Inferring Trimming Activity of Solid-State Drives Based on Energy Consumption

James Shey, Ryan Rakvic, Hau Ngo, Owens Walker, Thomas Tedesso, Justin A. Blanco, Kevin Fairbanks Electrical and Computer Engineering Department United States Naval Academy Annapolis, MD, US. {shey, rakvic, ngo, owalker, tedesso, blanco, fairbank}@usna.edu

Abstract—Solid-state drives (SSDs) have become pervasive in power consumption behavior could signal that a device is modern computing and are replacing hard disk drives in many malfunctioning. Accordingly, it is important to develop various applications. However, the mechanism by which SSDs store and techniques to examine SSDs and ensure a particular device is modify data is intrinsically different from hard disk drives. For example, a memory location on a SSD must be erased behaving as expected. There has been work on the energy prior to being written. The main contribution of this paper efficiency of SSDs [4–6], but an extensive literature review is a set of measurement and analysis techniques for inferring indicates that this is the first effort to correlate a specific class the behavior of a SSD by observing its power consumption. of SSD functionality, such as TRIM, with power consumption. This paper measures and analyzes the energy consumption of This paper is organized as follows. A brief review of the the TRIM command for three separate SSDs. Energy and time models are derived for all three SSDs and it is shown that these architecture and operation of SSDs is provided in Section II models are approximately linear as a function of the size of the while Section III discusses related work. The experimental file being trimmed. Additionally, empirically obtained signatures design is presented in Section IV and the results are discussed are presented to identify when a TRIM command is issued to in Section V. Finally, Section VI draws conclusions and the SSD based on the observed waveform. Our findings support proposes future work. the hypothesis that energy and time models, as well as power signatures, differ among drive manufacturers. II.SSDARCHITECTUREAND OPERATION Index Terms—SSD; power consumption; modeling; SSDs have faster access speeds because they do not have the I.INTRODUCTION moving mechanisms that are present their HDD counterparts. Solid State Drives (SSDs) come from a niche market, but Without the moving heads and rotating platters, every block on recently entered the mainstream storage-media market and are the same physical chip can be accessed with the same latency. available on a wide variety of consumer computers, including While SSDs can be built on either NOR or NAND flash laptops. As an alternative to conventional hard disk drives memory technology, most modern SSDs utilize the NAND (HDDs), SSDs have several benefits including lower read- architectures. Floating transistors in NAND-flash memory are write latency and lower energy consumption [1]. SSDs have arranged in rectangular grids known as memory blocks. Each become pervasive in modern computing, aided by the fact transistor in a column is connected in series such that the they are manufactured with equivalent interfaces and form drain terminal of one is connected to the source terminal of factors as magnetic HDDs, allowing an smooth transition. the next transistor in the column. A typical memory block has However, the mechanism by which SSDs store and modify 32 to 256 columns and 4096 to 65536 rows. Each row in a data is intrinsically different from HDDs. Many factors, which block is called a page. Within a memory block, word lines are are hardware and software related, affect the operation of SSDs connected to the gates of each row. The source terminal of the [2]. first transistor in each column, known as the source select, is The main contribution of this paper is a measurement and connected to the source line. Due to the setup of NAND flash analysis technique for inferring a specific SSD command, memory, it must be erased in blocks. TRIM, by observing the power consumption of the measured To ensure that the access time remains fast throughout the device. The impact of this work touches the fields of computer lifetime of the SSD, many manufacturers employ a technique security and privacy as an SSD’s power consumption can to reclaim pages with obsolete data known as garbage col- be profiled and aberrant behavior flagged similar to the side lection. The SSD controller keeps track of whether the data channel detection described in [3]. From a digital forensics within the pages of each block are valid or obsolete. When the and/or confidentiality concern standpoint, it may be impor- SSD is idle, the controller performs the garbage collection task tant to know with some certainty how the behavior of a which relocates pages with valid data in a partially filled block particular SSD will affect the ability to retrieve information. to another (presumably better utilized) block, and then erases Additionally, from a reliability viewpoint, a change in the the original partially filled block. How aggressively and how often the SSDs perform garbage collection is manufacturer dependent [1, 7, 8]. To ensure longevity of the drive manufacturers employ wear leveling. Each transistor can be written to a finite number of times. Wear leveling works with garbage collecting to write data to blocks that have the lowest number of writes. TRIM is a command that allows the operating system to send the SSD a message indicating that a file (which translates to all pages that belong to that file) can be marked as obsolete so that all the pages belonging to a deleted file data can be erased [8].

III.RELATED WORK

As SSDs continue to gain popularity, studying their perfor- mance characteristics has become an area of major interest Figure 1. System Setup including (a) Daughterboard and (b) Data Recorder [1, 7, 9]. In [7], the performance of SSDs using the TRIM feature is analyzed and it is shown that the TRIM feature can have a noticeable degradation on performance for SSDs. Table I SOLID-STATE DRIVES TESTED In [6, 8, 10, 11], it has been demonstrated that the fea- tures that SSD manufactures present in their datasheets are sometimes misleading. As an example, leading manufactures sometimes claim to perform TRIM, but a detailed black-box approach [8] found otherwise. This black-box analysis utilizes a software suite (including the algorithm outlined in [11]) to verify the bits on the drive in order to make inferences about SSD behavior [8]. In our work, we make use of the black- box approach [8] in our experimental setup and the algorithm in [11] to test whether a drive has actually been erased after A. Computer Setup having been given the command to erase it. There are numerous articles that have studied the power The testbed system is an Intel Core i5-2400 System with usage of different digital devices [12, 13] and, in particular, 16 GB DDR3 PC3-10600 running Windows 7 Service Pack hard drives [4–6, 14–16]. There has also been work on the 1. The system contains two drives, the first is an HDD that efficiency of SSDs by determining the relationship between contains the Operating System and all software required for workload and energy [3, 4] and one effort [6], through the use the experiments, and the second is the SSD to be tested. This of power analysis, demonstrated that a specific SSD performed setup ensures that the read, write, and delete commands for writes in coarser granularity than a single page. Other related the target SSD are controlled through the testbed programs (as work [14, 15] has focused primarily on modeling, whereas the opposed to the OS). The test SSDs are listed in Table I. research presented here is experimental. B. SSD Monitoring IV. EXPERIMENT DESIGN To monitor the test SSD, a daughterboard consisting of two This section describes the experimental setup used to mon- low-resistance precision resistors was inserted into the drive’s itor the power consumption of an SSD and map it to com- 4 pin Disk Drive Power Connector lines, as shown in Fig. mands provided to the SSD. The entire measurement system 1(a). A common measurement approach, this layout is similar is automated through the workload program to synchronize to the setup used in [14]. The daughterboard provides test the measurements of the executed commands with the data points to monitor the voltage across the resistor and across recorder via the computer’s serial port. The overall setup is the SSD. Both voltages are measured using 14 bits/sample at shown in Fig. 1. TRIM commands were evaluated for file 2 MS/s with 10:1 passive probes by a GEN3i High-Speed sizes of 1GB, 5 GB, 10 GB, 15 GB, 20 GB, and 25 GB Data Recorder with a GN412 High-Speed 100 MS/s Data as well as total disk usage of 25%, 50%, 75%, and 100%. Acquisition Card, shown in Fig. 1(b). This setup allowed The common, fixed file size measurements allow SSDs to be adequate sampling to capture all changes in the SSD current compared directly. Ten trial runs were conducted for each data and voltage while maintaining an error of less than 1mV. The point. The remainder of this section discusses the setup of data recorder also monitors the serial port of the computer, the computer, monitoring of the SSD, and operation of the enabling the recording of when commands are executed for workload program. different operations on the computer. for each drive which is shown in Fig. 6 and Fig. 7. Signature in this context is a unique pattern of energy consumption and not a mathematical model. The rectangular pulses represent a shift in the average power consumption of the drive. The time and energy scales on these signatures prototypes are the same where time 0 for each signature is the time at which the OS issued the TRIM command. The median delay from the issue of the TRIM command until the signature is seen for each drive is derived from the data of Fig. 5. Signatures are shown for both the TRIM Enabled and Disabled cases. It is significant to note that in the case of TRIM Disabled, there is no discernible pattern for the pulses and the pulses are not distinguishable from periodic pulses in the SSD’s activity. The individual results for each SSD are discussed in the following sections.

A. Crucial The Crucial SSD exhibited a consistent energy signal each time the TRIM command was executed and the amount of energy required for TRIM appeared to be a linear function of the file size as shown in Fig. 4. The linear regression model of the SSD’s energy consumption, E, in Joules, against trimmed file size, ψ, in Gigabytes (GB) is

E = 0.1067ψ + 0.5252 (1)

with a coefficient of determination (R2) of 0.9975. The time, T, in seconds, for the Crucial to complete the TRIM command is modeled as

T = 0.1899ψ + 1.0445 (2) Figure 2. Workload Program Flow Chart which is the linear regression equation corresponding to Fig. 4 with an R2 of 0.9954 C. Workload The Crucial had the widest range of time from when the A Python program was designed to automate the creation TRIM command was issued until the corresponding energy and deletion of files and ensure time synchronization between signature was seen, 5.9698s to 46.8988s, with the median the host computer and the data recorder. A flow chart for being 20s, as shown in Fig. 5. All times above 30s were for the program is presented in Fig. 2. The program creates a deletion of files of 50% of the drive or greater. file of desired size containing random bytes to ensure that The Crucial energy signature always ended with a pulse the power consumed is not data dependent. The data recorder averaging 490.5854 ms corresponding to 0.3653 J. Addition- is synchronized before the delete command is issued via the ally, the Crucial exhibited the closest R2 to 1 for both energy serial port. The algorithm developed by Bell-Boddington [11] consumption and elapsed time as a function of the file size is used to verify that the TRIM command has fully deleted the of the trimmed file. This analysis led to the signature shown file. If the file has not been fully erased, the program formats in Fig. 6(a) and Fig. 7(a). In Fig. 7(a), the first pulse is of the drive prior to the creation of another file. variable length and can be a combination of up to 3 pulses. This signature can potentially be used to identify that the V. EXPERIMENTAL RESULTS TRIM command is being issued to the Crucial SSD. The TRIM command was executed for each drive (ten trial runs per data point, per drive) and the experiment yielded the B. OCZ energy consumption model shown in Fig. 3 and the elapsed The OCZ would trim each time the TRIM command was time for completion of the TRIM command shown in Fig. 4. issued but would only fully delete the file for file sizes less than Fig. 5 shows the histogram of the time from the issue of 1 GB. This result corroborates the finding in [8], where some the TRIM command from the computer until the signature SSDs would not fully delete the data with a TRIM command for each drive is seen. From this data and analysis of the and thus portions of the original file were recoverable. For file waveform of each drive for each run, signatures were created sizes greater than 1 GB, the OCZ appeared to delete portions Table II OCZTRIMOPERATION

Figure 3. Energy to trim one file

of the file in a stepped approach. Table II shows the amount of the file deleted when the TRIM command was used. The linear regression model of Fig. 3 for the OCZ’s energy consumption is

E = 0.0787ψ + .8322 (3)

with an R2 of 0.9783. The time for the TRIM model is

T = 0.18ψ + 1.8109 (4)

2 Figure 4. Time to trim one file and is the linear regression of Fig. 4 with an R of 0.9797. This lower R2 value for Fig. 3 and Fig. 4 can be attributed to the OCZ trimming in a stepwise pattern (as seen in Fig. 3, Fig. 4, and Table II). Looking at the time from the when the TRIM command was issued until the corresponding energy signature was seen, the OCZ had a range of 5.5654s to 20.6408s, as shown in Fig. 5, with a median of 17s. The OCZ had the highest steady- state power usage at 415mW, but the energy consumption for the OCZ TRIM was the lowest compared to the other SSDs. Steady-state power is the power the SSD uses when there are no commands issued to it. This lower value for the TRIM command is not surprising since the OCZ did not fully delete the trimmed file. One possible explanation for not fully deleting a trimmed file is the performance limitations imposed by fully trimming a file as outlined in [7]. The OCZ TRIM command signature shown in Fig. 6(b) and Fig. 7(b) is based on this experimental data. The appreciable Figure 5. Time from TRIM command issued until signature difference between the trim of two different file sizes for the OCZ SSD is the duration of the pulse, as shown in Fig. 7(b) compared to Fig. 6(b). Figure 6. 1 GB file TRIM signature Figure 7. 5 GB file TRIM signature

C. Samsung Similar to the Crucial, the Samsung SSD appeared to erase the whole file with every TRIM command. The linear regression of Fig. 3 for the Samsung’s energy consumption is

E = 0.9217ψ + 1.42 (5) with an R2 of 0.9955. The corresponding linear regression of the time for the TRIM model from Fig. 4 is T = 1.8895ψ + 3.6646 (6) with an R2 of 0.9904. The Samsung SSD had the lowest steady-state power usage of all the SSDs tested and the time from issuing the TRIM Command until the corresponding energy signature was seen as nearly the same as that of the OCZ SSD, 5.3145s to 20.503s Figure 8. 1 GB File Write with a median of 20s, as shown in Fig. 5. The signature for the Samsung was built on this data and is shown in Fig. 6(c) and Fig. 7(c). The appreciable difference The ability to distinguish the TRIM command from other between the TRIM models of two different file sizes is the commands is an integral part of fully understanding a SSD. duration of the first pulse as shown in Fig. 7(c) when compared An observed 1 GB file write for each drive can be seen in to Fig 6(c). Fig. 8. This observation is not overlaid on Fig. 6 due the magnitudes of power for the write. Visually comparing the VI.CONCLUSIONSAND FUTURE WORK TRIM signatures (Fig. 6) and observed write (Fig. 8), it is This paper examined the energy signature of three SSDs to possible to differentiate the TRIM command from the write. infer trim commands issued to them. The signatures presented Models and signatures for write and read need to be fully in this paper demonstrate that it is possible to infer TRIM developed as well as SSD controller functions (e.g., garbage activity based on energy usage and visual pattern matching. collection and wear leveling) to create a more comprehensive Additionally, our results suggest a linear relationship between signature library. energy consumption and the file size of the file being trimmed All data were analyzed in the time domain in this work. and between TRIM completion time and the size of the file Further analysis using frequency domain features and machine being trimmed. learning may yield additional information as well as automated Different signatures emerge when analyzing the SSDs from approaches to SSD behavior inference based on energy/power different manufacturers. This may be attributable to each signatures. Preliminary work is also being conducted to eval- manufacturer using a proprietary controller and algorithms to uate the energy consumption using a Rogowski coil and the accomplish the functions of a SSD, as discussed in [7, 8]. results appear promising. This would be less invasive than the daughterboard technique currently in use and would improve technique for automatic instruction set characterization of the scalability of the approach. embedded processors,” in Instrumentation and Measure- ment Technology Conference Proceedings, 2007. IMTC ACKNOWLEDGMENT 2007. IEEE, May 2007, pp. 1–4. We would like to thank Rupam Mondal for his work on the [13] V. Konstantakos, A. Chatzigeorgiou, S. Nikolaidis, and Python workload program. T. Laopoulos, “Energy consumption estimation in em- bedded systems,” in Instrumentation and Measurement REFERENCES Technology Conference, 2006. IMTC 2006. Proceedings [1] H. Huang, S. Li, A. Szalay, and A. Terzis, “Performance of the IEEE, April 2006, pp. 235–238. modeling and analysis of flash-based storage devices,” in [14] J. Yan, C. Lonappan, A. Vajid, D. Singh, and W. Kaiser, Mass Storage Systems and Technologies (MSST), 2011 “Accurate and low-overhead process-level energy estima- IEEE 27th Symposium on, May 2011, pp. 1–11. tion for modern hard disk drives,” in Green Computing [2] N. Agrawal, V. Prabhakaran, T. Wobber, J. D. Davis, and Communications (GreenCom), 2013 IEEE and In- M. Manasse, and R. Panigrahy, “Design Tradeoffs for ternet of Things (iThings/CPSCom), IEEE International SSD Performance,” in USENIX Annual Technical Con- Conference on and IEEE Cyber, Physical and Social ference, Boston, MA, USA, 2008, pp. 57–70. Computing, Aug 2013, pp. 171–178. [3] M. Tehranipoor and F. Koushanfar, “A survey of hard- [15] V. Mohan, S. Gurumurthi, and M. Stan, “Flashpower: A ware trojan taxonomy and detection,” Design Test, IEEE, detailed power model for nand flash memory,” in Design, vol. PP, no. 99, pp. 1–1, 2013. Automation Test in Europe Conference Exhibition, 2010, [4] S. Shin and D. Shin, “Power Analysis for Flash Memory March 2010, pp. 502–507. SSD,” in Workshop for Operating System Support for [16] G. Hong, “Analysis of peak current consumption Non-Volatile RAN (NVRAMOS 2010), Jeju, Korea, 2010. for large-scale, parallel flash memory,” in Workshop [5] E. Seo, S. Park, and B. Urgaonkar, “Empirical Analysis for Operating System Support for Non-Volatile RAN on Energy Efficiency of Flash-based SSDs,” in Proceed- (NVRAMOS 2011), Jeju, Korea, 2011. ings of the conference on Power Aware Computing and Systems (HotPower ’08), San Diego, CA, USA. [6] B. Yoo, Y. Won, J. Choi, S. Yoon, S. Cho, and S. Kang, “SSD Characterization: From Energy Consumption’s Perspective,” in Proceedings of the 3rd USENIX confer- ence on Hot topics in storage and file systems (HotStor- age 2011), Portland, OR, USA, 2011, pp. 3–3. [7] G. Kim and D. Shin, “Performance Analysis of SSD write using TRIM in NTFS and EXT4,” Computer Sci- ences and Convergence Information Technology (ICCIT), pp. 422–423, 2011. [8] G. Bonetti, M. Viglione, A. Frossi, F. Maggi, and S. Zanero, “A Comprehensive Black-box Methodology for Testing the Forensic Characteristics of Solid-state Drives,” in Proceedings of the 29th Annual Computer Security Applications Conference, New Orleans, LA, USA, 2013, pp. 269–278. [9] J. Yoo, Y. Won, J. Hwang, S. Kang, J. Choi, S. Yoon, and J. Cha, “VSSIM: Virtual machine based SSD simulator,” in Mass Storage Systems and Technologies (MSST), 2013 IEEE 29th Symposium on, May 2013, pp. 1–14. [10] S. Li and H. Huang, “Black-box performance modeling for solid-state drives,” in Modeling, Analysis Simulation of Computer and Telecommunication Systems (MAS- COTS), 2010 IEEE International Symposium on, Aug 2010, pp. 391–393. [11] G. Bell and R. Boddington, “Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?” Journal of Digital Forensics, Se- curity and Law, pp. 1–20, 2010. [12] M. Wendt, M. Grumer, C. Steger, R. Weiss, U. Neffe, and A. Muhlberger, “Energy consumption measurement