We perform data recovery from SSDs of all brands: Kingston, OCZ, Transcend, Intel, Corsair, Silicon Power, Patriot, A-Data, Crucial, Western Digital, Samsung, Apacer, etc.
SSD (Solid State Drive)– are high-speed data storage devices based on NAND Flash memory. They have volumes and speeds similar in value to HDDs, but do not have mechanical parts, which allows them to easily withstand various external physical influences, such as vibrations, shocks, falls, etc.
The structure of an SSD drive is almost identical to conventional flash drives.. It has several NAND Flash chips and a management controller. The differences are that SSDs use a faster type of memory and controllers that can work with multiple memory chips in parallel.
Prices for data recovery services from SSD drives
How we recover data from SSD
Data recovery from SSD drives consists of several stages:
The main malfunctions that occur with SSD drives: - physical damage to SSD drives. This type includes damage to interface connectors, damage to controller and memory chips, radio elements of the SSD disk board and the printed circuit board as a whole due to mechanical or electrical influences.
- logical damage to the file system of the SSD drive, erroneous deletion of information, formatting. When working with SSD drives, software glitches may occur, resulting in user data being inaccessible or damaged.
- damage in the service information area of the SSD disk, used by the controller in the operation of the translation mechanism. An SSD drive contains areas that are used by the drive for official purposes. They are not involved in storing user data, but damage to the information in them leads to a complete loss of the drive’s functionality.
You can learn more about the equipment we use for data recovery from SSD drives by clicking on
Roman is the author of articles in the magazine "Iron", periodically published on Overclockers.ru, and also works as an engineer for information recovery systems in a domestic company, whose products are used, including by the largest Western companies. Let's find out what it's like to recover data from an SSD.
Roman, as I understand it, your company directly produces software and hardware systems that help diagnose and restore information from hard drives or Flash storage systems, such as memory cards, flash drives and SSDs?
Yes, Anton, that's right. The company is called ACE Laboratory and this year it celebrated its 20th anniversary, which is a very respectable period for a Russian company. Are there many IT companies from the early 90s that continue to actively develop 20 years after their opening? I don't hear about these very often :)
Initially, ACE Lab was founded by people from the Taganrog Radio Technical Institute and people from the Rostov Research Institute of Top. In the late 80s, at this research institute, the development of Soviet hard drives was carried out. For the most part, these were Seagate clones with a capacity of 5-20 MB (the most capacious foreign models of that time barely exceeded 60 MB), but nevertheless, everything was assembled from the domestic element base, Soviet electronics were used and Soviet engineers worked. Now it is difficult to imagine that once upon a time, in our country, completely domestic components were produced not only for military needs, but also for home use, in particular, for personal computers. In the early 90s, when the collapse of state enterprises began along with the collapse of the USSR, NII TOP could not hold out for long and was soon closed. Talented engineers who knew about the principles of HDD operation found their place in the new market conditions - if there was no point in producing something, then data recovery turned out to be a very promising area of activity. After all, in the early 90s, hard drives were just gaining momentum, and were about the same rarity as SSDs are today. Therefore, by developing its equipment in parallel with the development of HDDs, the company has accumulated vast experience during this time, and today, without exaggeration, is a leader in the production of equipment for data recovery throughout the world. They just don’t talk about us very often - this business is too highly specialized, “Data Recovery” :)
Is your company concerned about the development of this promising area (solid-state memory), or is it focusing its efforts more on traditional hard drives?
In percentage terms, HDD and SSD are approximately 90% to 10%, so the emphasis on hard drives is now, of course, more than on solid-state drives. On the other hand, the gradual cannibalization of enterprises producing HDDs is also beneficial for SSDs - it becomes possible to better concentrate resources for development. For example, 10 years ago, hard drives were produced by a whole cohort of companies. These were Fujitsu, IBM, Hitachi (and later Hitachi-IBM), Samsung, Toshiba, Seagate, Western Digital, Quantum, Maxtor, etc. We had to devote equal time to all drives, and since each manufacturer had a unique drive architecture (and, as a consequence, principles for recovering data from them), it was not easy to engage in uniform development in all areas at once. Over time, there were only two main competitors left on the market, which absorbed everyone else - Seagate and Western Digital, and perhaps Hitachi, which, although it was bought by Seagate, is now still churning out cheap 2.5” drives for laptops in very small quantities. So, by focusing on two or three manufacturers, it becomes possible to devote more time to SSDs - however, everything that happened was extremely timely.
In the course of your work, you often communicate with Western clients, but how many of us now use data recovery services from SSD or Flash?
The fact is that data recovery is an expensive business. This is a very painstaking process, which by definition cannot be paid for cheaply. And if things are going well with hard drives (people often ask to restore their information), then with Flash drives everything is much more complicated. For example, the SD card of the photographer who was officiating at the wedding suddenly failed him, and all the holiday photos disappeared along with the card’s functionality. In this case, of course, both the photographer and the bride and groom are interested in restoring lost data and are willing to pay a lot of money. But if a student has a flash drive with an essay, it is unlikely that he will pay two or three thousand rubles to restore his information. Abroad, even $100-200 is not a lot of money if travel photographs or more or less significant documents are at stake. But we, people who are less wealthy, are in no hurry to restore data. There are often cases when people do not want to sacrifice an 8-gigabyte flash drive worth 500 rubles (which needs to be opened and the memory chip unsoldered for further restoration), for fear of losing the warranty and in the future, losing the opportunity to exchange it in the store for a new one, for free. This does not speak of greed, it speaks of a completely different level of income compared to the rich West. It’s the same with SSDs - data recovery from them is even more expensive, and so far, in the Russian market no one wants to spend a lot of money for recovering a solid-state drive. In addition, those who buy SSDs are aware of their fragility, which is why they do not store important data on them, using them exclusively for programs and the operating system. In the West, people are less technically savvy, so having bought a laptop with an SSD, they immediately dump important documentation, photographs, videos, and indeed everything they can onto it, and are very surprised when the SSD suddenly dies. So in the West, there are already quite a lot of clients applying for data recovery from SSDs - many times more than in Russia.
There has always been a belief among users that if a hard drive breaks down, then you can “drain information” from it without any problems, but due to the characteristics of solid-state drives, this is generally impossible to do, is this true?
Solid-state drives are relatively new - they are only a few years old (that’s how long they have been actively developing; before 2008, almost no one knew about them at all), so much less time was spent on “excavation” them. There is a lot of experience with HDDs; it is easier to recover data from them due to the perfection of both technology and software. With flash drives and SSDs, everything is different; the principle of operation, placement and storage of data is very different from HDDs, so “switching your brain” from hard drives to flash drives was quite difficult.
At first, SSDs of the first generations did not differ from ordinary flash drives in terms of writing and reading information; there were simply a few more steps, and the overall recovery was slower, requiring much more time. For example, in an SSD, all data is divided into 4 KB pieces and written to different chips on the SSD board. Therefore, access to this data is very high. Those. controller, the same file begins to read at once through 4 channels, from 4 chips, reading the 1st part from the 1st chip, the 2nd from the second, etc., doing this simultaneously (which then type RAID0 for HDD). Thanks to this parallelization, high speed is achieved along with more “smooth” wear of NAND FlASH, since writing and reading were carried out constantly in different parts of the memory chips.. But after reading data from the chips, the engineer received garbage from pieces of files - it was necessary to restore the controller transformations, repeating them in reverse order. Imagine a patchwork quilt cut into 5cm wide strips, which are then mixed together in a common box. The task is to arrange all the pieces in the correct order and re-sew the blanket - a specialist was faced with approximately the same task. It was necessary to unsolder all the microcircuits, count them, analyze
each of them, and start linking them together piece by piece to get user data. This required a huge amount of time and, naturally, the user no longer received his expensive SSD back and could not return it to the store under warranty - either the data or the warranty, because... all microcircuits were pre-soldered and read. Nevertheless, it was possible to return the data, although it was very, very difficult. However, already in the second generation of SSDs, the developers of solid-state drives brought their algorithms for recording information not just to cutting and mixing (for a more uniform use of chip cells), they decided to include encryption. Those. The controller, before recording data, first encrypted it, resulting in so-called “uniform white noise” that filled the space of the chips. This is where the problem arose - it was possible to subtract the data, but “gluing” them together without decryption turned out to be simply unrealistic. But, as it turned out, SSDs of the 2nd and 3rd generations were already able to work in technological mode, which could be activated if the firmware crashed or the firmware of the SSD controller failed. By activating this mode, it became possible to access data without first unsoldering the chips, making the recovery process faster and less complex.
If the technological mode is implemented on SSDs, then why do few manufacturers talk about it when it can help restore a damaged drive?
It's simple - none of the manufacturers wants SSD drives to be repaired by third-party companies and data to be restored. They want one thing - big sales. If a disk breaks, you buy a new one, and don’t go and repair it, like, for example, an HDD. However, since manufacturers are expanding the warranty on their SSD products, and want users to trust them more, they have to resort to tricks, so they added a techno mode not to help recover data, but to fix it themselves. Let’s say your SSD breaks two years after purchase, and the warranty on the SSD is five years. You take it to a service center where they take it away from you and give you exactly the same one in return. At the same time, your old SSD is sent to the factory, where it is put into techno mode, the firmware is flashed, tested, the case is changed and sent back to the service center so that someone else can pick it up instead of the exact same one that is broken. After all, as practice shows, in modern SSDs, it is not the memory chips that wear out - all problems are 95% related to the controller and firmware/firmware, which can simply fail or become damaged during use. But, I want to note that this is purely a guess, although I must say, it looks very plausible :)
During the development of both hardware and software systems for data recovery, your employees must understand controllers, microcircuits, and so on. This is much easier to do by collaborating with the developers themselves, for example, manufacturers of drives or controllers; do they make contacts?
99% of all controller manufacturers, including the well-known Marwell, Indilinx, SiliconMotion, Alcor Micro, Phison, Sandforce, are located in China. It is there that they are developed, produced, etc. Establishing contact is very difficult, and this is not entirely beneficial to the controller manufacturers themselves who, as I already said, want to sell as much as possible. Therefore, developers have to figure everything out themselves through trial and error. :)
Now many have a negative attitude towards the transition of NAND memory to new manufacturing processes, due to the reduction in the number of cell rewrite cycles. Do you think there is a real danger that memory will simply stop working over time in personal computers, laptops, and so on within a reasonable time frame?
The probability that the SSD will fail is 100% :) Another question is how long will it take? If, for example, the manufacturer’s warranty is 5 years, I can say with a very high probability that the SSD itself will become obsolete much faster than the warranty on it will expire or it will break. In 5 years, any computer hardware becomes seriously outdated, so the most popular ones are 2-3 years; any SSD can work quite well. As for technical processes and reducing the size of memory cells, this is where programmers come into play, bringing the recording and “alignment” algorithms to perfection (as I said above). In addition, a substantial piece of space is added for “reassigned sectors”, so that damaged cells will be instantly copied to the reserve area, providing the same safety margin.
Let's say the first generations of SSDs from 2007-2008 had a 30,000-50,000 rewrite cycle for each memory cell, after which it became unusable for recording. At the same time, due to “linear” recording, when the user constantly overwrote the first 1-5 GB (browser caching and the OS can make thousands of writes daily to the same place), only they were worn out, and the remaining 50 GB remained unclaimed. and the disk could “die” very quickly. In modern SSDs, the lifespan of one cell is much less - approximately 3000-5000 cycles, however, due to the algorithms used for recording “alignment”, encryption, and overlaying XOR patterns, rewriting each cell is as efficient as possible. Developers like to boast that on boxes with SSDs they say, “our drive will last 10 years, even if you write 20 GB of data to it every day!” This is exactly what they mean - the same cells, thanks to optimized writing algorithms, will not be used constantly, so to “kill” a modern 16 GB microcircuit, you need to write 3000 times more of its actual volume to it, i.e. . approximately 48 TB... I don’t think that in everyday life, even in a couple of years, it will be possible to record at least 100-200 GB, not to mention terabytes. Those. Even if, with the development of the 14nm technical process, the safety margin of one cell drops to 300-500 rewrite cycles, a 512 GB SSD will have to write at least two hundred terabytes for noticeable damage to the NAND chip.
The weak point of the SSD is not the memory, but the controller and firmware, which really likes to crash, blocking all access to data.
SSD analysts have a bright future; more and more companies are starting to produce solid-state drives (for example, Seagate and MSI recently “expressed” such a desire). Previously, there were also assumptions that over time NAND Flash memory or its analogues would be able to replace hard drives; this was even before the official release of mass SSD lines; tens of years were then cited as a time frame. Now they are already talking about an advantage towards SSDs in the next 3-5 years, do you think there will be one and what do drives need to do in order to overtake hard drives in production?
To deny that SSDs are the future is stupid. But making any predictions about “a significant advantage in the next two to three years” is also wrong. The fact that an increasing number of manufacturers will produce SSD drives is quite obvious, because launching a solid-state drive into production is hundreds of times easier than releasing working HDD. What is needed for an SSD to work? Buy a handful of microcircuits and a controller for them, with official factory firmware, which can be added or supplemented if desired. Those. any more or less significant company that produces computer hardware (riveting video cards and motherboards) can also produce SSDs without any particular headaches - there will be nothing new for them. It's quite another to release a competitive controller, so it's more likely
The question is how many companies will continue or start producing SSD controllers, rather than SSD drives themselves. So far, of the significant ones, there are only five of them - Sandisk, Sandforce, Samsung, Indilinx, Marwell, but it is quite possible that new players will appear who will present their vision of the “ideal controller for SSD”. Starting to develop a controller for a solid-state drive is much easier than starting to produce your own HDDs, so sooner or later the advantage will still be in the direction of solid-state drives. There will be more and more players in the NAND FLASH market, but the number of HDD manufacturers with a 99.9% probability will remain the same - Seagate and WD, there will no longer be a third.
But so far, I don’t see any fundamental changes in the PC market; the main advantages of HDDs are still greater reliability (the probability of sudden death is less than that of SSDs), low price, and huge volumes. Yes, in the mobile sector, FLASH has long replaced the 1.8” HDD, completely occupying the entire market, but as for PCs, I don’t yet see any global improvements compared to 2008. Solid-state drives are still expensive, and the maximum capacity is limited to 256-512 GB (this is already the last line of reasonable cost, then there are simply stunning prices), so even cheaper memory does not provide significant accessibility. It would seem that the winner is obvious - HDDs continue to dominate the PC sector (that’s what we’re talking about, it’s the main one for us, we don’t take mobile into account), but in reality there is no competition as such. A friendship is literally now being established between SSD and HDD, since together, from each other, they will take much more advantages than alone. In the near future, we will most likely see the following development of the situation: the average user will have two drives installed in their PC - one SSD, small in size and at an affordable price (128-160 GB for ~$80-100) for programs, games and operating systems, and a spacious HDD with a capacity of 2-4 TB, for storing FullHD movies, music, documents, game images, etc.
But, again, this is all only if prices for Internet access do not go down and people do not massively use services for online viewing of HD Video, music, etc. In this case, there will be no point in having an HDD - for games and installed programs, a 256 GB SSD will be enough, and everything else can be stored on “cloud servers”, which are gaining popularity. But this is not a matter of the near future, most likely such a picture will be by 2018-2020, but for now, SSD and HDD will live in close cooperation with each other.
But this is just my vision of the situation, there are too many conditions for any unambiguous conclusion :)
Thank you for your answers and I wish you further success in your difficult endeavor :)
More and more users are purchasing SSD drives for installation in PCs. They are used in parallel with HDD or instead of them. Most often, the operating system is installed on an SSD disk, and files are stored on the HDD. It is with this placement that you can experience a multiple increase in the speed and performance of your computer.
Solid state drives have many advantages over hard drives. Therefore, you need to know how to choose the right SSD drive for your computer.
What does it represent?
A hard drive (HDD) is the device in your computer that stores all the data (programs, movies, images, music... the operating system itself, Windows, Mac OS, Linux, etc.) and it looks like this...
Information on a hard drive is written (and read) by reversing the magnetization of cells on magnetic plates that rotate at wild speed. Above the plates (and between them) a special carriage with a reading head rushes like a frightened one.
Since the HDD drive is in constant rotation, it operates with a certain noise (humming, crackling), this is especially noticeable when copying large files and launching programs and the system, when the hard drive experiences maximum load. In addition, this is a very “thin” device and is afraid of even a simple wobble during its operation, not to mention falling to the floor, for example (the reading heads will meet the rotating disks, which will lead to the loss of information stored on the disk).
Now let's look at a solid state drive (SSD). This is the same device for storing information, but based not on rotating magnetic disks, but on memory chips, as mentioned above. The device is similar to a large flash drive.
Nothing rotating, moving or buzzing - the SSD drive is absolutely silent! Plus - just crazy speed of writing and reading data!
Advantages and disadvantages
Advantages:
- high speed of reading and writing data and performance;
- low heat generation and electricity consumption;
- no noise due to the absence of moving parts;
- small dimensions;
- high resistance to mechanical damage (overload up to 1500g), magnetic fields, temperature changes;
- stability of data reading time regardless of memory fragmentation.
Flaws:
- limited number of rewrite cycles (1,000 – 100,000 times);
- high price;
- vulnerability to electrical damage;
- the risk of complete loss of information without the possibility of its recovery.
And now in more detail:
Advantages of an SSD drive
1. Speed
This is the most important advantage of SSD drives! After replacing the old hard drive with a flash drive, the computer gains multiple acceleration due to the high speed of transferred data.
Before the advent of SSD drives, the slowest device in a computer was the hard drive. It, with its ancient technology from the last century, incredibly slowed down the enthusiasm of a fast processor and fast RAM.
2. Noise level=0 dB
It makes sense - there are no moving parts. In addition, these drives do not heat up during operation, so cooling coolers turn on less often and do not work as intensely (creating noise).
3. Shock and vibration resistance
This is confirmed by numerous videos with tests of these devices - a connected and working SSD drive was shaken, dropped on the floor, knocked on... and it continued to work quietly! If you purchase an SSD drive for yourself, and not for testing, we advise you not to repeat these experiments, but limit yourself to watching videos on Youtube.
4. Light weight
Not an outstanding factor, of course, but still - hard drives are heavier than their modern competitors.
5. Low power consumption
I'll do without the numbers - the battery life of my old laptop has increased by more than one hour.
Disadvantages of an SSD drive
1. High cost
This is at the same time the most limiting drawback for users, but also very temporary - prices for such drives are constantly and rapidly falling.
2. Limited number of rewrite cycles
A regular, average SSD drive based on flash memory with MLC technology is capable of producing approximately 10,000 read/write cycles of information. But the more expensive type of SLC memory can already last 10 times longer (100,000 rewrite cycles).
In both cases, the flash drive can easily last at least 3 years! This is just the average life cycle of a home computer, after which the configuration is updated and components are replaced with more modern ones.
Progress does not stand still and tadpoles from manufacturing companies have already come up with new technologies that significantly increase the lifespan of SSD drives. For example, RAM SSD or FRAM technology, where the resource, although limited, is practically unattainable in real life (up to 40 years in continuous read/write mode).
3. Impossibility of recovering deleted information
Deleted information from an SSD drive cannot be recovered by any special utility. There are simply no such programs.
If during a large voltage surge in a regular hard drive, in 80% of cases only the controller burns out, then in SSD drives this controller is located on the board itself, along with the memory chips, and the entire drive burns out - hello to the family photo album.
This danger is practically reduced to zero in laptops and when using an uninterruptible power supply.
Main characteristics
If you are buying an SSD to install on your computer, pay attention to its main characteristics.
Volume
When purchasing an SSD drive, first of all, pay attention to the volume and purpose of use. If you are purchasing it just to install the OS, choose a device with at least 60GB of memory.
Modern gamers prefer to install games on SSDs to increase performance. If you are one of them, then you need an option with a memory capacity of 120 GB.
If you are purchasing a solid state drive instead of a hard drive, base it on how much information is stored on the computer. But in this case, the capacity of the SSD disk should not be less than 250 GB.
Important! The cost of a solid-state drive directly depends on the volume. Therefore, if your budget is limited, use an SSD to install the operating system and a HDD to store data.
Form factor
Most modern SSD drive models are sold in a 2.5-inch form factor and are built into a protective box. Because of this, they are similar to classic hard drives of the same size.
Good to know! To install a 2.5-inch SSD drive into a standard 3.5-inch mount inside a PC case, special adapters are used. Some case models provide sockets for a 2.5-inch form factor.
There are 1.8-inch and smaller SSDs on the market that are used in compact devices.
Connection interface
Solid state drives have several connection interface options:
- SATA II;
- SATA III;
- PCIe;
- mSATA;
- PCIe + M.2.
The most common option is to connect using a SATA connector. There are still SATA II models on the market. They are no longer relevant, but even if you purchase such a device, thanks to the backward compatibility of the SATA interface, it will work with a motherboard that supports SATA III.
When using an SSD with a PCIe interface, you may need to install drivers, but the data transfer speed will be higher compared to a SATA connection. But there are not always drivers for Mac OS, Linux and the like - you should pay attention to this when choosing.
mSATA models are used on compact devices, but work on the same principle as the standard SATA interface.
M.2 or NGFF (Next Generation Form Factor) models are a continuation of the development of the mSATA line. They have smaller dimensions and greater flexibility for configuration by digital equipment manufacturers.
Read/write speed
The higher this value, the more productive the computer. Average speeds:
- reading 450-550 MB/s;
- recording 350-550 Mb/s.
Manufacturers may indicate the maximum read/write speed rather than the actual one. To find out the real numbers, look online for reviews of the model you are interested in.
In addition, pay attention to the access time. This is the time during which the disk finds the information required by the program or OS. The standard indicator is 10-19 ms. But because SSDs have no moving parts, they are significantly faster than HDDs.
Memory type and runtime to failure
There are several types of memory cells used in SSD drives:
- MLC (Multi Level Cell);
- SLC (Single Level Cell);
- TLC (Three Level Cell);
- 3D V-NAND.
MLC is the most common type, which allows you to store two bits of information in one cell. It has a relatively short resource of rewrite cycles (3,000 - 5,000), but lower cost, due to which this type of cells is used for mass production of solid-state drives.
The SLC type stores only one bit of data per cell. These microcircuits are characterized by a long lifetime (up to 100,000 rewrite cycles), high data transfer rates, and minimal access time. But due to the high cost and small data storage volumes, they are used for server and industrial solutions.
The TLC type stores three bits of data. The main advantage is low production cost. Among the disadvantages: the number of rewrite cycles is 1,000 - 5,000 repetitions, and the read/write speed is significantly lower than the first two types of chips.
Healthy! Recently, manufacturers have managed to increase the lifetime of TLC discs to 3,000 rewrite cycles.
3D V-NAND models use 32-layer flash memory instead of standard MLC or TLC chips. The microchip has a three-dimensional structure, due to which the volume of recorded data per unit area is much higher. At the same time, the reliability of information storage increases by 2-10 times.
IOPS indicator
An important factor is IOPS (the number of input/output operations per second), the higher this indicator, the faster the drive will work with a larger volume of files.
Memory chip
Memory chips are divided into two main types MLC and SLC. The cost of SLC chips is much higher and the service life is on average 10 times longer than that of MLC memory chips, but with proper operation, the service life of drives based on MLC memory chips is at least 3 years.
Controller
This is the most important part of SSD drives. The controller controls the operation of the entire drive, distributes data, monitors the wear of memory cells and evenly distributes the load. I recommend giving preference to time-tested and well-proven controllers from SandForce, Intel, Indilinx, and Marvell.
SSD memory capacity
It would be most practical to use an SSD only for hosting the operating system, and it is better to store all data (movies, music, etc.) on a second hard drive. With this option, it is enough to buy a disk with a size of ~ 60 GB. This way you can save a lot and get the same acceleration of your computer (in addition, the service life of the drive will increase).
Again, I’ll give an example of my solution - special containers for hard drives are sold online (very inexpensively), which can be inserted into a laptop in 2 minutes instead of an optical CD drive (which I’ve used a couple of times over four years). Here's a great solution for you - an old disk in place of a floppy drive, and a brand new SSD in place of a standard hard drive. It couldn't have been better.
And finally, a couple of interesting facts:
Why is a hard drive often called a hard drive? Back in the early 1960s, IBM released one of the first hard drives and the number of this development was 30 - 30, which coincided with the designation of the popular Winchester rifled weapon (Winchester), so this slang name stuck to all hard drives.
Why exactly hard disk? The main elements of these devices are several round aluminum or non-crystalline glassy plates. Unlike floppy disks (floppy disks), they cannot be bent, so they are called hard disks.
TRIM function
The most important additional feature for an SSD is TRIM (garbage collection). It is as follows.
Information on the SSD is first written to free cells. If the disk writes data to a cell that was previously used, it first clears it (unlike an HDD, where data is written over existing information). If the model does not support TRIM, it clears the cell just before writing new information, causing the operation to slow down.
If the SSD supports TRIM, it receives a command from the OS to delete data in the cell and clears it not before overwriting, but during the “idle” of the disk. This is done in the background. This maintains the write speed at the level specified by the manufacturer.
Important! The TRIM function must be supported by the operating system.
Hidden area
This area is not accessible to the user and is used to replace failed cells. In high-quality solid-state drives it is up to 30% of the device volume. But some manufacturers, in order to reduce the cost of an SSD drive, reduce it to 10%, thereby increasing the amount of storage available to the user.
The flip side of this trick is that the hidden region is used by the TRIM function. If its volume is small, it will not be enough for background data transfer, which is why when the SSD “load” level is 80-90%, the writing speed will drop sharply.
Bus capacity
So, when choosing a flash drive, the speed of reading and writing data is also of paramount importance. The higher this speed, the better. But you should also remember about the bus bandwidth of your computer, or rather, the motherboard.
If your laptop or desktop computer is very old, there is no point in buying an expensive and fast SSD drive. He simply will not be able to work even at half his capacity.
To make it clearer, I will outline the throughput of various buses (data transfer interface):
IDE (PATA) - 1000 Mbit/s. This is a very ancient interface for connecting devices to the motherboard. To connect an SSD drive to such a bus, you need a special adapter. The point of using the described disks in this case is absolutely zero.
SATA - 1,500 Mbit/s. It's more fun, but not too much.
SATA2 - 3,000 Mbit/s. The most common tire at the moment. With such a bus, for example, my drive operates at half its capacity. He needs...
SATA3 - 6,000 Mbit/s. This is a completely different matter! This is where the SSD drive will show itself in all its glory.
So, before purchasing, find out what bus you have on your motherboard, as well as which bus the drive itself supports, and decide on the feasibility of the purchase.
Here, for example, is how I chose (and what guided) my HyperX 3K 120 GB. Read speed is 555 MB/s, and data write speed is 510 MB/s. This drive now works in my laptop at exactly half its capacity (SATA2), but exactly twice as fast as a standard hard drive.
Over time, it will migrate to children's gaming computers, which have SATA3, and there they will demonstrate all their power and speed without limiting factors (outdated, slow data transfer interfaces).
We conclude: if you have a SATA2 bus in your computer and do not plan to use the disk in another (more powerful and modern) computer, buy a disk with a bandwidth of no higher than 300 MB/s, which will be significantly cheaper and at the same time twice as fast as yours current hard drive.
Solid State Drives (SSDs) are gaining more and more user recognition in the modern world of technology. This is not surprising because SSDs have a number of undeniable advantages over conventional HDDs, which are losing ground. The main advantages of the new media are high access speed: reading and writing, no moving parts, low energy consumption, complete absence of noise during operation, compact dimensions.
However, even such perfect devices, as practice shows, can fail. Data recovery from SSDs in our center has been mastered and successfully used for several years, so we are always ready to help our clients in this matter.
Price list for data recovery from SSD media in the “Data-911” service
The average owner-user may initially think that the recovery of SSD drives is similar in its approaches to the technology for resuscitating flash drives. In fact, these solid-state drives are similar to “flash drives”, but their operating principle is different; SSDs are more complex in their structure and operation, and this significantly affects the duration and stages of the information recovery process.
The higher complexity of the SSD construction circuit layout can lead to failures specific to this type of drive, leading to data loss:
- micro-memory blocks in solid-state drives have a limited resource of read/write cycles, this should be taken into account to avoid information loss
- high dependence on stable operation of the electrical network: even imperceptible power surges can damage the SSD disk controller
- mechanical damage: although SSD drives are more resistant to falls and other physical impacts, no one can guarantee that this will not lead to data loss
- there is a high probability of logical failures in SSD memory chips, which leads to data being “absorbed” across all memory blocks. This increases the difficulty of recovery many times over.
What do you need to know about the process of recovering data from SSD drives?
Building a process for recovering information from solid-state SSD drives requires a highly qualified approach and step-by-step execution:
Two interesting research articles from different parts of the planet, published on the Internet almost immediately after each other, provide a significantly new look at the forensic aspects of the operation of SSDs, or solid-state storage devices, often referred to as flash drives.
The internal workings of SSDs are so different from traditional magnetic hard drives that forensic scientists can no longer rely on current data storage technologies in situations where evidence from SSD-type media appears in legal proceedings.
On the other hand, fragments of data stored in the memory of flash drives can be practically indestructible.
Cannot be restored
This is roughly the essence of the warning in the results of a research article by scientists from the Australian Murdoch University (“Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Discovery” by Graeme B. Bell and Richard Boddington, PDF).
The study was based on a large series of experiments comparing the nuances of data storage in the studied samples: a Corsair 64GB SSD flash drive and a traditional Hitachi 80GB magnetic disk. During a comparative analysis, researchers identified a whole bunch of problems with data recovery in SSDs. Problems that are completely unusual for magnetic disks and are caused by cleaning or “garbage collection” algorithms used to maintain flash drives at maximum performance levels.
Under the influence of these algorithms, investigatively important data stored on modern SSDs often become the object of a process known among criminologists as “self-corrosion.” The result of this process is that the evidence on the SSD is continuously erased or contaminated with extraneous data - in a way that is completely unusual for hard drive-based media. And, what is fundamentally important, all these changes in information occur in the absence of any commands from the user or the computer.
The results of Australian researchers inevitably raise doubts about the integrity and reliability of those files that are isolated using forensic methods and retrieved from storage devices. One could even say that there is a clear threat of the end of that “golden age” in the collection of digital evidence, which was provided by the peculiarities of data storage on magnetic media.
Over the past several decades, investigators have worked with magnetic tapes, floppy drives and hard drives, which continued to store enormous amounts of information after the files that contained it were marked as destroyed by the system. Even the secure wiping procedure, as experts know, is not always sufficient to completely destroy information on a magnetic medium. However, SSD solid-state drives store data much differently - in the form of blocks or pages of transistor NAND logic chips that must be electronically erased before they can be reused.
The result of the industry's work to improve the efficiency of SSD memory is that most modern flash drives have programs built into the firmware that regularly and automatically perform “self-cleaning” or “garbage collection” procedures. As a result of these sanitary procedures, there is a constant overwriting, modification and transfer of those files that are marked by the system as destroyed. Moreover, this process begins without any notification and very quickly, almost immediately after power is supplied to the chip. No commands are required from the user, and the flash drive does not emit any sound or light to inform the user that the cleaning procedure has begun.
When testing a particular sample, after it was quickly formatted, the researchers expected the wipe utility to start working in about 30-60 minutes, figuring that this process must occur with the SSD before new data begins to be written to blocks, before busy with files. To their surprise, the wipe occurred just three minutes later, leaving just 1,064 evidence files out of a total of 316,666 available for recovery from disk.
Deciding to follow this process further, the scientists removed the flash drive from the computer and connected it to a write blocker - a hardware device specifically designed to isolate it from all procedures that could change the contents of the media. But even here, just 20 minutes after connection, almost 19 percent of all files were erased due to internal processes initiated by the firmware of the SSD itself without any external commands. For comparison, on an equivalent magnetic hard drive, all data after a similar formatting remained recoverable regardless of the passage of time - as the researchers expected.
It is clear that for forensic scientists concerned about the safety of all data on the media, this feature of the SSD poses a big problem. As one of the co-authors, Graham Bell, writes in a commentary on their paper, “a few people in the computer forensics community had an idea that some funny things were happening to the data in the SSD, but almost everyone we showed our results to was shocked the scale of what was discovered."
If “garbage collection” in an SSD occurs before or during a forensic imaging procedure, this leads to the irreversible destruction of potentially large amounts of valuable data. That data that would normally be obtained as evidence during the investigative process, which is where the new term “corrosion of evidence” was born.
There is no doubt that the discoveries of Australian experts will inevitably have serious consequences for those criminal and civil court cases that rely on digital evidence. If the disk from which the evidence was obtained shows signs that changes have occurred to the data after the device was seized from the owner, then the opposing party has grounds to demand that this evidence be excluded from judicial consideration.
The authors of the article also warn that as the capacity of USB flash drives grows, manufacturers may begin to build similar cleaning technologies into them, creating the same problem for an array of secondary (external) storage media. In addition, Bell and Boddington suggest that garbage collection utilities will become more aggressive over time as manufacturers introduce more and more powerful firmware, chipsets and larger drives.
In the final conclusion of the article, which contains 18 problem points, the researchers do not propose any treatment methods, believing that there is no simple and effective solution to this problem.
Can't erase
If we talk about another American research article, also devoted to the specific features of data storage in SSDs, then at first glance its results seem to clearly conflict with those obtained by the Australians. Here, a team of researchers came to a completely different discovery: fragments of data stored in the memory of flash drives may be practically indestructible.
As the authors of this article demonstrate, flash drives are very difficult to clean of compromise-sensitive data using traditional methods of securely wiping files and drives. Even in cases where SSD devices indicate that files have been destroyed, up to 75 percent of the data they contained may still reside in the flash drive's memory. In particular, in some cases where solid-state drives report files as being “securely erased,” in fact duplicates of them remain largely intact in secondary locations.
These, in a nutshell, are the conclusions of a study conducted at the University of California San Diego and presented in late February at the Usenix FAST 11 conference (“Reliably Erasing Data From Flash-Based Solid State Drives” by Michael Wei, Laura Grupp, Frederick Spada, Steven Swanson . PDF).
Problems with reliable overwriting of data on an SSD, as the authors of the work write, occur due to a radically different internal design of the media. Traditional ATA and SCSI drives use magnetizable materials to write information to a specific physical location known as an LBA, or logic block address. SSD drives, on the other hand, use chips for digital storage that use FTL, or “flash translation layer,” to manage content. When data in such storage media is modified, FTL often writes new files to different locations, simultaneously updating the memory map to reflect the changes made. The result of such manipulations is that remnants of previous files, which the authors call “digital remains,” continue to be stored on disk in the form of uncontrolled duplicates.
As the authors write, “These differences in processing between magnetic disks and SSDs potentially lead to dangerous discrepancies between user expectations and the actual behavior of the flash drive... The owner of such a device may apply standard hard drive cleaning tools to the SSD, mistakenly believing that the result is that the data is on disk will be irreversibly destroyed. In fact, this data can remain on the disk and only requires a few more complex operations to recover it.”
In terms of specific numbers, the researchers found that about 67 percent of the data stored in the file remained on the disk even after it was destroyed in the SSD using the “secure erase” feature found in Apple Mac OS X. Others Safe (overwrite) erase utilities under other operating systems showed approximately similar results. For example, after destroying individual files with the Pseudorandom Data program, up to 75 percent of the data could remain on the SSD, and when using the British government cleaning technology British HMG IS5, up to 58 percent remained.
As the article warns, these results suggest that in the SSD situation, overwriting data is not effective, and standard manufacturer-provided erasing procedures may not work as expected.
According to researchers, the most effective way to securely delete data on an SSD is to use devices that encrypt their contents. Here, Wiping involves destroying the encryption keys in a special section called the “key vault,” essentially ensuring that the data remains encrypted on the disk forever.
But here, of course, another problem lurks. As the authors of the article write, “the danger lies in the fact that the protection relies on the correct operation of the controller, which clears the internal storage compartment containing the cryptokey and any other values derived from it that may be useful in cryptanalysis. Given the implementation errors we've found in some variants of secure erase utilities, it would be unreasonably optimistic to assume that SSD vendors will properly wipe the keystore. Worse, there is no way (for example, by disassembling the device) to verify that the erasure actually occurred.”
The researchers obtained their results by writing different files with clearly identifiable data structures to SSD drives. Then a special device based on FPGA (chips with reprogrammable logic) was used to quickly search and identify the remaining “fingerprints” of these files after applying secure erase procedures. The researchers' special device costs about a thousand dollars, but "a simpler version of the device based on a microcontroller would cost about $200 and would require only modest technical experience to design it."
There is no contradiction
As the combined summary of these two articles on the Slashdot discussion forum put it, “Either SSDs are really hard to wipe, or they're really really hard to recover deleted files from. It turns out to be some kind of confusing story."
One of the direct participants in the first (Australian) study, Graham Bell, explains this apparent paradox as follows.
Previously, data on disks was traditionally cleared manually, that is, by explicitly giving a command to the computer to tell the drive to write something else over the previous data. If such a rewrite command was not received, then the data continued to be stored in magnetic media. However, if you try to apply the same trick to an SSD, it may not work. The logical memory address you're trying to overwrite may have already been reallocated on the fly, so your "overwrite" command goes to some other physical memory location than the one that previously held the data. From a logical point of view, it all looks like the overwrite has worked: you will no longer be able to access this data through your computer's OS. However, from the point of view of the flash drive itself, this data is still there, hidden in some physical cell that is not currently in use, if we mean the corresponding logical sector. However, some clever firmware or a cunning hacker with a soldering iron can, in principle, get to this data.
At the same time, apart from these features, modern SSD media use various specific tricks in order to automatically increase their performance. One of these tricks is to pre-overwrite memory cells that contain data that is no longer taken into account by the file system. In this case, the drive itself actively tries to continuously clear everything it can from the disk. Moreover, it does all this solely on its own initiative - simply for the sake of speeding up future write operations, providing a pre-prepared pool of available and not used cells.
To summarize these features of SSD, we can state the following. If your computer tells the flash drive to reset some data, then the drive may lie to you and in reality the reset may or may not happen. If the drive itself wants to overwrite something (and it actually does this without any warning), then this data will be destroyed...
Another commentator, clearly not without a sense of humor, described such a complicated situation with the following words:
“Why do you call it confusion? Everything here is transparent and understandable. If you want to recover deleted data, then you cannot do this. If you want to destroy them, then you cannot do that either. This is Murphy’s Law for storing data on SSDs.”
