Solid-state drives speed past data recovery techniques

Solid-state disk drives are fast, use little power, get cheaper almost every day and are winning friends among all the big storage vendors. But the disks may also make it harder to use the last line of defence: data recovery. Simon Sharwood reports on the (mostly) upsides and downsides of data recovery using solid-state drives.

If you’re looking for a tiny upside in Queensland’s floods, you may, perhaps, find it in the fact that the floodwaters that inundated so many homes and businesses were fresh.

You can be a tiny bit optimistic about this fact because, according to forensics specialists, a hard disk that has been exposed to fresh water is a little easier to work with than one that has been dunked in the briny waters of an ocean or estuary. Salt, they explain, does a lot of damage in a hurry to the sensitive, ferrous media that coat a disk’s surface. Recovering data from a disk damaged in such a way, they lament, is near impossible.

Fresh water is less reactive and therefore a little kinder to disks and the data they store.

That fact is important to data recovery specialists who have an impressive array of tricks they use to restore data from disks that are broken, damaged, overwritten, have suffered file system corruption or have suffered accidental erasure. ‘Bit rot’, a phenomenon whereby the value of some very small areas on a disk’s surface change and corrupt data, is another scenario familiar to recovery experts.

Data recovery specialists bring their expertise to bear inside specialised laboratories that are generally sealed to near-surgical standards of cleanliness to ensure dust and other contaminants do not land on a disk’s surface. Recovery specialists are entirely happy prising open disks to remove their platters from the spindle. Most maintain rigs of various sorts that allow them to mount platters on a working spindle and then spin them up again so they can once again be read. Specialist software that can detect and rebuild data, even if segments of a file have been destroyed, is another tool in a recovery specialist’s kit-bag.

Voice+Data has had personal experience of these services, and the results were outstanding. A drive we relied on experienced a physical failure, and the recovery firm we worked with first produced a complete recovery of all the data it contained ... before it was last reformatted! Once we pointed out that newer data had since been written to the disk, it too was recovered.

Data recovery specialists can also discern data on disks that have experienced very heavy physical damage, or even immersion in water.

Tapes can also get the data recovery treatment, and Australia has one of the world’s leading practitioners of this art in the form of Perth’s Spectrum Data. The company specialises in recovering data from tapes recorded in the age of the mainframe or mini-computer, and has evolved many ways to combat ‘stiction’, a term it has devised to describe the mixture of stickiness and friction that old tapes display as their magnetic coating starts to flake off the underlying plastic tape. This degradation means old tape coats the heads of tape drives in fine gunk that impairs their effectiveness.

Spectrum therefore ‘exercises’ tapes as a first step to recovery, then tries to read tapes by playing them at different speeds or on different tape drives. Sometimes data can be restored by playing a tape at a slightly different angle across a drive’s heads, a feat that’s conceivable on older, reel-to-reel drives.

Expect to pay many hundreds of dollars to secure a recovery specialist’s services for even a single disk. Consumers find those sums a stretch when the family PC dies, along with years of holiday photos. But enterprises can sometimes find the fees more affordable, especially when business-critical data is at stake.

Many storage administrators therefore take comfort in the fact that, should they make an error or their storage equipment suffer significant damage, data recovery is a very effective last line of defence.

Solid-state disks

Such tricks are not in any way possible with the latest addition to the storage bestiary: solid-state disks (SSDs).

SSDs are making waves because they are small, cool (literally), fast and use little electricity. Those four qualities contrast impressively with conventional disk drives. With demand for storage increasing inexorably, but enterprises’ desire for large data centres and for smaller electricity bills, SSDs are a welcome innovation.

While some argue that SSDs already offer superior price-per-input/output, the disks cannot yet compete with their conventional cousins on price per gigabyte. But SSDs compare very favourably to the kind of fibre channel and other exotic disks that enterprises use for storage of critical data that needs all the speed it can get.

SSDs are therefore a hot item, and major storage vendors are falling over each other in a rush to prove that they can use SSDs in their arrays to feed more data, faster, to applications and end users.

Another selling point for SSDs is that they lack any moving parts, a quality that makes them very reliable.

But data recovery experts report solid-state hard drives can and do fail, and that when they do fail the tricks they use to restore data from spinning magnetic disks don’t work on the new generation of all-silicon drives. Indeed, recovery experts to whom Voice+Data spoke rate SSDs harder to work with than their magnetic cousins.

“We have had a few of them and they are much harder to recover data from,” says Jason Curtis, a Senior Lab Technician at CBL Data Recovery.

Curtis believes wear-levelling algorithms are responsible. These algorithms were developed because solid-state disks have a finite life due to the construction of the drives, which comprise NAND and NOR gates. These silicon circuits are used to store data, and each one can only be written to a certain number of times before it becomes unusable. Wear-levelling algorithms keep track of which gates have been written to and share the load around to prevent early burnout of a group of gates.

“The algorithms are a bit like RAID: they spread data across different chips,” Curtis says. “Once data is spread over more than four chips in the disk, it gets very hard to recover.”

SSD vendors don’t help either. Curtis says, “The algorithms are proprietary so we have to reverse engineer them,” in any attempt to receive data. This process does not always work, because the wear-levelling algorithms are not easy to reverse-engineer.

Another data recovery expert, Ari Raymond, the owner and Senior Data Recovery Technician at Total Data Recall, says he has had some success working with flash memory sourced from USB drives.

“We handle USB flash drives at component level,” he explains. “We pull the memory chip off the board and then read the chips separately. Each drive manufacturer has its own controller and we mimic the controller.”

Raymond has not, however, seen more than a handful of enterprise-class SSDs. Of those he has seen, he says controller damage has been the dominant problem.

“They just were not reading data from the hard drive or had bad solder joins,” he says. The latter problem can sometimes be fixed with special heating equipment that makes it possible to warm solder so that chips can be removed or joins restored.

CBL’s Curtis reports other issues.

“We’ve seen electrical problems,” he says. “You can have surges through them. Lightning strikes, faulty power supplies and faulty connections are other issues. If we can detect the drive, it is usually okay. But physical failures are hard: even the company that made the drive cannot restore data when that happens.”

How often do disks fail?

Disk drives are very reliable machines: most advertise a mean time between failure (MTBF) in the millions of hours.

MTBF has been the disk industry’s preferred longevity metric for many years, but vendors are now diverging. Seagate, for example, prefers annualised failure rate (AFR), a measure of how many drives in a population will fail during a year. Western Digital has dabbled with ‘load/unload cycles’, a measure of how many times a disk readies itself for action and then rests while waiting for further instructions