Home-Programs-How can I get my used solid state drive (SSD) back to peak performance? Deleting and recovering deleted files from a USB drive or external SSD drive.

How can I get my used solid state drive (SSD) back to peak performance? Deleting and recovering deleted files from a USB drive or external SSD drive.

Read about problems recovering SSD drives. Physical overwriting of deleted files with the TRIM command and cases when it does not work. Today solid state drives SSD), are becoming more and more popular and are often replacing traditional hard drives. Often used as system drives, SSDs store the operating system, applications, and all or most of the user's files, including documents, settings, web browsers, email, and more.

Content:

Due to the fact that SSD drives have no moving parts, they are considered more reliable than their mechanical counterparts. However, user errors, virus attacks and operating system failure also pose a certain threat to the integrity of the data on these drives. Owners of SSD drives encounter deleted files, accidentally formatted disks, corrupted data table partitions, and corrupted system files just as often as those with a regular hard drive.

Is it possible to recover an SSD?

The situation with data recovery from an SSD drive is significantly different from what we are used to using conventional hard drives. It is not always possible to recover deleted information from an SSD drive, but at the same time, it is not always impossible.

Let's look at various situations and find out what can be done if you use a special recovery program Hetman Partition Recovery.

Recovering files from SSD

In the vast majority of cases, files that have been deleted from an SSD drive cannot be recovered. This statement may not be what you want to hear, but a feature of the SSD that is not found in other traditional devices is TRIM - a special ATA interface command that causes the SSD controller to literally physically clear blocks of data that were previously used to in order to save deleted files.

In other words, the controller will receive the command the very moment you delete the file. Of course, direct deletion of information does not occur instantly, but modern SSD controllers are designed in such a way as to report that the data block is empty as soon as the deletion command is received, even if the actual data block is cleared a little later.

Speed ​​of SSD drives from Corsair, Kingmax, Kingston, PQI, etc. almost the same. Regardless of the manufacturer, it can be argued that the fact of executing the TRIM command almost 100% guarantees the deletion of files.

Is it possible to do something about this? There really isn't much that can be done. However, there are exceptions to this rule. If the TRIM command was not executed, if this option is not supported by the disk, the operating system, or the interface between the computer and the SSD, you will be able to recover the files as if they were saved on a regular disk.

Today, most SSD drives support the TRIM function. However, the current version of the MacOS operating system does not work with this command, so you can recover files deleted from your Mac PC. It is also possible to recover files from older versions of Windows (those before Windows Vista), which also do not support TRIM. And finally, the TRIM function is not supported when working with USB and FireWire protocols, therefore, your data from external media can be recovered.

Recovering Formatted SSDs

Typically, two types of disk formatting were available: full and quick. With full formatting, the information contained on the hard drive was erased, while with quick formatting, the partition table with information about files was simply cleared, giving the opportunity to a program such as Hetman Partition Recovery quickly and efficiently restore the necessary data. Now, such rules do not apply to SSD drives.

The very moment the user formats the disk, regardless of whether he uses a full or quick format, the operating system runs the TRIM command, and the SSD controller begins to physically erase the information contained in the data blocks. Again, this procedure is not instantaneous, but most controllers are designed to reset the data immediately after the TRIM command has been issued. With some exceptions (mentioned above), data from formatted SSD drives cannot be recovered - even if the fast format was selected.

Recovering failed SSDs

What to do if your SSD drive has been damaged, seriously damaged (within reason, of course) and can no longer be read or detected by the system. Ironically, in this case, all files are safely stored on disk because the TRIM command was not run by the operating system. In other words, you can use a data recovery program such as Hetman Partition Recovery to recover information from corrupted, damaged, unreadable or inaccessible SSD drives and get back all, or almost all, data in the shortest possible time. To prevent unexpected drive failure, follow S.M.A.R.T. parameters of the SSD and promptly change the device to a new one.

In an article entitled “How SSDs Erase Data,” we explained why SSDs continuously “scrape” free space, almost instantly erasing data after quickly formatting the drive or deleting a partition. Sounds scary, doesn't it? However, things are not always as bad as they may seem. Often your files still remain on the SSD drive, which means they can be restored. Let's look at when this happens and why it is possible.

TRIM: when the function does not work

TRIM is a great thing for optimizing the performance and longevity of an SSD drive. Without the TRIM function, we would have had a much lower speed of writing data to disk. Additionally, flash cells, which have a limited number of write cycles, would wear out much faster.

However, in some situations, the TRIM function is not used by the system. Specifically, TRIM will not work under any of the following conditions:

  • You used an SSD drive in a USB enclosure. TRIM does not work over USB (it does work over ESATA, however);
  • You used one or more SSD drives in a NAS enclosure (most NAS drives do not support TRIM, with the exception of some types of NAS drives that run in conjunction with the latest OS);
  • You used two or more SSDs in an internal RAID array (until recently, Windows did not support TRIM on RAID arrays. Even today, TRIM and RAID cannot always work together);
  • You are using Windows XP or Vista (TRIM was only added to Windows 7 and newer OS versions, including Windows 8 and 8.1);
  • Your SSD drive is formatted in FAT, FAT32 or EXFAT (in Windows TRIM only works with NTFS);
  • The disk or file system is damaged (TRIM only works if you have explicitly deleted the file, formatted the disk, or re-partitioned it. Otherwise, even if you don't see any data and the disk appears empty or inaccessible, the TRIM command will not work. while you are formatting or redistributing partitions);
  • Non-Apple SSD on Mac (On Mac OS X, TRIM is supported only on Apple-manufactured SSDs).

If your case fits one of the conditions described above, you can safely use one of the data recovery programs such as RS Partition Recovery to get your deleted files back. The likelihood that your data still exists and can be recovered is just as high as with a traditional hard drive!

Despite the significant difference between the type of drives in question and conventional hard drives and other types of storage media, the same applications for data recovery can be used. If the hardware was damaged, then specialized equipment and utilities will be required for resuscitation.

Faults preventing data from being read

Today, all faults that do not allow reading the data present on the media of the type in question can be divided into several main categories:

Physical damage includes failure of the main components:

  • connectors for connecting an interface;
  • failure of the physical memory controller chip;
  • failure of board components;
  • failure of the entire printed circuit board.

Damage of this kind can be caused as a result of both mechanical and electrical influence. In this case, repairs to restore access to the information located on the drive are quite complex and require specialized skills. Sometimes, when the controller is destroyed, it becomes simply impossible to access the content.

Logical damage to the media (its file system) may be a consequence of erroneous erasure of information or formatting. Also, situations of this kind occur due to the incorrect operation of any specialized applications. This kind of situation can be resolved quite simply - with the help of specialized utilities.

Disk drives of this type contain partitions used by the controller to perform its functions. If for some reason they are damaged and become inoperable, then in order to resuscitate them it is necessary to transfer the device to a specialized authorized service center. Such damage is not as complex as a controller failure, but is just as dangerous.

Recovery in case of damage to the controller

The type of process in question always consists of two main stages:

  • hardware;
  • software

Disassembling the device and subsequent steps

Disassembling the device of this type is carried out in several stages:

  • the case is removed from the personal computer (laptop or desktop - it doesn’t matter);
  • using a suitable screwdriver (Phillips or slotted), unscrew all connecting bolts;
  • a special opening tool (or a regular plastic card) is used to separate the housing.

After opening, you need to use a specialized soldering hair dryer to desolder all the microcircuits. Next, you should use a device that allows you to read directly from these electronic components - NANDFlashReader. This programmer is usually equipped with special utilities for reading.

Reading data from the chip

To work with data on a chip soldered from a printed circuit board, you can use the following applications:

  • PC-3000 Flash;

To recover data usingPC-3000 Flashyou need to do the following:

  • after launching, in the left window, right-click on the required microcircuit;
  • in the context menu that opens, select “read chip”;
  • set reading parameters in the corresponding window and auto-analysis parameters;
  • The image is being assembled, all data is located on the right side of the window;
  • select everything you need and right-click again - select “Save” (or press “F2”).

In some particularly complex cases, using the auto-analysis function is simply impossible. In such situations, it is best to contact professionals who specialize in problems of this type. Since otherwise there is a high probability of damage to the contents of the chip without the subsequent possibility of gaining access to the data.

Another quite powerful application for working with SSD memory chips is FlashExtractor. It was initially developed to work with the circuits of conventional flash cards, but later began to be used to work with the components of the disks in question.

Data recovery process fromSSDdisk:

  • we connect a special reader with a circuit installed in it to a personal computer via USB;
  • run the Flash Drive Information Extractor file (\usbflashinfo\GetFlashInfo.exe);
  • on the function panel you need to click on the “Get information” button;
  • select the destination where all saved content will be saved;
  • Click on “Extract”.

After the process is completed, all data to be restored will be copied to the appropriate directory. After which the user can use them at his own discretion.

With a working controller

It is much easier to resuscitate data when the controller is fully operational, and the necessary content was lost due to erroneous erasing or formatting. In such situations, there is no need to disassemble the disk itself, as well as solder it. Thus, the required amount of time and complexity of work are significantly reduced.

The following applications are ideal for resuscitating data in this case:

  • DMDE;
  • Hetman Partition Recovery;

All of the above applications give a fairly high success rate. Their use will allow you to recover data even if the device is formatted.

DMDE

To start the application recovery processDMDE, you need to do the following:

  • launch the application from the directory where it is installed;
  • after startup, a window will be displayed in which you will need to select the desired device (select an SSD drive);
  • Click on the “Start” button (a green triangle is drawn on it).

You must first look in the program settings at the destination where all information is saved. It is important to ensure that the amount of free space on the partition you select as the destination is sufficient to copy all the required volume.

An application called HetmanPartitionRecovery is also great for resuscitating data on an SSD drive.

To carry out this process, you need to do the following:

  • launch the application;
  • in the left part of the work area, select the disk with which you need to work and select it;
  • Open the “File” menu and select “Scan”.

After the scan is completed, all detected files will be indicated in the form of shortcuts or a table on the right side of the screen. To restore them, select the necessary objects, then right-click to open the context menu and select the second item from the top “Restore”. The data recovery process will take place automatically.

AdvancedDiskRecovery

The AdvancedDiskRecovery interface is not much different from the workspace of similar utilities. After launch, the user will see a standard workspace on the screen.

To begin the resuscitation process, you must do the following:

  • Select a device on the left side of the screen;
  • open the “Options” menu and click on the “Scanning” item;
  • on the right side of the screen the available objects to be resuscitated will be indicated;
  • Select the necessary files and folders and click the “Save” button (at the bottom right of the screen).

Despite all their reliability, SSD-type media sometimes fail. Also, users themselves are often the main cause of data loss (they accidentally delete files or format the device). Although there are some difficulties, there is almost always a chance to recover lost information.

Back in the days when mechanical hard drives with spinning platters were the standard, you could just give your old hard drive to a friend, hear “Thank you,” and be done with it. With modern solid-state drives, things are not so simple.

In many cases, used SSDs are no longer as fast as new ones, although they are still faster than the latest hard drives. The biggest problem with selling an SSD after a long period of use comes from the inconvenient characteristic of NAND flash memory: previously written cells must be erased before new data can be written to them. If an SSD is forced to reuse cells instead of using new ones to store data, performance drops sharply.

To avoid this problem with NAND flash, modern SSD controllers use a number of techniques, including creating additional storage that users cannot use, a technique known as over-provisioning. There is also a command called TRIM, which tells the SSD when blocks of memory are no longer needed and can be merged and erased.

Sounds good, doesn't it? But there is one problem.

Not all garbage collection (as erasing used cells and merging data in NAND memory is called) is created equal. The build can be inconsistent, and some older operating systems—Windows XP in particular—don't even support the TRIM command. Thus, the most frequently used NAND cells may remain on the SSD longer than you suspect.

In Windows 7 and 8, users don't have to worry about all this. The performance of modern SSDs should not noticeably deteriorate for many years, perhaps longer. But there are several scenarios where these idle cells can cause a hit to SSD performance, such as prolonged use in an environment without TRIM support (such as XP), after the disk is almost full and large amounts of data have been deleted, or simply by changing partitions and formatting. .

Yes, simply deleting files, changing partitions and formatting the drive does not work the same as on an HDD. These operations occur at a higher level than those where garbage collection occurs. In fact, due to the complete lack of utilities that perform a full garbage collection, there is only one way to return an actively used SSD to a pristine state so that it becomes as good as new - the ATA secure erase command.

Secure erase

The feature, built into every ATA-based drive (SSD and HDD) since 2001, erases everything on the drive and marks the cells as empty, restoring any modern SSD to factory performance.

Once upon a time, it was possible to invoke secure erase only through command line utilities such as HDparam in Linux or HDDerase in DOS, developed at the University of California, San Diego. But many SSD and HDD manufacturers now provide free utilities, such as OCZ's ToolBox, Samsung's Magician, or Seagate SeaTools, that provide secure erase capabilities.

Although the command itself is standard, many utilities only work with drives from their own company. If the manufacturer does not provide a secure erase command, you can use the DriveErase utility included with Parted Magic.

Additionally, secure erase is not routine maintenance for most users. If you are using Windows 7 or 8, you do not need to apply it unless you need to clean up the disk. If you're using XP, only perform secure erase when you really notice a drop in performance. Evidence of this is short-term hangs of the interface or freezes when saving files.

Here's how to recover your SSD step by step.

If you have data on your drive that you want to save, back it up to another storage device. If we are talking only about files, you can simply drag them onto a flash drive or external hard drive, or use a backup program.

If you have a working operating system that you would like to keep, you need to use a disk imaging program such as Acronis True Image or R-Drive Image, which copies everything. Do not use Windows System Recovery if you are restoring data to a different drive. It will not recover smaller drives, and sometimes struggles even with similarly sized drives that have plenty of free space.

Before you begin, disable all other drives and boot from your flash drive to perform the erase procedure to avoid accidentally overwriting the wrong drive. Parted Magic is an excellent choice because the program works as a bootable flash drive. If unplugging your other drives seems like a daunting task, make sure you select the correct drive to erase. Secure erase is irreversible.

Now run the secure erase feature. The exact method depends on the program. A guide to erasing using Parted Magic is easy to find online. Some SSDs use an advanced version of secure erase by default, which even removes service data.

The secure erase process will take only a few minutes on a modern SSD. On hard drives it can take several hours.

Once the process is complete, partition and format the drive if you plan to use it again. Parted Magic provides a convenient full-fledged editor to perform this task, but you can use the Windows Drive Management utility (Control Panel > System and Security > Administrative Tools > Create and format hard drive partitions) to accomplish the same task. Most often, users create a single partition and format it in NTFS.

You can then return the copied data back to the blank disk and enjoy high speed performance.

SSD Recovery | When a good memory gets into trouble

This time we contacted the Flashback Data laboratory, whose employees work on all types of data storage devices, but have special experience in working with flash memory. Representatives from Flashback Data agreed to show us what efforts a top-notch laboratory would take to save our precious flash memory.

SSD Recovery | Reading range

In its early days, Flashback primarily focused on replacing faulty chips, but over time this became increasingly difficult to do as manufacturers began using different components at different stages of production in the same model. Some devices now have encryption, which makes data recovery even more difficult. In this case, Flashback needed to be able to read memory directly, which in turn meant having an incredible number of ways to read chips from such a wide variety of flash memory available.

Note that when Flashback refers to "encryption", this state is typically unknown to the user. For example, around 2006, SanDisk began encrypting data on all of its drives, as Flashback co-founder and vice president Russell Chozick told us. As with automatic hard drive encryption, the controller encrypts all data stored in flash memory. Since there is no password to lock the encryption, the data is decrypted and retrieved from the media. So if the circuit board is damaged, Flashback employees try to move the controller and memory chips to a new device. “If the controller burns out, it is almost impossible to get the data back, since it contains information about how exactly the data needs to be decrypted. If you cannot work with the controller, you are faced with a big problem.”

SSD Recovery | Types of Flash Memory

These dark gray TSOP48 chips have been typical components of USB flash drives and SSD/SD/CF memory cards for many years, but recently they have opened the way for other chips as well. The bottommost sample in the picture shows the back of the TLGA chip and you can see that there are no pins on the side and the modules are located on the back side. Such chips are common in all types of flash memory and work, for example, in the latest iPhone smartphones.

During the rebuild process, Flashback employees insert TSOP48 chips into the readers, but the TLGAs must also be soldered. Obviously, the processes of analyzing and restoring information are much more complicated. So with the introduction of more compact flash memory into smartphones, the old “monolithic” formats seem simpler in comparison.

LaCie SD cards and USB devices also have monolithic chips. While most memory cards have separate controller and memory chips, a monolithic chip combines both components into one tiny module. Obviously, malfunctions of such devices can occur for any of a variety of reasons. If the controller stops working, technicians can still access the data through other means instead of using pins to connect to a card reader, smartphone or camera. In the photo, you can see how the device's casing has been partially removed, as technicians need to remove some of the soldered black coating in order to find certain points for connection to the logic analyzer. Once all points have been identified, the card will be connected as shown in the following pictures.

To remove some of the coating, Flashback employees use surprisingly simple tools: sanding paste and a polishing wheel. Chemicals can be used to achieve this goal, but we were told that it is better to use a slow and thorough polishing process. Very thin contacts can easily be damaged during the grinding process. We initially asked to connect a LaCie drive, but then abandoned the idea after learning that such a job could take a technician all day.

SSD Recovery | Common flash drive errors

We've seen photos of damaged hard drives, most of which were damaged due to the head colliding with tracks in the magnetic media. Almost all SSD and flash memory damage that Flashback detects is invisible. In rare cases, you may see a burn mark on the circuit board, but in general, broken controllers and burnt fuses leave no visible marks. As a result, specialists have to work for a long time testing each resistor. In comparison, disconnecting the connector, as shown in the photo, is a piece of cake for repair specialists.

SSD Recovery | What about wear and tear?

We have previously written about the constant race between two processes - improving reading algorithms as capacity increases and reducing lithography, which is reminiscent of a tug of war. In particular, we are concerned that flash and SSD drives that have been in use for several years may show signs of wear and tear.

Fortunately, we are told that most of the SSD drives that arrive at the Flashback laboratory are not even a year old, so the NAND memory does not wear out. In fact, cases of actual wear and tear are extremely rare. Although with USB flash drives (especially older models with less advanced alignment algorithms), wear is a little more common. Reading from the chips works fine, but when checking the information, a lot of ECC errors occur, and no data can be retrieved. The presence of four red dots (further in the pictures) indicates problems with ECC. On the contrary, major wear problems will be marked with four green dots.

There were also cases when specialists carried out an analysis, took out the chip, cleaned the lamella and put everything back in place, exacerbating the problem with reading the data, which now required more time. So wear and tear can indeed be regarded as a real danger, but there is no talk of any crisis here, although many might think about it.

SSD Recovery | Heat it up

Chips must be removed from the circuit board using a special soldering jig, and one of the main tools for this step is hot air. The picture shows how specialists remove the TLGA chip from a USB device. They control the temperature and air pressure, heating the device enough to melt the solder points. Such soldering stations also contain soldering irons, welding flux, ohmmeters and other diagnostic devices. Some of these stations occupy Flashback's main laboratory, which measures approximately 465 square meters.

SSD Recovery | Deleting memory

This SSD's controller is burned out, so Flashback's technicians carefully remove the memory chips, each of which is hand-numbered for tracking and easy data collection.

“Sometimes we never find out which components have failed,” says the company’s vice president. “We just know that this type of drive has a firmware glitch, or this error is most typical for it, so for us to work we need to remove the chips. Our clients are constantly in a hurry, so in many cases it is not possible to determine the exact reason why it burned out, but we know that the reading process will not work through the controller here, but it is not encrypted, so we have to. disconnect the chips, read them, and then restore them.

SSD Recovery | Disconnecting chips

Flash drives and SSDs aren't the only devices that experience heat. Flashback receives a constant stream of cell phones, like this HTC Evo that was drowned in a swimming pool. Services for recovering information from flash memory cost hundreds and thousands of dollars, so it becomes obvious that this phone was not given away to restore children's cartoons. Some of these phones are said to contain recent photographs of deceased friends or loved ones. Devices related to criminal investigations are regularly supplied, and if a criminal can destroy evidence, roughly speaking, underfoot, then valuable information can be obtained from an intact flash memory for an investigation.

The HTC Evo smartphone is now two years old. New devices, such as the Samsung Galaxy and some others from HTC, often support eMMC technology, which contains a controller built into the memory module, just like an SD memory card. In this case, the recovery process can become even simpler.

SSD Recovery | Hard drive vs flash memory

The so-called service area of ​​the hard drive contains information that allows it to “communicate” with itself. To transfer data into read/write processes, it is necessary to provide information about where the bad sectors are located, how many magnetic heads there are, which of them are enabled and which are disabled, and so on. Such information is located on the platters in a special area, which is separated from the disk space reserved for recording user data.

In the case of flash memory, manufacturers also leave space for such a zone, which contains all the information about error correction codes, the presence of errors in sectors, the location of these sectors, and so on.

While a hard drive consists primarily of 512-byte sectors, flash memory typically uses 528-byte sectors, with 512 bytes dedicated to memory and another 16 to the aforementioned service area. In SSD drives, the sector size of 512 bytes is converted to a user-accessible sector size. But when Flashback reads the raw data, experts get information from both areas. The data is mixed, dumped into one pile and at the same time alternated. When specialists need to display available information, all its elements extracted from the service area must be removed.

SSD Recovery | Closer inspection

Sometimes technicians need to perform a very thorough visual inspection of the chips and their fragile insides. The best tool for this kind of work is Vision Engineering's Mantis microscope, and although it costs about $2,000, it helps restorers examine the design in 3D (using two light paths passing through one lens) at twenty times magnification. A more natural and comfortable experience with Mantis helps detect problems that might not be noticeable using conventional microscopes. It also becomes an assistant during soldering work, during disassembly and repair.

SSD Recovery | Scanning stations

Once the chips are wired together so they can be read by external devices, Flashback employees place them in self-assembled configurations to read the data. They are quite simple, although they have special systems that allow you to view different sectors, control operating time, and so on. If reading is slower than usual, it is possible to move to other uncorrupted sectors to get the available information as quickly as possible.

“We can go forward and backward,” says the company's vice president. “We can have the device scan the MFT file table and display only the allocated data instead of getting free space, so the job can be done very quickly. Sometimes you have to fight with device that continues to fail even during the recovery process, sometimes there are clients who need to get one or two important files out as quickly as possible in a short time."

SSD Recovery | Mount selection

To connect chips to reading systems, Flashback uses a surprising variety of special mounts. In the picture you can see the type of adapter that was used to work with TSOP48 chips and a TLGA reader. Inside these adapters, each of the connector pins touches contacts on the memory chip. The adapter is screwed into the board for subsequent connection to the TSOP connector. At the bottom there is a USB interface for communication with scanning systems.

SSD Recovery | Data mix

Remember that memory chip that was removed from an HTC phone? We may see it again, now with readout wires. The circuit boards were custom made to connect to a USB device. Holes in each corner help secure the chip to the board. Together with the TSOP adapter shown above, each of its pins touches one pin on the memory chip. But in such a mix, all chip lamellas are open, so specialists can do unsoldering instead of connecting to the connector. Since there are many monolithic chips and connectors, the Flashback needs to connect to specific points and solder them to the chip.

This is an eight-bit chip, as evidenced by the eight wires that are connected to the circuit board. In a 16-bit chip there would be twice as many of them.

SSD Recovery | Reading process for several hours

When connecting monolithic chips, a similar approach is used. Different devices require different wires, but the approach remains the same - each connection performs its own function. For example, in the upper right corner, 3.3 V power is supplied through the contact. Looking at this process, you begin to realize how time-consuming it takes to simply extract data from the chips.

SSD Recovery | Welcome to the world of chaos

Let's see what data recovery specialists work with. Here you can see the contents of the raw raw data from the SSD's Master Boot Record. Data is mixed using algorithms used by controllers to optimize read and write speeds, level out wear, and so on.

“When we read the chips, we received a whole bunch of raw data,” says the vice president of the company. “For example, here the memory chip has a 528-byte sector, where 512 bytes are used for data, and another 16 are used for storing information about this data and error correction "We call this area a service area. When we first look at this hexadecimal data set, we need to find the data structures we know about to figure out their location."

SSD Recovery | FAT under a microscope

Shown here is the FAT16 file system and boot sector

“The master boot record (MBR) is usually marked in sector 0,” says Chozik. “Now it’s not there, but we can find it and determine the known data structure. We know where it is located, how far it is from the boot sector, and so on. This can be seen in the following picture. This process is similar to collecting evidence. We find the MBR, the boot sector and the FAT. Now we see the structures we are familiar with, and we must think about how to move them back together.

Chozik notes that sometimes experts fail to find any of these structures, usually because of the algorithm included with the device. Some algorithms invert all data bits. If such an approach is discovered, then specialists know how to carry out the reverse process. Some algorithms will touch each byte instead of an entire sector, so each byte will be located on a different memory chip. This requires a byte-by-byte rejoin rather than a whole sector rejoin. Some algorithms will use ciphers that further complicate the process. For a process performed by a computer, recovery is quite often done manually.

SSD Recovery | Joint return

Let's take a closer look at the data in the sector where information is scattered across several memory chips. You can see what the first part of each sector looks like.

In the hexadecimal number system, the designations are arranged in the following order: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C and so on. On chip #1 you can see that the order is broken twice - first between the values ​​09 and 0E, and then between 11 and 16. What happens to the corresponding data? The answer is on chip #2.

SSD Recovery | In order

Specialists need to reunite these separated 2112 bytes (4 sectors of 528 bytes), and when this happens, the result will look the same as in the picture below.

Now imagine that there are 64 memory dumps that need to be combined. Why 64? Because a separate chip can have more than one dump, but, for example, four at once. So take 16 chips (for example, on an SSD drive), multiply their number by four - you will get the total number of dumps (exactly 64).

SSD Recovery | Before and after

It may be hard to imagine what all this byte-level fluctuation actually looks like at the macro level. An empty cell in a table (or a damaged file) cannot fully reflect the entire situation.

This picture from Flashback illustrates this. In some examples, the header and some of the data are intact, so they may appear close together but be jumbled, resulting in image artifacts.

Taking a corrupted JPEG file, technicians use ECC correction and block movement to reorder the data and remove bit errors that were processed by the controller. They are also re-sequenced and clear the service area of ​​collected data to ensure a clean, uninterrupted flow of data.

SSD Recovery | End result

After several hours of repairs and various manipulations, even using algorithms that help automate data collection, Flashback employees provide the data in the form of files and folders. Everything is in order. The pressing question remains whether the data has been fully recovered and whether it corresponds to its original form.

This can be partially checked using file headers. SD memory cards and similar storage devices typically contain a ton of images that are easy to visually check for errors. ECC errors in individual files are fairly easy to detect - with other file types it can be more difficult. Utilities are able to tell specialists using the header that the file has been disinfected, but they may not note the bad sector, which is clearly visible to the observer.

“For most clients, we focus on practicality,” notes the company's vice president. “We ask what they need to get and test the files if they ask for it. If it turns out that we cannot restore the directory structure, we we have to do this using the file header. This is like a “raw” recovery, where we do not get file names. We will pull out the data, and we will get even more than people expect, since we can also recover deleted information. Sometimes we see that. The FAT table is completely damaged, and then you have to proceed with this type of recovery."

SSD Recovery | What's more important?

In one of the articles about data recovery, one of the readers noted in the comments that essentially anyone could get into this business and that Flashback operates on a different level compared to more well-known services. Proof of this fact can be found in the results and client list, which includes a wide range of commercial and government organizations.

According to Chozik, Flashback's leading experts have more than 15 years of experience in the data recovery industry. The company has invested hundreds and thousands of dollars in equipment and parts to carry out these processes.

“It’s very difficult to learn this business on your own,” he says. “It took years for the R&D department to reach the heights that we have achieved. Our company is not as small as it seems: we are almost 465 square meters in size, and We have a high level of security. There is also a four-level biometric control with round-the-clock surveillance. In order to combat static, the laboratory uses a grounded floor with copper wires, so there is no risk of electrical damage. We have a special area protected by bars for storing such data. used as evidence in investigations. Also special clean workstations with laminar air flow (Class 10 and Class 100 levels) are designed for hard drives. The forensic laboratory is the only private ASCLD laboratory with international accreditation (ISO 17025).

SSD Recovery | Not so small

The Flashback data recovery lab consists of three rooms. The large space of the first is filled with computers, soldering stations, devices for restoration, visualization and firmware. There are also servers for data storage and similar tasks. Another room stores thousands of hard drives, different versions of firmware and a ton of different devices in case you need a circuit board, internal read/write heads or anything else. It is worth noting that it is really clean here and there is forced air circulation for working with hard drives.

Another level of security is maintained in the so-called forensic area, which has already been discussed, and the cage in which the relevant drives are stored is fixed to the floor and equipped with motion sensors.

But this is not the most important thing in the article: it introduces you to the processes that occur behind the scenes of large companies involved in data recovery. Restoring is not just a plug-and-copy process, the amount of work seems simply prohibitive. Of course, we all hope to never become clients of such services, but if we suddenly have to use the services, then this is the data recovery process that your devices will be forced to go through.



Related publications: