How to recover data from faulty SSDs. Recovering a damaged SSD

Every PC user sooner or later faces problems when it is necessary to correct errors that occur with the system. And it’s good if they didn’t affect personal data. It’s worse if you have to restore the SSD drive. What is needed for this?

Device

Before you figure out how to recover data from a solid-state drive, it’s worth understanding what it is. SSD is a drive that is installed in a computer system. It is often compared to hard drive, since both devices have the same tasks. But there is a significant difference.

The solid state drive is very fast disk, which copes with work several times faster than a hard drive. This is caused by a difference in design.

Built on magnetic disks and the read head, the solid state drive works like a flash drive and is based on microchips.

IN at the moment SSDs are just gaining popularity. They are often purchased in pairs with hard drives and an operating system is installed on them for fast loading. Because SSDs are prohibitively expensive, HDDs cannot completely replace SSDs. Although server stations and gaming systems can install several solid-state drives.

Drive problems

As mentioned, SSD is popular due to its high speed. But, besides this, it is also considered a reliable device. This is due to the fact that the design of the drive has no moving parts, so it does not suffer from minor damage that the hard drive may not tolerate.

But an SSD can definitely be attacked by viruses and user errors. All this affects the integrity of personal data. If they are deleted certain files, it will not be easy to restore them. It’s more difficult with data after formatting. But restoring an SSD is possible.

What are the chances?

It’s worth saying right away that data recovery from an SSD drive is somewhat different from the process that is necessary in the case of a hard drive. Unfortunately, there are situations that make it impossible to recover lost documents.

But in most cases, it is possible to return files. The user will have to select suitable program and follow the instructions.

Special teams

The question of whether the SSD drive will be restored worries many people. It’s definitely not easy to answer, since there are a couple of nuances that can affect the result.

A distinctive feature of the drive is the presence of a specific command that SSDs have. TRIM is responsible for ensuring that all data that has been deleted from the disk is actually destroyed. The SSD completely erases the files from the data blocks.

This command works very simply. When a user deletes documents, it signals that the files should be destroyed rather than stored in special blocks.

But there is one point here: of course, the documents will not be deleted immediately. The device will notify the user that the files have been deleted, but the block will be cleared a little later. Therefore, there is a chance to quickly return the data.

All popular solid state drive manufacturers are trying to create universal devices, which would differ from each other only in the volume of the archive. All drives have the same speed, so the TRIM command will be executed 100%.

What to do?

If a command like this exists, is it possible to recover an SSD drive? In reality, little will happen. For example, some drives do not support the command to completely delete files, so any program can handle the recovery. Also, TRIM may not work on a particular operating system. There may be difficulties with the interface or motherboard. USB and FireWire protocols do not support the command.

Formatted drives

In this case, recovering SSD disk files is even more difficult. As you know, there is a complete and quick formatting of disks. Thanks to this function, you can completely clear data from the drive.

Full formatting completely destroys data, while quick formatting works with information partition tables. Therefore any popular program to restore it would cope with the second type of removal. But later the technology of the solid-state drive changed. It won't be easy to deal with now quick formatting, not to mention complete.

This state of affairs is again associated with the TRIM command. When the user selects formatting, it automatically triggers a complete data deletion. And the delay between activating TRIM and destroying documents from the disk is practically non-existent.

Disk failure

Why do you need SSD recovery? The hard drive may be corrupted by the system or damaged. The device may have become unreadable and the OS cannot detect it. In this case, returning personal data will be very simple. All you have to do is pick necessary software and restore files.

This is because the drive cannot enable TRIM. Due to the fact that the command has not been run, files from the blocks will not be deleted. Accordingly, they will be easy to restore.

Recovery instructions

First you have to find good program. Recovering an SSD drive is not easy. As with a flash drive, the user will have to try several programs at once. Therefore, you first need to install a couple of utility options.

After this you will have to connect the SSD. Many users advise not to use this SATA interface, and USB. This is due to the fact that the “native” port can activate the TRIM command, and accordingly, the files will be permanently deleted.

If you connect the drive via USB, deletion will not be activated, which means that the documents will remain safe.

Once the device is connected, you can launch the program. Whatever the utility, they all have a similar interface. You just need to select the drive you want to restore. After this, the user must start diagnostics, and then the recovery process itself.

Results

When the program collects all the information, a table will appear showing all the lost data. Some programs use certain markings. If the file can be recovered and saved on a PC, the opposite will be green tick. If it is damaged and its restoration is in doubt, there will be a yellow checkmark opposite. Red color indicates that the files have been severely “destroyed” and there are only their remains. Accordingly, it will be impossible to “reincarnate” such data.

Programs

Programs for data recovery from solid state drive large number. For example, you can use Magic Partition Recovery. The utility can cope with deleted partitions and bad sectors.

The program works with many file formats. She can for short time scan the drive and then create a report. There is also an in-depth analysis of SSDs. In this case, the utility works with the contents of files without using the file table.

Magic Uneraser is another document recovery program. It differs only in interface from the previous version. Works with everyone existing formats media files. Quickly scans the drive and also collects a report on the recovered data. The utility is compatible with hard drives, solid state drives, memory cards and flash drives.

Repair

Speaking about restoring the SSD disk controller, it is worth mentioning physical damage to the device. If for some reason the drive has broken down, you shouldn’t throw it away right away. Many experts say that it is quite possible to repair it. The question here is different: is there necessary tools and user skills?

In this case, you need to know the reading range, memory types, standard errors. Specialists carefully inspect the device, disconnect the chips, select a mount and scan the board.

Of course, such operations regular user will not be able to do it. To do this, you need to understand the drive structure, as well as have the appropriate testing programs and repair tools.

In those days when mechanical hard drives spinning platters were the standard, you could just give your old hard drive to a friend, hear “Thank you”, and that was the end of it. With modern solid-state drives, things are not so simple.

In many cases used solid state drives no longer as fast as the new ones, although still faster than the most modern hard drives. The biggest problem with selling an SSD after a long period of use comes from the inconvenient characteristic of NAND flash memory: previously written cells must be erased before new data can be written to them. If an SSD is forced to reuse cells to store data instead of using new ones, performance drops sharply.

To avoid this problem with NAND flash memory, modern SSD controllers use a number of techniques, including creating additional volumes that users cannot use - a technique known as over-provisioning. There is also a command called TRIM, which tells the SSD when blocks of memory are no longer needed and can be merged and erased.

Sounds good, doesn't it? But there is one problem.

Not all garbage collection (as erasing used cells and merging data in NAND memory is called) is created equal. The build can be inconsistent, and some older operating systems—Windows XP in particular—don't even support the TRIM command. Thus, the most frequently used NAND cells may remain on the SSD longer than you suspect.

In Windows 7 and 8, users don't have to worry about all this. The performance of modern SSDs should not noticeably deteriorate for many years, perhaps longer. But there are several scenarios where these idle cells can hit SSD performance, such as long-term use in an environment without TRIM support (for example, in XP), after the disk is almost full and large amounts of data have been deleted, or simply by changing partitions and formatting.

Yes, simply deleting files, changing partitions and formatting the drive does not work the same as on an HDD. These operations occur at a higher level than those where garbage collection occurs. In fact, due to the complete lack of utilities that perform a full garbage collection, there is only one way to return an actively used SSD to a pristine state so that it becomes as good as new - the ATA secure erase command.

Secure erase

The feature, built into every ATA-based drive (SSD and HDD) since 2001, erases everything on the drive and marks the cells as empty, restoring any modern SSD to factory performance.

Once upon a time, it was possible to invoke secure erase only through command line utilities such as HDparam in Linux or HDDerase in DOS, developed at the University of California, San Diego. But many SSD and HDD manufacturers now provide free utilities, such as OCZ's ToolBox, Samsung's Magician, or Seagate SeaTools, that provide secure erase capabilities.

Although the command itself is standard, many utilities only work with drives from their own company. If the manufacturer does not provide a secure erase command, you can use the DriveErase utility included with Parted Magic.

Additionally, secure erase is not routine maintenance for most users. If you are using Windows 7 or 8, you do not need to apply it unless you need to clean up the disk. If you're using XP, only perform secure erase when you really notice a drop in performance. Evidence of this is short-term hangs of the interface or freezes when saving files.

Here's how to recover your SSD step by step.

If you have data on your drive that you want to save, run backup to another medium. If we are talking only about files, you can simply drag them onto a flash drive or external hard disk, or use a backup program.

If you have a working operating system that you would like to keep, you will need to use a disk imaging program such as Acronis True Image or R-Drive Image, which copies everything. Do not use Windows program System Recovery, if you are restoring data on a different disk. It will not recover smaller drives, and sometimes struggles even with similarly sized drives that have plenty of free space.

Before you begin, disable all other drives and boot from your flash drive to perform the erase procedure to avoid accidentally overwriting the wrong drive. Parted Magic is an excellent choice because the program works as a bootable flash drive. If unplugging your other drives seems like a daunting task, make sure you select correct disk, which needs to be erased. Secure erase is irreversible.

Now run the secure erase feature. Exact method depends on the program. A guide to erasing using Parted Magic is easy to find online. Some SSDs use an advanced version of secure erase by default, which even removes service data.

The secure erase process will take only a few minutes on a modern SSD. On hard drives it may take several hours.

Once the process is complete, partition and format the drive if you intend to use it again. Parted Magic provides a convenient full-fledged editor for this task, but you can use Windows utility Drive Management (Control Panel > System and Security > Administration > Create and format hard sections disk) to solve the same problem. Most often, users create a single partition and format it in NTFS.

You can then return the copied data back to the blank disk and enjoy high speed performance.

I thought that suddenly this topic would make some of the owners of an SSD device think about backup, some about a generally more cautious attitude, and some would save others from communicating with the not too hasty support service. Everything written does not apply Only to devices of the same series and manufacturer that I have.

About 10 days ago I happened to leave a laptop with a battery in critical condition without charging overnight. I'm not too worried about battery life, but the blow came from the other side. In the morning, when I plugged in the laptop and turned it on, I was surprised to find that:

Let's collect an arsenal that will be useful to us:

$ sudo apt-get install hdpam partx smartmontools

$ sudo partx -s /dev/sda
partx: /dev/sda: failed to read partition table

$ sudo smartctl -s on -d ata -A /dev/sda -T verypermissive
smartctl 5.41 2011-06-09 r3365 (local build)
Copyright 2002-11 by Bruce Allen,

SMART support is: Unavailable - device lacks SMART capability.
=== START OF ENABLE/DISABLE COMMANDS SECTION ===
Error SMART Enable failed: Input/output error

I/O error? The drive doesn't support SMART? This is already some kind of nonsense.

$ sudo hdparm -I /dev/sda

ATA device, with non-removable media
Model Number: INTEL SSDSA2CW080G3
Serial Number: BAD_CTX 00000150
Firmware Revision: 4PC10302
…
Configuration:
Logical max current
cylinders 16383 16
heads 16 16
sectors/track 63 63
-
CHS current addressable sectors: 16128
LBA user addressable sectors: 156301488
LBA48 user addressable sectors: 156301488
Logical Sector size: 512 bytes
Physical Sector size: 512 bytes
device size with M = 1024*1024: 76319 MBytes
device size with M = 1000*1000: 80026 MBytes (80 GB)

In short, for those unfamiliar with the language and the lazy, forum members talk about the widespread susceptibility of all Intel SSDs to such a bug, especially affecting the 320 series and X25M. There is news about firmware 0362, which is designed to get rid of this particular bug, but the number of requests from people has already this firmware with the same symptoms indicates that the problem has not been resolved. Yes, the best solution in this case would be to send the hard drive back to Intel so that they have an incentive to correct their mistakes.

Unfortunately, Intel support is not very prompt, and replies about once a day, obtusely on technical issues, and highly recommending installing their SSD Toolbox to determine the problem. I would like to separately note that the main segment of SSD users are owners of MacBooks, who, like me, have difficulties installing software under Windows. It is worthy of special mention that this tool, designed for identifying faults, requires:
- Java
- .NET 3.5
- Windows Media Player Redistributable 11
which makes installing it on a computer loaded from a Live CD an almost impossible task (firstly due to capacity limitations on the virtual hard drive, and secondly due to the fact that WMP 11 requires Windows authentication verification, which only creaks and groans some particularly outstanding personalities are produced in Wine.
Warm greetings to the developers of this software.
I miraculously managed to explain the situation to support, and they agreed to a replacement, but for a replacement I need to fill out an incredible number of forms, to which I also need to attach confirmation of my purchase of the device. As fate would have it, I am now ten thousand kilometers from home, and I did not expect such a catch.

Fortunately, everyone on the forums clearly says that the contents of the disk cannot be restored, but that it is possible to restore functionality. And the time that was spent on correspondence with the support service was not wasted, but was usefully spent reading forums and experiments, the brief results of which are given here.

It is necessary to restore the number of cylinders, returning the treasured 16383.
For this operation we will need two commands, launching both is difficult to protect from fools and pests.

We set the user and password for master operations on the disk.

$ sudo hdparm –user-master user –security-set-pass abc /dev/sda

The following commands perform some kind of safe cleaning, I ran both because I wasn’t sure which one would be needed. Before each, I started setting a master password and closing the laptop lid.

$ sudo hdparm –user-master user –security-erase abc /dev/sda
$ sudo hdparm –user-master u –security-erase-enhanced abc /dev/sda

$ sudo hdparm --dco-restore /dev/sda

Total conclusions that I made for myself:
- keep a Live CD handy
- do not leave the laptop completely without power at a critical charge
- make backups, including keyrings, lists of installed packages, configs and rsa keys
- update the firmware (after you have found out that it definitely works well)
- take care of your nerves

I would also like to note that this method does not always completely restore functionality, and that sometimes the disk remains glitchy and slow.

Once again I would like to send my warmest greetings to Intel support, and let them know that I still can’t log in with my username and password to their community in order to publish this miraculous recipe with them, and remind them that I’ve been waiting for at least some kind of help from them for a week now. Any answer why I can’t do this.

In the next topic I'll tell you about interesting statistics SSD deaths, returns, repairs and operational errors by manufacturer and model.

PS Dear Habr, please correct the display of the “code” tag.
PPS Found it by chance

SSD Recovery | When good memory gets into unpleasant situations

This time we contacted the Flashback Data laboratory, whose employees work on all types of data storage devices, but have special experience in working with flash memory. Representatives from Flashback Data agreed to show us what efforts a top-notch laboratory would take to save our precious flash memory.

SSD Recovery | Reading range

In its early days, Flashback primarily focused on replacing faulty chips, but over time this became increasingly difficult to do as manufacturers began using different components at different stages of production in the same model. Some devices have introduced encryption, which makes data recovery even more difficult. In this case, Flashback needed to be able to read memory directly, which in turn meant having an incredible number of ways to read chips from such a wide variety of flash memory available.

Note that when Flashback refers to "encryption", this state is typically unknown to the user. For example, around 2006, SanDisk began encrypting data on all of its drives, as Flashback co-founder and vice president Russell Chozick told us. As with automatic hard drive encryption, the controller encrypts all data stored in flash memory. Since there is no password to lock the encryption, the data is decrypted and retrieved from the media. So if the circuit board is damaged, Flashback employees try to move the controller and memory chips to a new device. “If the controller burns out, it is almost impossible to get the data back, since it contains information about how exactly the data needs to be decrypted. If you cannot work with the controller, you are faced with a big problem.”

SSD Recovery | Types of Flash Memory

These dark gray TSOP48 chips have been typical components of USB flash drives and SSD/SD/CF memory cards for many years, but lately they paved the way for other chips. The bottommost sample in the picture shows the back of the TLGA chip and you can see that there are no pins on the side and the modules are located on the back side. Such chips are common for all types of flash memory and work in e.g. the latest smartphones iPhone.

During the rebuild process, Flashback employees insert TSOP48 chips into the readers, but the TLGAs must also be soldered. Obviously, the processes of analyzing and restoring information are much more complicated. So with the introduction of more compact flash memory into smartphones, the old “monolithic” formats seem simpler in comparison.

LaCie SD cards and USB devices also have monolithic chips. While most memory cards have separate controller and memory chips, a monolithic chip combines both components into one tiny module. Obviously, malfunctions of such devices can occur for any of a variety of reasons. If the controller stops working, technicians can still access the data through other means instead of using pins to connect to a card reader, smartphone or camera. In the photo, you can see how the device's casing has been partially removed, as technicians need to remove some of the soldered black coating in order to find certain points for connection to the logic analyzer. Once all points have been identified, the card will be connected as shown in the following pictures.

To remove some of the coating, Flashback employees use surprisingly simple tools: sanding paste and a polishing wheel. Chemicals can be used to achieve this goal, but we were told that it is better to use a slow and thorough polishing process. Very thin contacts can easily be damaged during the grinding process. We initially asked to connect a LaCie drive, but then abandoned the idea after learning that such a job could take a technician all day.

SSD Recovery | Common flash drive errors

We've seen photos of damaged hard drives, most of which were damaged due to the head colliding with tracks in the magnetic media. Almost all SSD and flash memory damage that Flashback detects is invisible. In rare cases, you may see a burn mark on the circuit board, but in general, broken controllers and burnt fuses leave no visible marks. As a result, specialists have to work for a long time testing each resistor. In comparison, disconnecting the connector, as shown in the photo, is a piece of cake for repair specialists.

SSD Recovery | What about wear and tear?

We have previously written about the constant race between two processes - improving reading algorithms as capacity increases and reducing lithography, which is reminiscent of a tug of war. In particular, we are concerned that flash and SSD drives that have been in use for several years may show signs of wear and tear.

Fortunately, we are told that most of the SSD drives that arrive at the Flashback laboratory are not even a year old, so the NAND memory does not wear out. In fact, cases of actual wear and tear are extremely rare. Although with USB flash drives (especially older models with less advanced alignment algorithms), wear is a little more common. Reading from the chips works fine, but when checking the information, a lot of ECC errors occur, and no data can be retrieved. The presence of four red dots (further in the pictures) indicates problems with ECC. On the contrary, major wear problems will be marked with four green dots.

There were also cases when specialists carried out an analysis, took out the chip, cleaned the lamella and put everything back in place, exacerbating the problem with reading the data, which now required more time. So wear and tear can indeed be regarded as a real danger, but there is no talk of any crisis here, although many might think about it.

SSD Recovery | Heat it up

Chips must be removed from the circuit board using a special soldering jig, and one of the main tools for this step is hot air. The picture shows how specialists remove the TLGA chip from a USB device. They control the temperature and air pressure, heating the device enough to melt the solder points. Such soldering stations also contain soldering irons, welding flux, ohmmeters and other diagnostic devices. Some of these stations occupy Flashback's main laboratory, which measures approximately 465 square meters.

SSD Recovery | Deleting memory

This SSD's controller is burned out, so Flashback's technicians carefully remove the memory chips, each of which is hand-numbered for tracking and easy data collection.

“Sometimes we never find out which components have failed,” says the company’s vice president. “We just know that this type of drive has a firmware glitch, or this error is most typical for it, so for us to work we need to remove the chips. Our clients are constantly in a hurry, so in many cases it is not possible to determine the exact reason why it burned out, but we know that the reading process will not work through the controller here, but it is not encrypted, so we have to. disconnect the chips, read them, and then restore them.

SSD Recovery | Disconnecting chips

Flash drives and SSDs aren't the only devices that experience heat. There is a constant flow through the Flashback service cell phones, such as this one HTC Evo who was drowned in the pool. Services for recovering information from flash memory cost hundreds and thousands of dollars, so it becomes obvious that this phone was not given away to restore children's cartoons. Some of these phones are said to contain latest photos deceased friends or loved ones. Devices related to criminal investigations are regularly supplied, and if a criminal can destroy evidence, roughly speaking, underfoot, then valuable information can be obtained from an intact flash memory for an investigation.

Now HTC smartphone Evo is two years old. New devices, such as the Samsung Galaxy and some others from HTC, often support eMMC technology, which contains a controller built into the memory module, just like an SD memory card. In this case, the recovery process can become even simpler.

SSD Recovery | Hard drive vs flash memory

The so-called service area of ​​a hard drive contains information that allows it to “communicate” with itself. To transfer data into read/write processes, it is necessary to provide information about where the bad sectors are located, how many magnetic heads there are, which of them are enabled and which are disabled, and so on. Such information is located on the platters in a special area, which is separated from the disk space reserved for recording user data.

In the case of flash memory, manufacturers also leave space for such a zone, which contains all the information about error correction codes, the presence of errors in sectors, the location of these sectors, and so on.

While a hard drive consists primarily of 512-byte sectors, flash memory typically uses 528-byte sectors, with 512 bytes dedicated to memory and another 16 to the aforementioned service area. In SSD drives, the sector size of 512 bytes is converted to a user-accessible sector size. But when Flashback reads the raw data, experts get information from both areas. The data is mixed, dumped into one pile and at the same time alternated. When specialists need to display available information, all its elements removed from the service area must be deleted.

SSD Recovery | Closer inspection

Sometimes specialists need to carry out a very thorough visual inspection chips and their fragile insides. The best tool for this kind of work is Vision Engineering's Mantis microscope, and although it costs about $2,000, it helps restorers examine the design in 3D (using two light paths passing through one lens) at twenty times magnification. A more natural and comfortable experience with Mantis helps to detect problems that might not be noticeable using conventional microscopes. It also becomes an assistant during soldering work, during disassembly and repair.

SSD Recovery | Scanning stations

Once the chips are connected in such a way that they can be read external devices, Flashback employees place them in self-assembled configurations to read the data. They are quite simple, although they have special systems that allow you to view different sectors, control operating time, and so on. If reading is slower than usual, it is possible to move to other uncorrupted sectors to get the available information as quickly as possible.

“We can go forward and backward,” says the company's vice president. “We can have the device scan the MFT file table and display only the allocated data instead of getting free space, so the job can be done very quickly. Sometimes you have to fight with device that continues to fail even during the recovery process, sometimes there are clients who need to pull one or two as soon as possible important file in a short time."

SSD Recovery | Mount selection

To connect chips to reading systems, Flashback uses a bewildering array of special mounts. In the picture you can see the type of adapter that was used to work with TSOP48 chips and a TLGA reader. Inside these adapters, each of the connector pins touches contacts on the memory chip. The adapter is screwed into the board for subsequent connection to the TSOP connector. At the bottom there is a USB interface for communication with scanning systems.

SSD Recovery | Data mix

Remember that memory chip that was removed from HTC phone? We may see it again, now with readout wires. The circuit boards were custom made to connect to a USB device. Holes in each corner help secure the chip to the board. Together with the TSOP adapter shown above, each of its pins touches one pin on the memory chip. But in such a mix, all the lamellas of the chips are open, so specialists can do desoldering instead of connecting to the connector. Since there are many monolithic chips and connectors, the Flashback needs to connect to specific points and solder them to the chip.

This is an eight-bit chip, as evidenced by the eight wires that are connected to the circuit board. In a 16-bit chip there would be twice as many of them.

SSD Recovery | Reading process for several hours

When connecting monolithic chips, a similar approach is used. Different devices needed different wires, but the approach remains the same - each connection performs its own function. For example, in the upper right corner, 3.3 V power is supplied through the contact. Looking at this process, you begin to realize how time-consuming it takes to simply extract data from the chips.

SSD Recovery | Welcome to the world of chaos

Let's see what data recovery specialists work with. Here you can see the contents of the raw raw data from the SSD's Master Boot Record. Data is mixed using algorithms used by controllers to optimize read and write speeds, level out wear, and so on.

“When we read the chips, we received a whole bunch of raw data,” says the vice president of the company. “For example, here the memory chip has a 528-byte sector, where 512 bytes are used for data, and another 16 are used for storing information about this data and error correction . We call this area the service area. When you first view this data set in hexadecimal system"We have to find the data structures we know in order to figure out their location."

SSD Recovery | FAT under a microscope

Shown here is the FAT16 file system and boot sector

"Home boot record(MBR) is usually marked in sector 0, says Chozik. “Now it’s not there, but we can find it and determine the known data structure.” We know where it is located, how far it is from the boot sector, and so on. This can be seen in the following picture. This process is similar to collecting evidence. We find MBR, boot sector and FAT. Now we see structures that are familiar to us, and we must think about how to move them back together.

Chozik notes that sometimes experts fail to find any of these structures, usually because of the algorithm included with the device. Some algorithms invert all data bits. If such an approach is discovered, then specialists know how to carry out the reverse process. Some algorithms will touch each byte instead of an entire sector, so each byte will be located on a different memory chip. This requires a byte-by-byte rejoin rather than a whole sector rejoin. Some algorithms will use ciphers that further complicate the process. For a process performed by a computer, recovery is quite often done manually.

SSD Recovery | Joint return

Let's take a closer look at the data in the sector where information is scattered across several memory chips. You can see what the first part of each sector looks like.

In the hexadecimal number system, the designations are arranged in the following order: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C and so on. On chip #1 you can see that the order is broken twice - first between the values ​​09 and 0E, and then between 11 and 16. What happens to the corresponding data? The answer is on chip #2.

SSD Recovery | In order

Specialists need to reunite these separated 2112 bytes (4 sectors of 528 bytes), and when this happens, the result will look the same as in the picture below.

Now imagine that there are 64 memory dumps that need to be combined. Why 64? Because a separate chip can have more than one dump, but, for example, four at once. So take 16 chips (for example, on an SSD drive), multiply their number by four - you will get the total number of dumps (exactly 64).

SSD Recovery | Before and after

It may be hard to imagine what all this byte-level fluctuation actually looks like at the macro level. An empty cell in a table (or a damaged file) cannot fully reflect the entire situation.

This picture from Flashback illustrates this. In some examples, the header and some of the data are intact, so they may appear close together but be jumbled, resulting in image artifacts.

Taking a corrupted JPEG file, technicians use ECC correction and block movement to reorder the data and remove bit errors that were processed by the controller. They are also re-sequenced and clear the service area of ​​collected data to ensure a clean, uninterrupted flow of data.

SSD Recovery | End result

After several hours of repairs and various manipulations, even using algorithms to help automate data collection, Flashback employees provide the data in the form of files and folders. Everything is in order. The pressing question remains whether the data has been fully recovered and whether it corresponds to its original form.

This can be partially checked using file headers. SD memory cards and similar storage devices typically contain a ton of images that are easy to visually check for errors. ECC errors in individual files are fairly easy to detect - with other file types it can be more difficult. Utilities are able to tell specialists using the header that the file has been disinfected, but they may not note the bad sector, which is clearly visible to the observer.

“For most clients, we focus on practicality,” notes the company's vice president. “We ask what they need to get and test the files if they ask for it. If it turns out that we cannot restore the directory structure, we we have to do this using the file header. This is like a “raw” recovery, where we do not get file names. We will pull out the data, and we will get even more than people expect, since we can also restore it. deleted information. Sometimes we see that the FAT table is completely damaged, and then we have to proceed with this type of recovery."

SSD Recovery | What's more important?

In one of the articles about data recovery, one of the readers noted in the comments that essentially anyone could get into this business and that Flashback operates on a different level compared to more well-known services. Proof of this fact can be found in the results and client list, which includes a wide range of commercial and government organizations.

According to Chozik, Flashback's leading experts have more than 15 years of experience in the data recovery industry. The company has invested hundreds and thousands of dollars in equipment and parts to carry out these processes.

“It’s very difficult to learn this business on your own,” he says. “It took years for the R&D department to reach the heights that we have achieved. Our company is not as small as it seems: we are almost 465 square meters in size, and We have a high level of security. There is also a four-level biometric control with round-the-clock surveillance. In order to combat static, the laboratory uses a grounded floor with copper wires, so there is no risk of electrical damage. We have a special area protected by bars for storing the data that is required. used as evidence in investigations. Also special clean workstations with laminar air flow (Class 10 and Class 100 levels) are designed for hard drives. The forensic laboratory is the only private ASCLD laboratory with international accreditation (ISO 17025).

SSD Recovery | Not so small

The Flashback data recovery lab consists of three rooms. Large space The first one is filled with computers, soldering stations, devices for restoration, visualization and firmware. There are also servers for storing data and similar tasks. There are thousands of hard drives in another room, different versions firmware and a lot of the most different devices in case you need a printed circuit board, internal read/write heads or anything else. It is worth noting that it is really clean here and there is forced air circulation for working with hard drives.

Another level of security is maintained in the so-called forensic area, which has already been discussed, and the cage in which the relevant drives are stored is fixed to the floor and equipped with motion sensors.

But this is not the most important thing in the article: it introduces you to the processes that occur behind the scenes large companies involved in information recovery. Restoring is not just a plug-and-copy process, the amount of work seems simply prohibitive. Of course, we all hope to never become clients of such services, but if we suddenly have to use the services, then this is the data recovery process that your devices will be forced to go through.

We perform data recovery from SSDs of all brands: Kingston, OCZ, Transcend, Intel, Corsair, Silicon Power, Patriot, A-Data, Crucial, Western Digital, Samsung, Apacer, etc.

SSD ( Solid State Drive)– are high-speed NAND-based storage devices Flash memory. They have volumes and speeds similar in value to HDDs, but do not have mechanical parts, which allows them to easily withstand various external physical influences, such as vibrations, shocks, falls, etc.

The structure of an SSD drive is almost identical to conventional flash drives.. It has several chips NAND Flash and a control controller. The differences are that SSDs use more fast type memory and controllers that can work with multiple memory chips in parallel.

Prices for data recovery services from SSD drives

How we recover data from SSD

1. physical damage to SSD drives. This type includes damage to interface connectors, damage to controller and memory chips, radio elements SSD boards disk and the printed circuit board as a whole due to mechanical or electrical influences.
2. logical damage to the file system of the SSD drive, erroneous deletion of information, formatting. When working with SSD drives, software glitches may occur, resulting in user data being inaccessible or damaged.
3. damage in the service area SSD information disk, used by the controller in the operation of the translation mechanism. An SSD drive contains areas that are used by the drive for official purposes. They are not involved in storing user data, but damage to the information in them leads to complete loss drive performance.

You can learn more about the equipment we use for data recovery from SSD drives by clicking on