Editor’s note: We are excited to post our first sneak peek of the design and functionality of our brand new industry-leading computer forensics tool: SRS SSD Forensic Recovery System. This article will give you an overview of SSD data recovery, and will also introduce one of the core advantages in SRS——TRIM Deleted Data Recovery.
What is Solid State Drive (SSD)?
Solid State Drive (SSD) has been marketed as a clear choice for consumers looking for reliability and speed. Much of the optimism surrounding the reliability of SSDs compared to the standard mechanical drives. So nowadays, SSDs are becoming more and more popular, lots of customers buy them instead of conventional hard disk drives (HDDs). SSD consists of solid-state electronic memory chips (typically DDR RAM or Flash Memory) to read and write data. It can extend the life of a notebook battery, decrease the weight of the machine, and increase read performance. SSD has solved the problem of physical constraints and is now widely used to replace HDD with high-speed circuitry.
What makes SSD so popular?
1. SSD provides faster access time than a hard drive does.
2. The SSD access time does not depend on a read/write interface head synchronizing with a data sector on a rotating drive.
3. The SSD also provides greater physical resilience to physical vibration, shock, and extreme temperature fluctuations. SSD is also immune to strong magnetic fields which could sanitize a hard drive.
Why are SSDs corrupted/failed/not working/dead?
SSDs do not have to contend with failure points dependent upon physical wear and tear, like a mechanical drive, but the components do degrade from use over time. As with any manufactured product, material defects can affect the longevity and reliability of an SSD. Capacitors, controller chips, and power supplies each must function reliably for the SSD to continue to operate and are common failure points. A key statistic to most SSDs is the expected number of reading/writing cycles that the flash memory is rated for. This figure calculates the endurance of the storage components and gives an expected lifespan for the drive. In most cases, consumers should expect at least a decade of average use before the read/write endurance of a drive surpassed and in some cases many more years. As with all computer components, wear and tear will eventually cause a failure. The best course of action is to have an adequate backup plan in place and follow the best practices when attempting to recover a failed drive.
And you don’t have to worry about the mechanical components in your solid-state drive wearing down over time. That’s because there is no moving arm writing to a spinning disk, like in a traditional hard drive. That doesn’t mean your SSD will not experience any wear and tear. Capacitors degrade over time, the power supply could break, and the controller chip could kick the bucket. So, while an SSD is more reliable than a mechanical hard drive, it does have components that can and will break.
Solid State Drive wear rates
There are three common measurements used to describe SSD wear rates, manufacturers test the SSD hardware extensively before releasing it to consumers. The three specifications are:
1. P/E Cycles: A program-erase cycle is a process where data is written to an SSD memory block, erased, and rewritten. The entire process counts as one cycle. The number of cycles an SSD can withstand depends on the manufacturer, hardware, and SSD technology. Total P/E cycles can range from as low as 500 up to a high of around 100,000.
2. TBW: The Terabytes Written measurement details how much data you can write to an SSD before it fails. For example, a 250GB Samsung 860 EVO SSD carries a 150TBW rating, whereas the 1TB model comes with a 600TBW rating. Like P/E cycles, ratings vary between manufacturers and the SSD technology.
3. MTBF: The Measurement of Time Between Failures is the third SSD reliability measurement you will see. MTBF describes the SSD reliability over its expected lifetime under normal operation and is typically measured in the tens of thousands of hours.
SSDs are built for longevity. You should expect your SSD to last you quite a while. Better still, there aren’t many things that can outright destroy your SSD. A power surge is one thing that can damage your SSD or wipe your data, but you can protect against that with a surge protector power outlet or power strip. However, the simple fact of the matter is that as your SSD ages, electronic components wear and will eventually fail.
Can you recover data from a corrupted/failed/not working/dead SSD?
SSDs do not give warning signs as they near failure. There is no growing realization that the new buzz or grinding noise you hear is the slowly failing mechanical drive. When an SSD fails it simply no longer works and with no warning. When an SSD suddenly goes silent, it’s bad news. The biggest hurdle to recovering data from an SSD is the relatively newer technology that an SSD represents. Data recovery systems have had many years to perfect the recovery of files from older mechanical drives and those techniques will not work on an SSD. As the technology of SSDs matures further, expect more recovery solutions to become available.
How to spot a failing SSD and save your data?
The best way to stop a catastrophic loss of data from your SSD is to understand the warning signs. Your old hard drive would whirr, click, grind, and beep before it finally hit the dust. But your SSD doesn’t give those audible warning signs. There are several key warning signs that your SSD is about to die:
1. Bad block errors: You cannot write to a specific block on the SSD, random freezes and errors, random crashes.
2. Cannot write to disk: As it says, you can no longer write to the SSD, which in turn causes crashes, errors, and more.
3. File system repair: You need to repair your operating file system on an increasingly regular basis.
4. Boot crashes: Your operating system cannot boot properly, and your system fails to load.
5. Read-only: The SSD suddenly switches into read-only mode, stopping you from writing new data to the drive.
These are not the only indicators before an SSD failure, but they are the most common. A healthy backup system should form part of any computer user’s routine. You never know when something might happen, and you’ll kick yourself if you lose important data.
What’s TRIM?
SSD TRIM is an Advanced Technology Attachment (ATA) command that enables an operating system to inform a NAND flash solid-state drive (SSD) which data blocks it can erase because they are no longer in use. The use of TRIM can improve the performance of writing data to SSDs and contribute to longer SSD life. Basically, with TRIM feature the user’s solid-state drive (SSD) can improve computer performance. However, this function will make data recovery impossible. When a user deletes any data from a TRIM-enabled SSD, then the drive will clear all the sectors immediately and permanently.
How does SSD TRIM impact data recovery?
The potential for data recovery on an SSD is hampered due to the way an SSD self-manages data destruction using the TRIM command. Furthermore, the chance of data recovery depends on the SSD status. Is the drive completely broken, or did you lose data in a power surge? To understand how TRIM impacts data recovery, it is useful to understand what happens when you delete a file on your computer.
Data deletion on a hard drive
A traditional hard drive stores files in physical locations on a magnetic platter. The operating system indexes the file locations in a file system and accesses the data using a mechanical arm. Whereas, a solid-state drive is a form of flash memory, like a USB thumb drive—but with a much larger capacity.
When you press Delete, the file doesn’t actually annihilate into the ether. First, it moves to the Recycle Bin, where its indexed location remains in place in case you want to rest. When you delete the file from the Recycle Bin (or use the Shift + Delete shortcut for direct delete), Windows removes the file completely and informs the operating system that the space is available for new data. While that seems a little convoluted, it means your data remains recoverable, at least for a short period.
Data deletion on an SSD
Your SSD is different from a regular hard drive due to the data storage technology. Your SSD stores data in cells. Before writing new data to a cell, the SSD must move the existing data to another location on the SSD. During regular operations, SSDs essentially rapidly zero the data containing cells before rewriting data. SSDs maintain control over where data is written within the cells. This means that the operating system might request data to be written to block 1,000, whereas the SSD pointer table contains an altogether different number. This is known as wear-leveling.
Data still writes to the SSD. The SSD manages the location of the data, ensuring there is space for the new data to write to the drive. However, the operating system might mark a block as empty according to its records, while the SSD is moving data around to ensure even wear. That’s where the TRIM command comes in. TRIM allows the operating system to tell the SSD which blocks it can pre-zero. The process keeps the data write process fast as you don’t have to wait for the block to zero. The flip side of that usefulness is that you don’t know when the TRIM command will inform on which blocks to zero.
How to recover deleted data from SSD TRIM？
SRS SSD Forensic Recovery System supports one-click recovery of TRIM deleted data. The deleted data of SSD after TRIM will be cleared, and the tools at the logical level can no longer recover the deleted data. Therefore, the recovery of TRIM deleted data has always been the pain point and difficulty of the industry.
Through in-depth research and attempts, SRS can perform recovery on data that has not been filled with 0 after TRIM deletion. SRS does not need to read all physical data of the chip, no physical data sorting and reorganization of normal image files, and can directly restore TRIM deleted data through a wizard-like operation. (Remind: the longer the TRIM deletion time, the lower the probability of data recovery)
SRS SSD Forensic Recovery System
SRS SSD Forensic Recovery System is an industry-leading Solid State Drive recovery tool developed by SalvationDATA. It widely supports fault diagnosis, firmware repair, data extraction, and data recovery from SSDs with SATA, PATA, mSATA, and M.2 interfaces and the capacity from 32 GB to 2 Tb of different brands, including OCZ, Corsair, Crucial, RunCore, A-DATA, G.Skill, Micron, Plextor, Intel, Samsung, Seagate, SanDisk, Kingston, etc. SRS6900 supports high-speed imaging up to 30G/ min, with the advanced utility, it can do disk imaging of SSD drive which had bad sectors including ECC bad sectors using our proprietary bad sector anti-blocking technology. This can effectively solve the problem of data recovery for corrupted or failed SSD with bad sectors. The product design is simple, easy to use, following the forensic workflow, and suitable for one-key operation.
Stay tuned for our next sneak peek!
SalvationDATA Blog 