As ransomware inevitably overwrites existing data, SSDs can detect ransomware attacks by monitoring overwrites. The state-of-the-art technology uses a hash to monitor overwrites, which consumes tens of bytes of memory per I/O. To improve memory efficiency, we propose a bitmap-based overwrite detection method that uses only one bit per I/O.