Data Recovery from Solid State Drives can be Tricky

Solid State Drives have been long seen as the next generation of ultimate storage media. Small, compact, efficient and high performance NAND chips that return lightning fast read and write speeds. What more could one want? Oh… yeah there was the pricing factor, for the longest solid state drives have been a bit too costly for most consumers and therefore we have seen an early adoption of high performance solid state drives predominately in the enterprise.

However, looking at the trends on 2013 , 2014 and projecting trends for 2015, the purchase cost of solid state drives has drastically dropped. Not only to the point where they are now becoming reasonably priced for consumers to consider, but are soon to be within range to compete with traditional hard drives.


So what is not to love about these great little magic storage devices? The main concern has been the recoverability from both a computer forensic and a data recovery standpoint.  Digital forensic examiners are concerned about the TRIM technology that is being utilized in most Solid State Drives. Causing a quick garbage collection and reallocation of pages. This process deletes blocks and therefore can make some deleted data areas unrecoverable. Even for digital forensic examiners and law enforcement. Once the process has removed the data, there is not much left to be un-done. Different SSD drives handle after-TRIM reads differently. Firmware bugs are common in SSD drives and can greatly affecting evidence recoverability. From a data recovery engineer’s perspective, Solid State Drives are complex and difficult storage devices, which still are not fully understood in their totality.  Various failure types can occur; despite SSD’s no longer have any mechanically rotating components such as their older brother the Hard Disk Drive. These Devices suffer from electronic failures, damaged resistors, and capacitors, fuses, voltage regulators and controllers. In many cases a cumbersome process can be performed to recover the data from a damaged SSD Drive. This involves the removal of each individual NAND (storage chip), usually 12 or 16 of them. Thereafter the data needs to be read out from each chip via specific hardware. Once this process has been completed the data needs to be assembled. The assembly process can be a difficult one, due to how the Solid State Drive’s controllers store the data within the chips. This usually includes complex storage algorithms. For approx. 30% off all SSD drives, a recovery at present time is not possible. This in many cases is because the Solid State Drives utilize a controller that encrypts all of the data prior to storing the content on the actual Flash chips.



About the Author