SSD Data Recovery
Concepts and Methodologies
We're often asked why data recovery of
solid state drives is necessary. Many people have the perception that anything
solid state from USB flash
drives to SSDs are
impervious to failure due to the lack of moving parts. While these drives are
unlikely to fail from being dropped they have their own unique issues which
impact their long term
endurance
such as wear damage, firmware
bugs, or poor fault handling by the drives firmware.
A solid state
drive's endurance is limited by thenumber of available spare blocks and the
amount of error
correcting code implemented to correct bit errors that develop from writing
data over the lifetime of the drive. Solid state drives will
transparently remap
blocks of data to different locations so no one block is written to more
frequently than another. The boom in solid state drive solutions has created a
plethora of companies, controllers,
and firmware versions with different implementations to address this problem.
To successfully recover data from solid state drives requires an in-depth
knowledge of how
data is stored and addressed throughout NAND memory for that vendor's specific
implementation.
At the core of a solid state drive is its remapping
table, a data structure which translates LBA addresses to NAND block address
allowing the controller to locate data. Most controllers tag each block of data
with an address or store an array of addresses in a table somewhere in NAND.
Addresses can be merged with status bits which obfuscate the actual address
making locating these data structures difficult without knowing the encoding
scheme beforehand.
In the last year a few companies have come out with
canned / prepackaged data recovery solutions for recovering data from solid
state drives. These solutions support a limited number of controllers, firmware
and NAND memory configurations. To use these solutions data recovery shops
remove the NAND memory chips, read their contents, then use a software
application to process the NAND contents and generate a final image. Most
controller/firmware/NAND combinations are only partially reverse engineered
resulting in a poor or corrupt image.
SSD bad block
routines,damaged remapping tables and wear damage can also negatively affect
the final image.
If the drive isn't supported by a 3rd party solution
it's up to the data recovery shop to create their own solution. This typically
involves locating file system data structures stored in predictable locations or
purchasing an identical drive and writing test patterns to figure out how the
controller is storing and addressing data. This process can take anywhere from a
few weeks to a few months depending on the complexity of the drive.
In
either case a full recovery can be complicated by the quality of data stored
within the NAND memory chips and how gracefully the drive failed.Firmware bugs,
sudden power
loss, or the firmware's inability to handle a specific fault can leave the
drives internal data structures or user data in an inconsistent state.Generally
wear leveling
algorithms effectively spread writes over the NAND media however in a few
cases we've found one NAND chip has a statistically larger number of
uncorrectable errors than its neighboring NAND chips. This can result in a poor
final image as data is frequently interleaved between two or more NAND chips.
Many new solid state drives are proactively using simple ciphers or
military grade symmetric key
encryption (eg:
AES) which obfuscate the data stored in NAND memory. While simple cipher keys
can be broken with frequency analysis, symmetric key encryption is nearly
impossible to break without the manufacturer's help. Currently drives
implementing symmetric key encryption algorithms are considered unrecoverable.
In a climate of rush SSDs with buggy firmware this can be a dangerous
combination ensuring the end users data is lost if the drive fails.
Data
recovery of solid state drives is inherently complex. Due to advances in NAND
storage concepts older drives (Pre
2009) tend to
be more recoverable than newer (2010 and
later) solid state drives. Over time and as the industry consolidates we may
see an increase in the number of recoverable drives as more resources can be
devoted to fewer drives. Locating a data recovery shop specializing in solid
state drives can be tricky because few companies (small or large) have devoted
any real time or money into independent research and development of solid state
drives.
If you're in the unfortunate position that you need your data
recovered from a solid state drive get a referral from the drives controller or
SSD manufacture. Otherwise try searching for a data recovery shop that
specializes in your specific drive or NAND data recovery as a whole. Avoid data
recovery shops that specialize in EVERYTHING and be skeptical of shops that
specialize primarily in hard drives as they likely won't have much experience in
NAND or solid state drives.
Many data recovery shops won't tell you they don't know how to recover
data from your drive so they might fabricate an excuse like the controller is
bad, static electricity damaged the drive or the controller overwrote all your
data. If a data recovery shop says your drive is unrecoverable try another
company.
Most importantly
BACKUP YOUR DATA!!! |
|
Editor's footnotes
and disclaimer
by Zsolt Kerekes,
editor StorageSearch.com
My
editor's introduction had gotten so long and unwieldy - there was a distinct
risk that readers wouldn't get to see any of the text written by Jeremy Brock
above when they landed on this page. So I put it here at the end instead.
Data recovery for
magnetic, optical and simple flash memory storage is a well established science
and market that has received plenty of coverage here on StorageSearch.com since
1998. But what about SSDs? They're different. Some SSDs are more complicated
internally than RAID systems.
And there are many different ways of designing SSDs that even
SSD architects disagree
about.
I started talking to experts in traditional DR companies
about the subject of SSD
data recovery back in
2007. What I
needed - I said - was someone who not only knew some of the theory - but also
had enough experience of handling SSD recoveries to write a reliable
introductory article on this topic for our readers.
Now when it comes
to the subject of SSDs - I am a difficult editor to satisfy - because I've
talked to more SSD companies (past, present and future) than anyone else on
the planet. And the problem for SSD recovery companies is that because SSD
recovery is still a small new market their expertise is limited to subset of
what's actually out there - and consequently they may extrapolate a naiive
view from the limited stuff they've seen. All that will change in the next few
years. In the meantime - I needed an article now - while we're still at the
start of the SSD market
bubble. But who was going to write it?
And I had to make sure that
I filtered out spammy companies - who just want your business - but don't know
as much as they should. To be fair - nobody knows all the answers today.
A
few months ago Jeremy Brock (the author of the article below) emailed me to say
he disagreed with my suggestion that readers should filter out DR companies
less than 5 years old who claimed they could do SSD recoveries. His company at
the time was 3 years old - and specialized in flash storage.
Over a
period of more than 30 very lengthy email exchanges (some of which were
article length in themselves) I came around to the view that readers would
definitely benefit from seeing an article written by the nearest thing that the
market has today to an expert in comsumer SSD recoveries.
So that's how
the article on this page was born.
I couldn't find a linkedin page or
bio for Jeremy Brock - so I linked to some other articles he had previously
written instead.
And now you can see why this couldn't go at the
beginning. I'm just not very good at managing my own word counts in editorial. |
| ......................................................................................................................... | |
|
|
| . |
| Surviving SSD
sudden power loss |
Why should you care
what happens in an SSD when the power goes down?
This important design
feature - which barely rates a mention in most SSD datasheets and press releases
- has a strong impact on
SSD data integrity
and operational
reliability.
This article will help you understand why some
SSDs which (work perfectly well in one type of application) might fail in
others... even when the changes in the operational environment appear to be
negligible. |
|
| | |
| . |
| Learning how data is mapped
into the flash memory in a failed unknown
USB flash drive using
reverse engineering methods and poking data into a similar working drive
monitored by a logic analyzer is demonstrated in a
video
(May 2015) by Gillware Data Recovery |
 | | |
| . |
 |
| . |
| Today's commodity 2D MLC
flash has raw wear-out in the 2,000 to 3,000 write cycle range. Pioneers of 3D
flash SSD design say that raw 3D nand flash endurance is better.
|
| SSD endurance myths
and legends | | |
| . |
|
|
| . |
 |
| . |
|
| |
