All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 22 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 13:32 
Offline

Joined: May 28th, 2016, 9:16
Posts: 137
Location: Karlsruhe / Germany
Hey guys,

currently I have a notebook on my table. This notebook was used by an employee, that has been fired. And on his last day, he deleted (or formatted - don't know yet) the SSD. On a normal drive I would just plug the drive to my Imaging station and run R-Studio. But since it's a laptop I'm to lazy to get the disk out of the machine to plug it to PC-3000. So the question is, can I just boot the laptop to linux and dd the whole SSD into a single file on my storage cluster?

Or will I miss some data because of the wear levelling or some other SSD magic?


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 13:35 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3237
Location: Chicago
D_R wrote:
Or will I miss some data because of the wear levelling or some other SSD magic?

Most likely data is gone

_________________
https://www.linkedin.com/in/artemrubtsov/


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 14:08 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1871
Location: Providence, RI
You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 15:13 
Offline

Joined: October 24th, 2009, 15:22
Posts: 587
Location: Poland
data-medics wrote:
You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over.


+1.

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 15:39 
Offline

Joined: May 28th, 2016, 9:16
Posts: 137
Location: Karlsruhe / Germany
data-medics wrote:
You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over.


I did it, but in my understanding TRIM does not erase the files from the drive. It just mark the data, that it can be overwritten. Or am I wrong?


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 16:19 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3275
Location: Massachusetts, USA
TRIM's job is to optimize the drive's performance by erasing unused space. Files marked as deleted is unused space.
Can replicate/confirm with practice SSD.

Proper way is to remove drive, set to tech mode and clone.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 16:21 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1871
Location: Providence, RI
D_R wrote:
Or am I wrong?


Yes, you are. T.R.I.M. is a system in which the OS tells the SSD ranges of sectors where files have been deleted. The SSD then zero fills the sectors during idle periods to prepare the way for new data. It's a system built to overcome the inherent limitation of NAND flash having only the ability to write individual ones, but not individual zeros. So it's got to wipe entire pages and re-write the data to prepare sectors for new data.

Usually it all happens within a few minutes. So unless the SSD was powered off right after the data was deleted, it's gone forever.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 16:25 
Offline

Joined: May 28th, 2016, 9:16
Posts: 137
Location: Karlsruhe / Germany
data-medics wrote:
The SSD then zero fills the sectors during idle periods to prepare the way for new data.

Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster.


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 16:58 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 11026
Location: Australia
D_R wrote:
data-medics wrote:
The SSD then zero fills the sectors during idle periods to prepare the way for new data.

Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster.

I would think that the trimmed blocks would be erased rather than overwritten.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 17:30 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1871
Location: Providence, RI
D_R wrote:
Because then you double the count of write cycles and the SSD wears out much faster.


What you're not understanding is, it always has to be zeroed out before it can be re-written because it CAN'T WRITE INDIVIDUAL ZEROS, only ONES!!! So to change any bit to a zero, the whole block must be erased. SSDs can only function this way, it's a limitation of the technology. The point of T.R.I.M. is to do this preparation during idle times and not when you actually need the writes to happen.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 18:21 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
labtech wrote:

Proper way is to remove drive, set to tech mode and clone.



Supposing the drive was removed, and connected to a machine/appliance with TRIM disabled, would tech mode still be necessary ? Or, what is the reason for tech mode ? Just to prevent TRIM from running ?


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 16th, 2018, 21:27 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3275
Location: Massachusetts, USA
Preventing trim from running.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 17th, 2018, 9:38 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3237
Location: Chicago
D_R wrote:
data-medics wrote:
The SSD then zero fills the sectors during idle periods to prepare the way for new data.

Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster.

The drive does not really write zeros it marks the blocks as "free" and when you try to read it drive checks if such a block is free and returns zeros instead of actual data.
Meanwhile a process inside an SSD called Garbage Collector erases all the blocks marked as "free"

_________________
https://www.linkedin.com/in/artemrubtsov/


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 6:51 
Offline

Joined: May 28th, 2016, 9:16
Posts: 137
Location: Karlsruhe / Germany
Doomer wrote:
The drive does not really write zeros it marks the blocks as "free" and when you try to read it drive checks if such a block is free and returns zeros instead of actual data.
Meanwhile a process inside an SSD called Garbage Collector erases all the blocks marked as "free"


Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random.


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 8:04 
Offline

Joined: December 6th, 2012, 8:49
Posts: 207
Location: españa
D_R wrote:
Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random.
This is currently an interesting topic of discussion.....

In the case of bitlocker, there would be no problem. Bitlocker, unlike TrueCrypt, supports TRIM and would leave empty parts unencrypted. It improves performance and prevents degradation over time, but has other problems.


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 11:56 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3237
Location: Chicago
D_R wrote:
Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random.

the drive does not know it is encrypted by Bitlocker, it works on LBA level which is lower level comparing to BitLocker. OS (Windows) commands the TRIM feature to do the job when you delete a file or format a drive.
When TRIM works on Bitlocker-encrypted drives you will see patches of zeros inside. If you don't see many sectors filled with zeros then TRIM didn't work and your data is still there

_________________
https://www.linkedin.com/in/artemrubtsov/


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 12:10 
Offline

Joined: December 6th, 2012, 8:49
Posts: 207
Location: españa
Currently in the SSD sector is a jungle, a real war between the different manufacturers to impose their standards and get their market share...

This results in a multitude of combinations (controller/Firmware/PCB/NANDFlash...) and a certain level of "incompatibilities".

TTRIM was created to improve NAND Flash writing performance and yet (depending on the combination of software and/or SSD driver) it can cause the disc to have poor writing performance and premature wear.....

For example, an SSD with bitlocker (to follow this theme) has the same write performance on a SSD with SANDFORCE controller as on a Samsung SSD (for example)?


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 12:45 
Offline

Joined: May 28th, 2016, 9:16
Posts: 137
Location: Karlsruhe / Germany
Ok, a little update. I decrypted the Bitlocker partition and was able to access the data. I scanned the Image for deleted Files with R-Studio and saw the deleted files. Then I tried to get the data, but most of the files are damaged. I have no zeros in the Data but something what looks like random data in combination with real data. For example I have no Word header but some readable text in the file.

Does anyone has any idea? Why can I still see the File Structure but the data is cactus?


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 18:12 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
Maybe just a theory, but :

Deleted files were marked in the MFT as deleted, but that changed only the relevant flags in MFT.

The sectors, in turn, were reused by the normal working of the OS / the drive, and so have wrong content in them. Something similar to a disk that was formatted and had windows reinstalled in it.


Top
 Profile  
 
 Post subject: Re: Best Way to recover deleted SSD
PostPosted: July 19th, 2018, 19:01 
Offline

Joined: December 6th, 2012, 8:49
Posts: 207
Location: españa
rogfanther wrote:
Maybe just a theory, but :

Deleted files were marked in the MFT as deleted, but that changed only the relevant flags in MFT.

The sectors, in turn, were reused by the normal working of the OS / the drive, and so have wrong content in them. Something similar to a disk that was formatted and had windows reinstalled in it.
In SSD (better said, in NAND Flash) it is a little more complex than that, there are more factors involved.

To write/modify a memory block in NAND Flash (with or without TRIM), it must be "empty" if it has valid previous data, first read the data from the block, transfer it to a buffer, make the necessary changes to the data, initialize the block (erase it) and then write the new data to the NAND Flash block from the buffer.......

In addition to this, the algorithms of the different controllers that can also modify the data (compress them) would also come into play.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 22 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot], oyovera and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group