As previously mentioned, data is written to flash memory in units called pages. Pages are made up of multiple cells. However, flash memory can only be erased in larger units called blocks.  Blocks are made up of multiple pages.

If the data in some of the pages of a particular block are no longer needed (stale pages), only the pages with good data in that block are read and are then rewritten into another previously erased empty block. Then the free pages left by not moving the stale data are available for new data. This process is called garbage collection, and it happens automatically in the background as a mobile device operates. All solid-state storage includes some level of garbage collection, but they may differ in when and how fast they perform the process.

Unlike hard disk drives, flash memory-based solid-state devices (SSDs) don't contain spinning parts. In flash-based storage devices, data is written to pages (sometimes called cells) in an SSD that is made up of multiple flash memory chips. Cells have a finite life cycle, meaning that each one can only be written to so many times before it wears out and eventually becomes unprogrammable.

Wear leveling is a process that is designed to extend the life of solid-state storage devices. Solid state storage is made up of multiple microchips that store data in blocks. Each block can tolerate only a finite number of write/erase cycles before becoming unreliable. For example, NAND flash is typically rated at about 100,000 program/erase cycles. Wear leveling arranges data so that write/erase cycles are distributed evenly among all the blocks in the device, thereby allowing the device to last longer.¹

In practical terms, the wear leveling process can result in many search hits for any search term during the examination of data from a physical image of a smartphone or other device using flash-based memory for data storage.

In the slide’s example, the search term “Is that not awesome” was conducted across the full physical image of the NAND chip on a Samsung SCH R710 cell phone.

This search term resulted in 478 search hits across all the data on the physical image, although there were only two active files with a keyword match on the phone.

The wear leveling process can result in the content of deleted data of all types being written multiple times in multiple locations on a phone, leaving behind a plethora of potential evidentiary data.

Reference:

[1] https://for585.com/se1mv (Cypress white paper on wear leveling)