System for forensic tracing of memory device content erasure and tampering

Abstract

A system for providing forensic tracing of memory device content erasure and tampering is disclosed. The system uses a special command that enables forensic tracing in a secure memory device. Once the forensic tracing is enabled, firmware of the memory device tracks the data stored on the memory device. The command specifies whether the tracking and tracing is for the entire memory device or for a region of the memory device. The firmware confirms that the forensic tracing is enabled, and a target protection region is defined. Once an authenticated command for an operation to access, modify, or erase data of the memory device is received from a host, the system enables the operation to proceed. The system creates a trace of the operation and the metadata of the target region that is modified within a secure memory region of the memory device that is not addressable by the host device.