Over the past few years Kroll Ontrack have been compiling a database of Solid State Drives (SSD) and other flash memory devices sent to them for data recovery. Its engineers have recently been analysing this data and have come up with the top 5 SSD recovery issues that make data recovery from SSDs much more complex than traditional HDDs:
1. Proprietary design and architecture
The design of SSD is rapidly evolving in the pursuit of higher performance, lower cost and higher capacity. For each new design the layout of the data, the way it is configured and the way it is accessed changes. The impact of these changes on data recovery is the data layout needs to be mapped for each new design before a recovery can be attempted. The short cut would be to obtain the new layouts from the SSD manufacturers, but they are obviously very weary of releasing any information that might help their competitors figure out what their latest design innovations are. This means for each new design architecture Kroll Ontrack has to map the layout before they can achieve a high quality recovery.
A cautionary note: if a data recovery company tells you that it is just a matter of reading the data from the chips they don’t know what they are doing.
2. Poor design or insufficient testing
Without good design and thorough testing the data stored on SSDs is susceptible to corruption. When electrical power is removed from an SSD, whether it is planned or unplanned such as when a laptop battery goes flat, the SSD has milliseconds to save the data into the right location. If the design or testing process is not thorough enough to accommodate this situation this can lead to data not being saved to the correct place causing corruption or lost data due to sudden power loss. When the power returns in the worst cases the SSD is unable to power up correctly and access any of the data. In more common cases the result is a loss of some of the data, normally from the files that were being accessed at the time of the power removal. A common situation this occurs in is when a USB memory drive is removed without safely removing (Windows) or ejecting it (Mac or Linux) first.
Encryption using hardware or software encryption drastically reduces the chances of a successful recovery for most failure modes. The encryption means the raw data cannot be reconstructed into the correct layout as it cannot be read. It would be like trying to do a jigsaw where all the pieces are the same colour and same shape.
4. Embedded SSDs
On most tablets and smart phones the memory, controller and associated electronics are mounted on the same circuit board as all the other electronic components. This means fault isolation and repair are far more complex than from a SSD that can be removed, e.g a MacBook Pro SSD. See the image for more details.
5. Number of Manufacturers
The number of manufacturers and hence number of different designs is huge. It will be a long time before the SSD industry consolidates to the extend the Nand memory chip market has. Almost 100 per cent of the Nand market is divided between the dominant D-Ram players Samsung Electronics, SK Hynix and Micron along with Intel, Toshiba and SanDisk. For SSDs there are over 500 manufacturers.
As the design of SSDs and the recovery techniques used mature I expect these issues will be come less of an obstacle to overcome to achieve a high quality, yet cost effective data recovery.