Don't get trapped in solid state

Solid state disks can be a real headache when it comes to data recovery, warns Robert Winter

Slowly but surely, a major transition is taking place in the realm of data storage. While hard disk drives (HDDs) will continue to be the mainstay of storage for the next few years at least, solid state drives (SSDs), where data is stored on memory chips, are becoming increasingly popular in both the consumer and enterprise worlds. SSD costs continue to decrease while capacity grows - so it is certain that SSDs will become ever more popular as a storage medium over the coming years.

However, there remains an issue with SSDs that users often appreciate only when it’s too late, and that is the problem of data recovery. While SSDs are physically more robust than HDDs, there is still a wide range of scenarios that can lead to data becoming lost or inaccessible. The processes and methods required to recover data from traditional hard drives are complex but well established, but this is not the case with SSD.

Since they are based on relatively new technology, it is not widely understood how SSDs work. The way they store data creates a set of unique challenges for anyone attempting a data recovery. There are also issues of proprietary designs and standards that further complicate the job of data recovery.

Most SSDs comprise flash memory chips and a flash controller chip, an extremely complex microprocessor that manages how data flows in and out of the device and how data is written to the flash chips. If the flash controller chip becomes inoperable, the only way to recover the data is to remove the flash memory chips and attempt a raw extraction. This is a technical and time-consuming task requiring specialised tools and expertise.

Furthermore, due to the proprietary nature of controller chip design, the extracted chips cannot be reattached to a similar flash memory device. Even devices made by the same manufacturer may incorporate a wide variety of data communication and data management protocols. Data recovery engineers have to work the flash memory chips with specialised equipment and custom software if they are to gain access to the data.

The next challenge of the data recovery effort is to organise the extracted data. HDDs store data in a linear fashion, with available space starting at the outer edge of the platters and moving in concentric circles toward the centre. Flash memory storage is much more dynamic, because if a block of memory cells is constantly written to, it will quickly wear out.

To manage the endurance of flash, a process called wear levelling is used by the controller chip. This process equalises the number of times to which specific areas are written and manages the frequency of writing to any specific group of flash cells. For example, if a file has been copied to the SSD and has not been changed or moved for a specified period of time, the flash controller will reprogramme another area of the flash memory array with the data. It will then erase-function the original area, freeing those electrons and preventing the cells from stagnating. The data on any flash storage device is moving constantly, even if the user copies files to another folder on the device.

Where the flash controller chip is no longer managing the data, wear levelling creates complex challenges. And if the flash device has two or more flash memory chips, the data may be distributed between chips to improve performance.

Finally, some manufacturers divide areas of each chip into regions and organise them into groups for multi-operational microprocessors, with all this data held together by the flash translation layer (FTL). However, not all manufacturers make devices with the same data layout, FTL or wear-levelling processes. Designs within a product line can change very quickly.

And of course, if the methods employed for encryption are just as device exclusive, complex, and in flux as the data management schemes, recovery of critical data may be impossible. So think very hard before deploying SSD as primary data storage. Efforts are being made to iron out some of the issues created by proprietary technologies, but it seems likely that data recovery from SSD will remain tricky for some time.

Robert Winter is chief engineer at Kroll Ontrack