SSD Data Recovery

SSD Data Recovery

SSD Data Recovery

SSDs (Solid State Drives) may one day become the standard form of storage in computers. Apple laptops are already heading that way. There are certainly many advantages when comparing SSDs to HDDs (Hard Disk Drives), however they do bring their own problems, which are often not well reported. We don’t care how good SSDs can be. We care about how they fail. It’s common to hear things like: “I’m replacing my hard drive with an SSD so I won’t have to worry about it crashing again.” While this is technically true – there are no moving parts to crash – there are plenty of other ways an SSD can fail. Whether it’s technically crashed or not doesn’t matter at all when you can’t access your files. It’s a shame but an SSD does not get you out of the boring task of running regular backups.

There are some pros and cons which specifically affect data recovery from SSDs. I haven’t listed things like battery life or read / write speed as they are not relevant when it comes to recovering data from them.

SSD Pros:

  • Shock resistance. No moving parts to crash.
  • Just as susceptible to filesystem issues, deletion, reformatting, bad sectors etc which can be recovered using existing equipment.

SSD Cons:

  • False sense of security. The word reliable comes up a lot in SSD marketing with phrases like “More reliable, faster, and more durable than traditional magnetic hard drives.” Maybe research exists that shows SSDs are less prone to failure it doesn’t seem to be the case. Anything that holds your valuable data runs the risk of getting drenched, getting stolen, getting lost, and that’s before we take general failures into account.
  • Susceptible to electronic failure, Maybe more so than a hard drive as the storage and electronics are combined in SSDs. Some of the most common hard drive failures are caused by errors in the firmware which controls the performance of the drive. SSDs have very complex firmware, which opens the possibility of firmware corruption. In many cases firmware corruption will block access to your data.
  • Encryption. Most modern SSDs encrypt the data at a hardware level, which makes it impossible to remove data chips and extract data from them externally (you can do it, but the data is encrypted). The keys to the encryption are often stored within the controller chip, so if that fails, you could be locked out of your data for good. Modern encryption works well. You can’t get round it.
  • Wear-levelling algorithms. Which move the data around the SSDs to improve performance, can make recovery difficult as these algorithms would need to be taken into account when accessing a failed SSD. They don’t store data in logical order like hard drives do.

Recovering Deleted Data

In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

Recovering Deleted Data

The Filing Cabinet

The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

Overwritten / Deleted Data

We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

The Problem With SSDs

Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

Specifics

In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

The Important Bit

If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

Bigger Hard Drives of the Future

The Register has today posted two articles about the ongoing battle to expand hard drive capacities.

First is an actual device for sale, a 2TB Western Digital portable drive. This drive has a fancy new case and USB3 connection. It contains backup software and also the option to encrypt the data with a password. I wonder if it encrypts the data by default like some of their previous portables. (A bad thing!)

Second is a futuristic announcement from Seagate about their new HAMR technology. This new tech uses a laser to heat part of the disk before magnetising it. This apparently allows for much higher densities, theoretically paving the way for 60TB hard drives. There doesn’t appear to be any products using this technology at the moment.

60TB drives will be fantastic for backups, but horrible to backup without a new, faster form of connection. These would take almost forever (exaggeration) to fill up by SATA.

This news helps prove that hard drives are far from dead. It will take a long time until SSDs can cope with such massive capacities, at a similar cost to these beasts.

Apple & Lacie Thunderbolt Technology

Apple officially unveiled the newly updated MacBook Pro range featuring new high-speed Thunderbolt I/O technology and improved processor and graphics offerings back in February 2011. LACIE have just announced the Little Big Disk with Thunderbolt Technology to support this range of Macs. Running on PCI Express and DisplayPort protocols, data transfer speeds between peripherals on Thunderbolt technology can reportedly be done 20 times faster than USB 2.0. LACIE also mention the use of SSD technology in the little big disk to complement this technology, using two 250GB Intel 510® Series Solid-State Drives (SSD). The two solid-state drives are preconfigured as a Striped RAID Set for enhanced performance.
Our only concern with SSD technology is it’s reliability and endurance.
As with any non-volatile floating gate memory device, the more you cycle the device the more failures you tend to observe, and the less data retention you get. So although the I/O technology is the way forward, the type of device used for critical data storage, is still a question to be answered.

Dataquest part of Novatech’s New Managed Services

Dataquest’s specialist data recovery services incorporated in Novatech’s bespoke IT & Telecomms hardware solutions. Novatech can now offer their customers the complete worry free IT Solution. In partnership with Novatech, Dataquest will provide their customers with 24/7 Data Recovery support.

Novatech Blog

SSDs Not Secure

Some tests carried out by the “Non-Volatile Systems Laboratory” have revealed some serious flaws with SSDs ability to be securely erased. When using standard tools designed for spinning disks, the results were understandably bad. They also tried the built-in “Security Erase Unit” command and the results of this were generally not good. After being securely erased, most of the SSDs still contained some large fragments of the test files.

Some secure erasure software would be similarly inefficient for hard disks anyway, as things like remapped or bad sectors can still contain readable data which may not be erased during the process.

The simplest solution for securely erasing any data is to completely destroy the storage media. For hard drives this means making a real mess of the platters, for SSDs it means wrecking the whole PCB, data chips and controller chips.

Read More On Slashdot

3TB Seagate Drive

A new 3TB drive is looming on the horizon, yet this may not be the breakthrough it seems. There appears to be major problems in the way older versions of Windows handle drives above 2.1TB. Windows XP and below will be unable to make use of these drives in any meaningful way, with some reports suggesting that only 990MB  of usable capacity would be available to these vintage operating systems. It sounds like one more nail in XP’s coffin. If you need this mountain of storage it seems like it’s time to ditch XP already!

Read more on Slashdot