–351. [16] V V Zhirnov, R K. Cavin, III, J A. Hutchby and G I. Bourianoff, Limits to Binary Logic Switch Scaling—A Gedanken Model, Proc. IEEE, 91 (11), November 2003, 1934 – 1939. [17] J C McNulty and C D Hillman, Current concerns regarding solid state drive reliability, Proc. IDEMA Reliability Symposium, San Jose, CA (24 September 2008).

Figure 1. Cosmic ray energy spectrum