Staying on Top of Technology

OCZ Z-Drive 4500 PCIe SSD Recovery

An important part of data recovery is staying ahead of new technology. It’s important that we are able to recover data from wherever people currently store their files. People once stored their most valuable data on a hard drive in their PC. Making hard drives is complicated and expensive, so only a handful of manufacturers had the resources to build them. The relatively small number of brands allowed us to became experts in the way those disks work & fail. Over time, some of those manufacturers merged or went bust. There are now just a few factories building disks. That’s not to say hard drive technology is standing still, it’s just a small enough target to keep an eye on. When Seagate release a new family of disks we scrabble around for a little while, and then ultimately find out how they work.

Enter the SSD

Solid State Drives have been on the horizon for a long time now. In fact, the three Macs within arms reach of me right now all have SSDs in them. The biggest problem for me, is that the barrier to entry to make SSDs is really low. There are thousands of factories in China alone with the capability to pump out millions of SSDs. Just buy some controllers and NAND chips, solder them to a circuit board — Instant SSD.

MacBook Pro SSD

The Numbers

In 2018 there are only three hard drive manufacturers left. By comparison there are 35 SSD manufacturers listed — without including all the white-label, rebadged, refurbished, grey-market & clone drives in the market. If we estimate that each manufacturer produces three different product lines, you’ll get to 105 different types of SSD vs nine hard drive families. In fairness, I can think off the top of my head that some of these hard drive brands have more than three families of disk, but you get the idea. Staying on top of all those brands quickly goes from difficult to impossible.

The Future of Data Recovery

You’ve got to wonder if the future of data recovery will be choosing even smaller niches. Some companies may focus on recovering just one or two brands of SSD, and know that they at least have a chance of staying up to date with the latest technology.

Dead Ends

SSDs present a number of new obstacles to data recovery. Some of these are not challenges as much as actual show-stopping dead ends.

Does your SSD controller use encryption, wear levelling & compression? The answer is yes for most SSDs. What happens to the data if that controller fails? In some cases this means the data is gone for good. In other cases it could mean weeks or months of manual work. You can’t just solder on a replacement controller as it won’t have the necessary encryption keys, nor will it have any idea of where the data has been stored across the multiple NAND chips.

 

(Possible?) World’s First Apple SSD Recovery

MacBook Escape Header

Apple’s PCIe SSDs have always proven challenging for data recovery. We have a good success rate with them, however many of our tools don’t even support working at PCI level. This particular SSD provided a new challenge though.

The Device

Manufacturer: Samsung
Model: MZ-JPV5120/0A4
Controller: S4LN058A01-8030
Capacity: 512GB
Interface: PCIe
Date: 2015.11

MacBook Pro SSD

The Problem

The SSD we received was initially showing up correctly in the system. Upon access, the disk would read a few bytes and then stop reading. The SSD would remain visible to the system but not respond to any further commands. The only way to bring it back was to cycle power. Yep, the IT classic — Turn it off and on again! The problem is, PCI cards don’t come with on-off switches so the solution needed to work within software.

Brainstorming

First I thought a copy task with a scheduled reboot may get the device back online, however I quickly found out PCI slots stay powered on during a reboot 🤦‍♀️ This means once the device gets stuck, a reboot won’t bring it back on.

My second idea was to schedule shutdowns but the time taken to boot and then restart the copy process seemed like a nightmare.

The Solution

In the end I found a series of commands which could keep a fairly steady copy process going. The main idea was:

  • Start a copy task
  • Pause on error
  • Toggle the PCI connection using low-level commands
  • Resume the copy task
  • Rinse & repeat

Although not the most elegant solution, this process cycled through 647 times, taking an average of 760MB per cycle. In less than 24 hours the whole 512GB device was cloned to another disk ready for recovery.

After this script finished I did find a slightly cleaner way to reset the PCI slot which will result in much faster recoveries in the future.

I was unable to find any mention of this type of recovery online, so if anyone else knows about it, they’re keeping it to themselves. If you know anyone with a failed Mac SSD, get in touch. This is just one of the many solutions we have for recovering them.

Contact Us Now...

For a fast reply from a real person.

Fusion Drive Data Recovery

Fusion Drive Data Recovery

Urgent Warning: Fusion Drive always consists of two separate disks. If you want your data back you must get both parts. We’ve heard a number of reports that users with failed Fusion Drives are only given the Hard Disk back when receiving Apple repairs. On its own, the hard drive is not enough to recover all data in original condition. This is especially true if FileVault encryption is used.

HDD + SSD = Fusion Drive
HDD + SSD = Fusion Drive.

What is Fusion Drive?

Fusion Drive is Apple’s version of a hybrid solid state & mechanical disk. It combines a small fast SSD with a large slow hard drive to achieve a balance between cost & performance. Frequently used files are moved to the SSD, and old stale data is sent to the slow hard drive. This is all taken care of automatically behind the scenes. Unless you dig into the terminal, you wouldn’t even know you had two separate disks inside the Mac. Fusion Drive is  part of Apple’s Core Storage system. It is somewhat similar to Linux LVM as a volume management system.

What Fusion Drive is not

Fusion Drive does not use the SSD as a cache for files but actually moves data from one disk to the other. This is important, as both disks are required for full recovery.

Why does Fusion Drive exist?

At launch, and even now, the cost for large capacity SSDs is way higher than the cost of an equivalent hard drive. The problem is that SSDs offer huge benefits to the user experience. When you use an SSD, you hardly ever have to wait for things to load. The computer boots up within seconds.

Hybrid drives aim to bridge the gap between solid state and mechanical disks. An iMac with a 3TB Fusion Drive comes with some of the benefits of SSDs, but much less cost. As the cost of SSDs fall, the need for Fusion Drive will eventually disappear. Apple has shown with their current lineup that they’d much rather go all-SSD where possible. Current iMac Pro & MacBook Pro both use 100% SSD internal storage.

Anecdote Corner

We’ve had two recent cases where a user has brought a “Fusion Drive” to us for recovery, but actually only had the hard drive part. Apple had given the damaged hard drive back after replacement, but reused the SSD when creating a new Fusion Drive. This user only had a few GB of data so the Hard Drive hadn’t even been used yet. All the data was stored on the SSD which was now overwritten.

The majority of Fusion Drives we’ve seen have a Seagate ST3000DM001 3TB hard drive combined with a 128GB blade SSD.

If you need help with a Fusion Drive:

Contact Us Now...

For a fast reply from a real person.

OCZ Z-Drive 4500 PCIe SSD Recovery

OCZ Z-Drive 4500 PCIe SSD Recovery

I published a post back in 2016 highlighting the problem we were seeing with Sandforce controllers on single SSD drives. We have now also come across this PCIe 3.2TB SSD that uses a Marvel controller as well as Sandforce controllers to control banks of data chips. Like the others, this device has I/O errors which we believe is caused by the Sandforce controllers. This PCIe SSD device requires proprietary drivers for it to be recognised in the bios and OS, regardless of what platform it is run on. Although we can communicate with the device via an SSD Utility provided by Toshiba, there is no access to the user data.

OCZ Z-Drive 4500 PCIe SSD
OCZ Z-Drive 4500 PCIe SSD

If you’ve got a problem with an OCZ SSD:

Contact Us Now...

For a fast reply from a real person.

SandForce SSD Data Recovery Problems

MacBook Pro SSD

The low prices and high speed access of the Sandforce controller made it an appealing option for SSD manufacturers such as Toshiba, Intel, Kingston & OCX. But it soon became a problem for users when the SSD devices using these controllers started to fail in their computers after just six months of use. Usually it resulted in the device not being recognised by the computer bios, and not functioning at all.

That was okay if you were happy to have it replaced under warranty by the manufacturer. The problem came when you wished to try and recover critical data that may have been stored on these SSD’s. The use of full hardware encryption on the controller and the device, meant that the data could not be recovered, even when using low level data chip removal.

Fortunately today these controllers are not so popular, and as a result most mainstream manufacturers do not use them. But be aware that they can still be found in some non branded SSD’s.

This drive has a hardware problem that can’t be repaired

This drive has a hardware problem that can’t be repaired.
Back up as much of the data as possible and replace the disk. See an authorised Apple dealer for more information.
S.M.A.R.T. Status : Failing

If you see the message above, your hard disk or SSD has started to fail and has reported faults to the Mac. If caught early enough, these disks can usually be recovered. You can try to copy important data to another disk but if the copy process gets stuck for a while, it’s safer to stop. If you leave a failing disk in that state it can deteriorate until the disk is ruined.

If the data is really important, and you’d rather not take the risk, you could have a look at our Mac Data Recovery Services. We have been dealing with these sorts of problems for years and have a developed a really safe way to get the data off in good condition.

This drive has a hardware problem that can't be repaired

Whatever you decide to do, don’t ignore this message. The broken disk cannot repair itself, and will only get worse. In many cases, the disk won’t even be readable by the time you see this warning.

It doesn’t matter if the disk is still inside your iMac or MacBook, we can remove it for you, and even replace the drive at the end of the recovery process if you want. Ask about our Mac Setup service if you are interested.

Contact Us Now...

For a fast reply from a real person.

SSD Data Recovery

SSD Data Recovery
SSD Data Recovery

SSDs (Solid State Drives) may one day become the standard form of storage in computers. Apple laptops are already heading that way. There are certainly many advantages when comparing SSDs to HDDs (Hard Disk Drives), however they do bring their own problems, which are often not well reported. We don’t care how good SSDs can be. We care about how they fail. It’s common to hear things like: “I’m replacing my hard drive with an SSD so I won’t have to worry about it crashing again.” While this is technically true – there are no moving parts to crash – there are plenty of other ways an SSD can fail. Whether it’s technically crashed or not doesn’t matter at all when you can’t access your files. It’s a shame but an SSD does not get you out of the boring task of running regular backups.

There are some pros and cons which specifically affect data recovery from SSDs. I haven’t listed things like battery life or read / write speed as they are not relevant when it comes to recovering data from them.

SSD Data Recovery Pros:

  • Shock resistance. No moving parts to crash.
  • Just as susceptible to filesystem issues, deletion, reformatting, bad sectors etc which can be recovered using existing equipment.

SSD Cons:

  • False sense of security. The word reliable comes up a lot in SSD marketing with phrases like “More reliable, faster, and more durable than traditional magnetic hard drives.” Maybe research exists that shows SSDs are less prone to failure but it doesn’t seem to be the case at the moment. Anything that holds your valuable data runs the risk of getting drenched, getting stolen, getting lost, and that’s before we even take general failures into account.
  • Susceptible to electronic failure, Maybe more so than a hard drive as the storage and electronics are combined in SSDs. Some of the most common hard drive failures are caused by errors in the firmware which controls the performance of the drive. SSDs have very complex firmware, which opens the possibility of firmware corruption. In most cases firmware corruption will block access to your data.
  • Encryption. Most modern SSDs encrypt the data at a hardware level, which makes it impossible to remove data chips and extract data from them externally (you can do it, but the data is encrypted). The keys to the encryption are often stored within the controller chip, so if that fails, you could be locked out of your data for good. Modern encryption works well. You can’t get round it.
  • Wear-levelling algorithms. Which move the data around the SSDs to improve performance, can make recovery difficult as these algorithms would need to be taken into account when accessing a failed SSD. They don’t store data in logical order like hard drives do.

Recovering Deleted Data

In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

Recovering Deleted Data

The Filing Cabinet

The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

Overwritten / Deleted Data

We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

The Problem With SSDs

Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

Specifics

In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

The Important Bit

If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

Bigger Hard Drives of the Future

The Register has today posted two articles about the ongoing battle to expand hard drive capacities.

First is an actual device for sale, a 2TB Western Digital portable drive. This drive has a fancy new case and USB3 connection. It contains backup software and also the option to encrypt the data with a password. I wonder if it encrypts the data by default like some of their previous portables. (A bad thing!)

Second is a futuristic announcement from Seagate about their new HAMR technology. This new tech uses a laser to heat part of the disk before magnetising it. This apparently allows for much higher densities, theoretically paving the way for 60TB hard drives. There doesn’t appear to be any products using this technology at the moment.

60TB drives will be fantastic for backups, but horrible to backup without a new, faster form of connection. These would take almost forever (exaggeration) to fill up by SATA.

This news helps prove that hard drives are far from dead. It will take a long time until SSDs can cope with such massive capacities, at a similar cost to these beasts.