Micron RealSSD C400 mSATA 128 GB SSD MTFDDAT128MAM-1J1

[czarnuch]

Hi

It is my first on forum, so please be kind
I am about to start DR of HP Folio with mentined Micron SSD in it. Client erased data by restoring "falling" Windows to factory defaults via HP recovery tools. I am assuming (statisticaly) that most of data should remain at it's place not overwritten (correct me if I am wrong). Because client refuses to open machine I am trying write SSD image on external storage. I managed to create image of the drive (dd over ssh). But after image scan I saw filenames but data itself seems to be broken (almost all of it). So I attached HDD via USB and made second attempt to create second image. Strange is that it was also dd image but it is bit smaller (??). Scans from that image also gives me files with names but with corrupted data. I am missing somthing or there is someking hypervision in HP Folio prevents from creating image? Do you got any ideas what I am missing?
SMART is not showing anything interesting (no bad blocks, etc.)

Thanks
Pawel

[czarnuch]

Yes. I used R-Studio build in file type signatures (Known File Types). The problem is that I am able to see file (to be precise filename) i R-Studio but after recovery files are not readable

Regards
Pawel

[czarnuch]

Any ideas? Somebody was dealing with that disk? Does anybody achived to create proper image from Micron drive?

[Vulcan]

Your story is missing the exact procedures and commands which were used, which could help to explain the 2 slightly different image sizes.

I don't have time to try clarifying your situation at the moment. However my overall opinion (based on the incomplete story, and so this might be wrong) is that you are asking the wrong question, by asking whether someone has dealt with that SSD. This is more of a filesystem-related issue IMHO.

An expert using WinHex (or similar) with the drive (or image) in front of him, looking at the MFT and user data in that filesystem, would be able to understand the situation better. Readers here don't have the drive (or image) to look at...

[hddguy]

Hi

I am assuming (statisticaly) that most of data should remain at it's place not overwritten (correct me if I am wrong).

This is often the case with traditional HDD, but traditional HDD do not operate with wear leveling, garbage collection, TRIM etc

the more the SSD is accessed, the more chance the SSD will implement some level of relocating blocks/pages rendering your erased data unrecoverable.

[Vulcan]

Very good point hddguy, I hadn't considered TRIM (as the OP didn't mention Win7/8 but I should have guessed that). Of course normal wear-leveling (static or dynamic) doesn't affect data recovery unless TRIM is used by the OS since without TRIM, the SSD doesn't know which data is deleted on the filesystem, and hence still keeps (and moves during any wear-leveling) the blocks containing deleted files.

[czarnuch]

Hi

I decided to boot from disk (yes, I should not but don't punish me ) and check if TRIM is enabled by Windows 7. After "fsutil behavior query DisableDeleteNotify" it gave me that it is enabled. Correct me if I am wront, but and that point all data was lost due to TRIM functionality?
Is there any other way? Force SSD controler to give me data, etc.

[czarnuch]

BTW. Is there any good source to impoorve my skills in the subject (SSD)? There are a lot of "home made masters" who can misslead in the learning.

[arvika]

It looks like software issue. In software layer, not phisical. Client overwriten some data, probably with MFT. Recovery - if it possible - can be make only by sewrch by header. Directory structure probably was destroyed.

[czarnuch]

He he.
Yes you are right