Accueil > Unclassified > Data recovery in an SSD

Data recovery in an SSD

Récupération de données SSD
Data recovery in an SSD

This article follows the in-depth tour of professional SSDs, as well as the article about SSD lifespan.

On a mechanical hard drive, data recovery is often possible: there is a physical trace of the data written. There are many services or companies that offer this type of service. Thus, it is sufficient to repair faulty mechanical components and / or to use forensic software / apparatus. As for SSDs, data recovery is much more complex.

On an SSD, as there is not necessarily the slightest link between logical and physical organization of data, this operation is much more complex or even impossible in some cases.

Recovery process for SSD

Processus de récupération
Processus de récupération pour SSD

The process for recovering data from a faulty SSD is always the same, regardless of the origin of the failure (controller fault, circuit break, etc.):

  1. It is necessary to unsolder the memory chips that compose it to read the stored data individually, this requires specific and precision equipment (soldering station, specific reader, etc.).
  2. Then you have to reconstruct the data, this is the most laborious and complex part. Indeed on an SSD, the data is organized in a rather specific way.

First, all bits are, by default, 1, so to minimize the number of write / erase, and the number of 1, in chips, it is very common for manufacturers to choose to apply an XOR function to the data. incoming. The problem being that the XOR function is difficult to reverse in addition to being difficult to detect. In addition to that, the data can be organized in various ways, more or less complex.

Take, for example, next-generation internal interlacing. This way of organizing the data distributes the pages by block, i.e. a logical volume of X pages will be written on (suppose) two blocks, we will then find the even pages in the even blocks and the odd pages in odd blocks.

Difficult data recovery

Difficult data recovery

The main difficulty is, it is impossible to know which function was used to organize the data without testing it, which takes a long time. Additionally, controllers use complex algorithms to reconstruct a logical data volume using the latest version of each block. To do this, it stores the version number of each block in a dedicated space. Thus, if the controller is faulty, the task is even more complex. Finally, manufacturers develop sometimes very complex management algorithms for their SSDs, so, to avoid reverse-engineering, they encrypt these algorithms as well as certain data, this obstacle is probably the most insurmountable.

A point on the data actually erased is in order. On an SSD, the data is determined by the electrical state of the memory chips, after being erased by the garbage collector or the Trim command. the data does not leave the slightest physical trace on its medium. This detail may seem insignificant but it can be a problem for the legal authorities, indeed on a classic hard drive (unless it has gone through a series of specific operations or simply destroyed) it is possible to recover the data. that the user thought they had erased since their trace is still present on the board. On an SSD this proves impossible, if the user issues the appropriate commands (or if he simply allows his SSD time to run his garbage collector) it will be impossible for anyone to recover the data since the memory cells will simply be empty.

On an SSD, if the physical medium, i.e. the memory chip, is damaged it is quite simply impossible to recover the data, whereas with the appropriate hardware and software, it is generally possible to read the residues of the supposedly erased data on the hard drive platter.

It may interest you

Leave a Reply

Your email address will not be published. Required fields are marked *

Solve : *
14 − 12 =