SSD Data Recovery
Concepts and Methodologies
We're often asked why data recovery of
solid state drives is necessary. Many people have the perception that anything
solid state from USB flash
drives to SSDs are
impervious to failure due to the lack of moving parts. While these drives are
unlikely to fail from being dropped they have their own unique issues which
impact their long term
endurance
such as wear damage, firmware
bugs, or poor fault handling by the drives firmware.
A solid state
drive's endurance is limited by thenumber of available spare blocks and the
amount of error correcting code implemented to correct bit errors that develop
from writing data over the lifetime of the drive. Solid state drives will
transparently remap
blocks of data to different locations so no one block is written to more
frequently than another. The boom in solid state drive solutions has created a
plethora of companies, controllers,
and firmware versions with different implementations to address this problem.
To successfully recover data from solid state drives requires an in-depth
knowledge of how data is stored and addressed throughout NAND memory for that
vendor's specific implementation.
At the core of a solid state drive is
its remapping table, a data structure which translates LBA addresses to NAND
block address allowing the controller to locate data. Most controllers tag each
block of data with an address or store an array of addresses in a table
somewhere in NAND. Addresses can be merged with status bits which obfuscate the
actual address making locating these data structures difficult without knowing
the encoding scheme beforehand.
In the last year a few companies have
come out with canned / prepackaged data recovery solutions for recovering data
from solid state drives. These solutions support a limited number of
controllers, firmware and NAND memory configurations. To use these solutions
data recovery shops remove the NAND memory chips, read their contents, then use
a software application to process the NAND contents and generate a final image.
Most controller/firmware/NAND combinations are only partially reverse engineered
resulting in a poor or corrupt image. SSD bad block routines,damaged remapping
tables and wear damage can also negatively affect the final image.
If
the drive isn't supported by a 3rd party solution it's up to the data recovery
shop to create their own solution. This typically involves locating file system
data structures stored in predictable locations or purchasing an identical drive
and writing test patterns to figure out how the controller is storing and
addressing data. This process can take anywhere from a few weeks to a few months
depending on the complexity of the drive.
In either case a full
recovery can be complicated by the quality of data stored within the NAND memory
chips and how gracefully the drive failed.Firmware bugs,
sudden power
loss, or the firmware's inability to handle a specific fault can leave the
drives internal data structures or user data in an inconsistent state.Generally
wear leveling algorithms effectively spread writes over the NAND media however
in a few cases we've found one NAND chip has a statistically larger number of
uncorrectable errors than its neighboring NAND chips. This can result in a poor
final image as data is frequently interleaved between two or more NAND chips.
Many
new solid state drives are proactively using simple ciphers or military grade
symmetric key
encryption (eg:
AES) which obfuscate the data stored in NAND memory. While simple cipher keys
can be broken with frequency analysis, symmetric key encryption is nearly
impossible to break without the manufacturer's help. Currently drives
implementing symmetric key encryption algorithms are considered unrecoverable.
In a climate of rush SSDs with buggy firmware this can be a dangerous
combination ensuring the end users data is lost if the drive fails.
Data
recovery of solid state drives is inherently complex. Due to advances in NAND
storage concepts older drives (Pre
2009) tend to
be more recoverable than newer (2010 and
later) solid state drives. Over time and as the industry consolidates we may
see an increase in the number of recoverable drives as more resources can be
devoted to fewer drives. Locating a data recovery shop specializing in solid
state drives can be tricky because few companies (small or large) have devoted
any real time or money into independent research and development of solid state
drives.
If you're in the unfortunate position that you need your data
recovered from a solid state drive get a referral from the drives controller or
SSD manufacture. Otherwise try searching for a data recovery shop that
specializes in your specific drive or NAND data recovery as a whole. Avoid data
recovery shops that specialize in EVERYTHING and be skeptical of shops that
specialize primarily in hard drives as they likely won't have much experience in
NAND or solid state drives.
Many data recovery shops won't tell you they don't know how to recover
data from your drive so they might fabricate an excuse like the controller is
bad, static electricity damaged the drive or the controller overwrote all your
data. If a data recovery shop says your drive is unrecoverable try another
company.
Most importantly
BACKUP YOUR DATA!!!
PS
- to discuss this article with the author - email jeremy@aplusperfect.com |
|
Editor's introduction,
footnotes and disclaimer
My editor's intro had gotten so
long and unwieldy - there was a distinct risk that readers wouldn't get to see
any of the text by the author of the above article when they landed on this
page. So I put it here at the end instead.
Data recovery for
magnetic, optical and simple flash memory storage is a well established science
and market that has received plenty of coverage here on StorageSearch.com since
1998. But what about SSDs? They're different. Some SSDs are more complicated
internally than RAID systems.
And there are many different ways of designing SSDs that even
SSD architects disagree
about.
I started talking to experts in traditional DR companies
about the subject of SSD
data recovery back in
2007. What I
needed - I said - was someone who not only knew some of the theory - but also
had enough experience of handling SSD recoveries to write a reliable
introductory article on this topic for our readers.
Now when it comes
to the subject of SSDs - I am a difficult editor to satisfy - because I've
talked to more SSD companies (past, present and future) than anyone else on
the planet. And the problem for SSD recovery companies is that because SSD
recovery is still a small new market their expertise is limited to subset of
what's actually out there - and consequently they may extrapolate a naiive
view from the limited stuff they've seen. All that will change in the next few
years. In the meantime - I needed an article now - while we're still at the
start of the SSD market
bubble. But who was going to write it?
And I had to make sure that
I filtered out spammy companies - who just want your business - but don't know
as much as they should. To be fair - nobody knows all the answers today.
A
few months ago Jeremy Brock (the author of the article below) emailed me to say
he disagreed with my suggestion that readers should filter out DR companies
less than 5 years old who claimed they could do SSD recoveries. His company at
the time was 3 years old - and specialized in flash storage.
Over a
period of more than 30 very lengthy email exchanges (some of which were
article length in themselves) I came around to the view that readers would
definitely benefit from seeing an article written by the nearest thing that the
market has today to an expert in comsumer SSD recoveries.
So that's how
the article on this page was born.
I couldn't find a linkedin page or
bio for Jeremy Brock - so I linked to some other articles he had previously
written instead.
And now you can see why this couldn't go at the
beginning. I'm just not very good at managing my own word counts in editorial. |
| ......................................................................................................................... | |
|
|
| . |
| Surviving SSD
sudden power loss |
Why should you care
what happens in an SSD when the power goes down?
This important design
feature - which barely rates a mention in most SSD datasheets and press releases
- has a strong impact on
SSD data integrity
and operational
reliability.
This article will help you understand why some
SSDs which (work perfectly well in one type of application) might fail in
others... even when the changes in the operational environment appear to be
negligible. |
|
| | |
| . |
|
|
| . |
|
|
| . |
| "Fast purge SSDs
are the antithesis of ideal consumer / enterprise SSDs - because they are
designed to defeat data recovery. " |
| ...from:-
fast purge flash SSDs | | |
| . |
|
|
| . |
|
|
| . |
|
|
| . |
| why the notebook
SSD crystal ball is still murky |
Editor:- in September 2010 -
a reader (Andrew Hancox) sent me a list of 10 key questions about the
future of the SSD market.
His 1st question was - "How long do
you think it will be before the pricing of SSDs comes down to a level where
they are a viable option to be used as primary drives in portable devices for
mainstream consumers?" |
 |
Although I've been posing
and answering that very same question since before the SSD notebook market
began - I've come up with
a much better
answer.
| | | | |
