Recovering data from SSDs: Technical deep dive with Spiceworks

A few months ago, we were lucky enough to partner with Spiceworks to share knowledge and answer some questions around the topic of SSDs.

Spiceworks is a great platform to share educational content, product reviews and ask any questions you may have about your IT profession. If you ever have a question about data recovery or data management, one of our top tech wizzes is available on the Spiceworks forum to help you out.

Here's a recap of what we covered in our first Spiceworks meet up:

-       SSD controller recovery vs chip-off recovery and which technique works under specific circumstances

-       The challenges of recovering data from 3D NAND and why it may be easier than 2D TLC NAND

-       The flip side to the science of data recovery. Ensuring that you erase the data on your SSD.

For those that 'don't fancy watching the full recording, below are some of the key questions (with answers) our experts were asked.

In the event of an SSD failure, is it advisable to cool the drive down before attempting recovery (i.e. Should I ship it on dried ice or something similar)?

There is no need to ship the drive cold. In sporadic cases, the temperature can sometimes affect NAND, so freezing a drive can occasionally clean up bit errors. When these errors are on the 'drive's firmware storage, it can make a previously failed drive work again temporarily.

Do you see data recovery getting more cost-effective or more expensive because of the different variations of firmware?

We 'don't see a difference in the cost of the actual recovery, but there is a time cost. When we are familiar with the drive or firmware variation, we have better support for that drive. In cases when we are seeing new drives for the first time, it can take some time to perform research and development and work with the drive manufacturer to gain knowledge of the drive and the data layout.

 Has your job in data recovery changed for the better or, the worse with NVME/Flash vs old spinning disk for recovery percentages?

 We wouldn't say it's got worse, but we still have a lot to learn when it comes to SSDs, whereas our knowledge in tooling in terms of spinning hard drives is very mature. We are leading the way in terms of research and development expenditures for SSD support, so we learn all the time and developing new recovery methods.

How do data recovery experts circumvent TRIM?

TRIM does go and zero out the bits so shutting the drive down after an accidental deletion is critical. This will stop the process and hopefully retain most if not all of the data that was deleted.

Are there different methods of extracting data from traditional NAND and 3D Optane type chips?

 There are controller-based recoveries and chip off recoveries. We prefer controller-based recoveries where we extract the data through the controller chip. This is a much quicker and reliable way of recovering the data.

If you overwrite the controllers with your firmware, how do you know where the data is randomly laid out or is that stored on the flash itself?

We are not overwriting the drives firmware but more sideloading a version of our custom firmware that then interfaces with the 'drive's firmware. This is used to apply low-level operations that are not typically supported without our firmware directly interfacing the firmware of the drive. 

Is there any chance to recover data on your own with SSD? Or is the only option to ship it in for recovery?

There are a few things to try at home, given you have a backup or clone. If you do not have either, we advise you reach out to a data recovery company so that further damage can be mitigated.

 Does using something like DBAN or other drive wiping software damage the SSD?

Typically, deletion software does not damage a drive. It does wear the NAND just like any other IO operation though.

 Does recovering data from an SSD require specialized settings like a clean room for old HDD?

We still open any SSDs we receive in our cleanrooms, but we do not have to worry as much about getting particles on the platters as we do on spinning media.

Counter to what you usually do. What is the best way in your opinion to make sure the data isn't recoverable?

Make sure all the NAND chips are broken for destruction or use an erasure software that has been validated by Ontrack.

What's the next generation of SSDs looking like both speed and price?

QLC NAND is the newest and densest flash. We would expect to see this technology continue to drop in price and rise in capacity.