| HDD GURU FORUMS http://forum.hddguru.com/ |
|
| Best Way to recover deleted SSD http://forum.hddguru.com/viewtopic.php?f=10&t=37096 |
Page 1 of 2 |
| Author: | D_R [ July 16th, 2018, 13:32 ] |
| Post subject: | Best Way to recover deleted SSD |
Hey guys, currently I have a notebook on my table. This notebook was used by an employee, that has been fired. And on his last day, he deleted (or formatted - don't know yet) the SSD. On a normal drive I would just plug the drive to my Imaging station and run R-Studio. But since it's a laptop I'm to lazy to get the disk out of the machine to plug it to PC-3000. So the question is, can I just boot the laptop to linux and dd the whole SSD into a single file on my storage cluster? Or will I miss some data because of the wear levelling or some other SSD magic? |
|
| Author: | Doomer [ July 16th, 2018, 13:35 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: Or will I miss some data because of the wear levelling or some other SSD magic? Most likely data is gone |
|
| Author: | data-medics [ July 16th, 2018, 14:08 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over. |
|
| Author: | arvika [ July 16th, 2018, 15:13 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
data-medics wrote: You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over. +1. |
|
| Author: | D_R [ July 16th, 2018, 15:39 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
data-medics wrote: You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over. I did it, but in my understanding TRIM does not erase the files from the drive. It just mark the data, that it can be overwritten. Or am I wrong? |
|
| Author: | labtech [ July 16th, 2018, 16:19 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
TRIM's job is to optimize the drive's performance by erasing unused space. Files marked as deleted is unused space. Can replicate/confirm with practice SSD. Proper way is to remove drive, set to tech mode and clone. |
|
| Author: | data-medics [ July 16th, 2018, 16:21 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: Or am I wrong? Yes, you are. T.R.I.M. is a system in which the OS tells the SSD ranges of sectors where files have been deleted. The SSD then zero fills the sectors during idle periods to prepare the way for new data. It's a system built to overcome the inherent limitation of NAND flash having only the ability to write individual ones, but not individual zeros. So it's got to wipe entire pages and re-write the data to prepare sectors for new data. Usually it all happens within a few minutes. So unless the SSD was powered off right after the data was deleted, it's gone forever. |
|
| Author: | D_R [ July 16th, 2018, 16:25 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
data-medics wrote: The SSD then zero fills the sectors during idle periods to prepare the way for new data. Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster. |
|
| Author: | fzabkar [ July 16th, 2018, 16:58 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: data-medics wrote: The SSD then zero fills the sectors during idle periods to prepare the way for new data. Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster. I would think that the trimmed blocks would be erased rather than overwritten. |
|
| Author: | data-medics [ July 16th, 2018, 17:30 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: Because then you double the count of write cycles and the SSD wears out much faster. What you're not understanding is, it always has to be zeroed out before it can be re-written because it CAN'T WRITE INDIVIDUAL ZEROS, only ONES!!! So to change any bit to a zero, the whole block must be erased. SSDs can only function this way, it's a limitation of the technology. The point of T.R.I.M. is to do this preparation during idle times and not when you actually need the writes to happen. |
|
| Author: | rogfanther [ July 16th, 2018, 18:21 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
labtech wrote: Proper way is to remove drive, set to tech mode and clone. Supposing the drive was removed, and connected to a machine/appliance with TRIM disabled, would tech mode still be necessary ? Or, what is the reason for tech mode ? Just to prevent TRIM from running ? |
|
| Author: | labtech [ July 16th, 2018, 21:27 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
Preventing trim from running. |
|
| Author: | Doomer [ July 17th, 2018, 9:38 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: data-medics wrote: The SSD then zero fills the sectors during idle periods to prepare the way for new data. Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster. The drive does not really write zeros it marks the blocks as "free" and when you try to read it drive checks if such a block is free and returns zeros instead of actual data. Meanwhile a process inside an SSD called Garbage Collector erases all the blocks marked as "free" |
|
| Author: | D_R [ July 19th, 2018, 6:51 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
Doomer wrote: The drive does not really write zeros it marks the blocks as "free" and when you try to read it drive checks if such a block is free and returns zeros instead of actual data. Meanwhile a process inside an SSD called Garbage Collector erases all the blocks marked as "free" Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random. |
|
| Author: | colanco [ July 19th, 2018, 8:04 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random. This is currently an interesting topic of discussion.....In the case of bitlocker, there would be no problem. Bitlocker, unlike TrueCrypt, supports TRIM and would leave empty parts unencrypted. It improves performance and prevents degradation over time, but has other problems. |
|
| Author: | Doomer [ July 19th, 2018, 11:56 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
D_R wrote: Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random. the drive does not know it is encrypted by Bitlocker, it works on LBA level which is lower level comparing to BitLocker. OS (Windows) commands the TRIM feature to do the job when you delete a file or format a drive. When TRIM works on Bitlocker-encrypted drives you will see patches of zeros inside. If you don't see many sectors filled with zeros then TRIM didn't work and your data is still there |
|
| Author: | colanco [ July 19th, 2018, 12:10 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
Currently in the SSD sector is a jungle, a real war between the different manufacturers to impose their standards and get their market share... This results in a multitude of combinations (controller/Firmware/PCB/NANDFlash...) and a certain level of "incompatibilities". TTRIM was created to improve NAND Flash writing performance and yet (depending on the combination of software and/or SSD driver) it can cause the disc to have poor writing performance and premature wear..... For example, an SSD with bitlocker (to follow this theme) has the same write performance on a SSD with SANDFORCE controller as on a Samsung SSD (for example)? |
|
| Author: | D_R [ July 19th, 2018, 12:45 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
Ok, a little update. I decrypted the Bitlocker partition and was able to access the data. I scanned the Image for deleted Files with R-Studio and saw the deleted files. Then I tried to get the data, but most of the files are damaged. I have no zeros in the Data but something what looks like random data in combination with real data. For example I have no Word header but some readable text in the file. Does anyone has any idea? Why can I still see the File Structure but the data is cactus? |
|
| Author: | rogfanther [ July 19th, 2018, 18:12 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
Maybe just a theory, but : Deleted files were marked in the MFT as deleted, but that changed only the relevant flags in MFT. The sectors, in turn, were reused by the normal working of the OS / the drive, and so have wrong content in them. Something similar to a disk that was formatted and had windows reinstalled in it. |
|
| Author: | colanco [ July 19th, 2018, 19:01 ] |
| Post subject: | Re: Best Way to recover deleted SSD |
rogfanther wrote: Maybe just a theory, but : In SSD (better said, in NAND Flash) it is a little more complex than that, there are more factors involved.Deleted files were marked in the MFT as deleted, but that changed only the relevant flags in MFT. The sectors, in turn, were reused by the normal working of the OS / the drive, and so have wrong content in them. Something similar to a disk that was formatted and had windows reinstalled in it. To write/modify a memory block in NAND Flash (with or without TRIM), it must be "empty" if it has valid previous data, first read the data from the block, transfer it to a buffer, make the necessary changes to the data, initialize the block (erase it) and then write the new data to the NAND Flash block from the buffer....... In addition to this, the algorithms of the different controllers that can also modify the data (compress them) would also come into play. |
|
| Page 1 of 2 | All times are UTC - 5 hours [ DST ] |
| Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group http://www.phpbb.com/ |
|