[Case Study] Computer Forensics: Doctor SalvationDATA Teach you How to Repair Corrupted SSD (Solid-State Drive)

Editor’s Note: In this case study, forensic experts from SalvationDATA will introduce the way how to repair a solid-state drive (SSD) malfunction on the process of investigation, for the reason that lots of investigators from all around the world have asked for help about the corrupted SSD repairing many times.

First of all, let us have a brief understanding of the SSD malfunction type

Totally we divide the SSD malfunction into two major categories: Physical malfunction and Firmware malfunction, what’s the detailed description of these two major categories, please follow the information below:

Physical malfunction: Interface damage, Circuit damage, Abnormal heating, Circuit board distortion, Circuit faults and unusually high temperatures for chipsets.

Firmware malfunction: Bad blocks, read errors, missing modules, bad logic, and validation errors.

 

The main way of SSD malfunction repairing: firmware repair, chip data reorganization, interface conversion, physical replacement.

Different repair way directed against different malfunctions, now we will see the steps of how to repair different SSD malfunctions.

1.  For SSD that cannot be handled by firmware repair and replacement:

• Before taking the chip to read the first to clearly understand whether to support the chip storage data reorganization;
• After confirming the recombination of the supporting data, first, apply flux around the chip;
• Then use a hot air gun to adjust the temperature to the disassembly temperature of about 220 degrees, blow welding on the chip;
• The blow-welded chip is put into the programmer for data reading;
• Use professional data recombination equipment to analyze the layout of the data extracted from the chip and reorganize the logical data;
• Finally, extract the reorganized logical data.

2. For SSD with bad blocks, read errors, unreachable modules, status exceptions, and lost state:

• Firstly, professional equipment is used to read SSD system and chip information, and the main information includes chip number, channel number, channel block number, block size, page size, and other parameters;
• By obtaining the parameter information, the service area is scanned in each channel of the chip;
• Filters important firmware information from the retrieved service area;
• Extract the new decoding table from the important firmware;
• Through the new decoding table, the logical data image extraction.

3. For a wide variety of SSD interfaces:

• Starting with the internal understanding of the protocols they use and the external interface configuration, there are currently seven major categories of SSD interfaces;
• Need to pay attention to what protocol they use, and what channel does the data transfer take;
• For SATA bus with AHCI protocol, the corresponding SATA interface needs to be used;
• If it is PCI-E bus with NVME protocol or PCI-E bus with AHCI protocol, the corresponding PCI-E adapter card shall be used to transfer;
• For the hard disk with the U.2 interface, we need to prepare the advanced hardware in advance to access the SSD data through the dedicated motherboard interface.

4. For interface failure and component failure with minimal storage of SSD:

• First of all, in case of an interface failure, an empty board with the same model number and circuit board number should be prepared according to the original circuit board model number;
• Use flux and a hot air gun to blow the main control chip and memory chip together;
• Weld the main control chip and memory chip to the new circuit board one by one;
• Wait for the temperature to cool, use the multimeter to measure whether the main control and storage is short circuit;
• Connect the device to read the SSD data;
• In the case of component damage, purchase the same type of circuit board directly to remove the intact components using a hot air gun and electric iron replacement.

5. For circuit scratches of SSD:

• First prepare copper wire, tin wire, and soldering iron;
• With the help of a magnifying glass, put copper wire of suitable length on the scratch of the circuit again;
• Connect both ends of the copper wire back to the original circuit using tin wire and electric soldering iron;
• Restore the other places where the tin points have fallen off one by one;
• Multimeters are used to measure circuit paths and major chip data channels;
• Connect the device to read the SSD data.

In numerous SSDs, Intel’s consumer SSD in terms of performance is good, but Intel 710 series there is a bug in the controller, can lead to power during the drive capacity only 8 MB, read the first sector of the data at the same time all is 0, shown in the diagram below, this is also a firmware fault are common in their everyday life.

Process of Firmware Repairing:

1. Acquire disk capacity:

• The first is to determine the block structure based on the obtained firmware information;
• The second is to send instructions to get information from the drive;

2. Gets the data for the corresponding address

• First, you need to send the initialization instructions off the drive;
• After success, the address of the sector data to be read is transferred to the drive-by instruction, and the internal part of the hard disk is converted by decoding table;
• Then use the command to read the response data of the drive, in the data to save the symbol of the success of the conversion, if the first four bytes of the returned data is the address previously transferred to the drive, the conversion is successful, otherwise, the conversion fails;
• Finally, the data of the transformed address is read;
• Set the value of the sector address (LBA) of step 2 to 0, and the following results are obtained from the program. It is not difficult to find from the figure that the data in the first sector of the hard disk changes from all 0 to MBR, and the data is repaired normally.

The above repair methods are all based on the processing after the drive failure. There are different repair technologies for different fault types, but the repair may not be successful. In many cases, the data cannot be recovered.

For important data protection in the SDD drive, should not only in the hope of drive failure after restoration, but more attention should also be paid to the drive in the process of using prediction and data protection, by predicting to forecast the result of the hard drive, electric, health, long lifetime and so on, for drive status is bad, promptly the important files in the backup hard disk data or directly mirror the whole drive, the loss of important data to prevent the drive.

Conclusion

Thanks for your time reading our blog post. If you are interested in our forensic solutions, come and check out our website for more information. You can also go to our resource page to download our forensic products for free. We welcome you to contact us and claim your free product trial!