Repairing SSD bad sectors or recovering SSD bad sector data

[HDDWizard]

I don't want to go on a long-winded explanation of what led to this topic. I'll just say I have a company SSD drive. It's encrypted with PGP Whole Disk Encryption. I cannot send it in to a data recovery service and my company's IT said they cannot send it in, either. I'm sure they wouldn't mind but it's out of their control (read: above their pay grade; budget and business logistics). They are allowing me to recover my data and give it back when I'm done.

The SSD drive does not boot into its only OS, Windows XP SP3 32-bit. It definitely has logical errors. I imaged the drive with Clonezilla, with -q1 and -rescue options checked, to skip bad sectors. Clonezilla reported that the drive was physically damaged and I had no choice but to use the -rescue option.

Before I securely erase the drive and give it back to my company's IT, I want to get the possible clone.

Are there any free or paid tools which can repair SSD bad sectors or, somehow, read the data in these bad sectors during a clone/image/recovery process?

As an aside, I understand that there are professional tools or methods which can even recover critical data from bad sectors for things like court, DOJ, NSA, FBI, CIA, and the like, where every piece of data is essential. How do these data recovery services read even the data in bad sectors? Is it software and/or hardware tools? Or, the only to physically repair or retrieve data in bad sectors is to repair the drive in a clean room?

Thank you.

[HaQue]

SSD drives do not need a Clean Room, just a clean room.

SSD drives don't get bad sectors either, they have no physical sectors. They have Blocks, and they get bad blocks, and pages of data. To recover data, common method is to de-solder all the NAND chips, read them in a reader, and use software to reconstruct th data in relation to what the controller did. Wear levelling algorithms and bad block management are a couple of the technologies you have to deal with. Some are further complicated by other things such as proprietary technology that "no-one" else is privvy to, XORing the data and/or service area etc etc. if a NAND has some bad blocks, then it is possible that nothing will ever read those blocks.

If the drive is failing, then you might get your data back, but the drive will be toast. A regular filesystem might be easily recoverable, as you can often afford to live with a few dead files due to bad blocks or whatever the result of the coniption the controller had ... but encrypted partitions usually need the whole thing sound and thats a much biger challenge.

Did you manage to get an image?

Is it a true SSD or a HYbrid.

I confess i am not sure your nick is descriptive, and I wonder why they will let you try and get your data back, but not send to a DR company that would have more stringent privacy procedures in place than an individual.

[HDDWizard]

SSD drives do not need a Clean Room, just a clean room.

SSD drives don't get bad sectors either, they have no physical sectors. They have Blocks, and they get bad blocks, and pages of data. To recover data, common method is to de-solder all the NAND chips, read them in a reader, and use software to reconstruct th data in relation to what the controller did. Wear levelling algorithms and bad block management are a couple of the technologies you have to deal with. Some are further complicated by other things such as proprietary technology that "no-one" else is privvy to, XORing the data and/or service area etc etc. if a NAND has some bad blocks, then it is possible that nothing will ever read those blocks.

If the drive is failing, then you might get your data back, but the drive will be toast. A regular filesystem might be easily recoverable, as you can often afford to live with a few dead files due to bad blocks or whatever the result of the coniption the controller had ... but encrypted partitions usually need the whole thing sound and thats a much biger challenge.

Did you manage to get an image?

Is it a true SSD or a HYbrid.

I confess i am not sure your nick is descriptive, and I wonder why they will let you try and get your data back, but not send to a DR company that would have more stringent privacy procedures in place than an individual.

Thank you for your detailed response!

It's pretty simple, actually; the company doesn't want to pay to recover my data. It is not essential for them. I am but one in cog in a rather giant corporation. If I were part of the executive branch of the company, I'm willing to bet I can work it out with IT to send the drive out. I know IT would like to help me out but these things have to go through an approval process above them and I'm just not important enough.

I asked IT to let me try and recover my data. They have a million other things to do and don't have the time or resources to tediously recover my data. They are willing to try but I have witnessed horror stories in my company of laptops and hard drives returned without the person's data recovered or backed up. I also have some sensitive data on there and I don't know who's looking at it or what they will do with it. If I am unable to recover anything, I would consider them taking a look at it and weigh the risks.

It's a true SSD.

I did get a clone of it with Clonezilla (used the rescue option which ignored bad sectors). I then made an image from the clone. And then I decrypted the clone and made an image again. So, I have an encrypted image and a decrypted image. Then I restored the decrypted image on a clean healthy drive. I am running an R-Studio scan on it, at the moment, and the results are very promising and it looks like I will get at least some of the data back.

But I wanted to image the original drive with a different program that might be able to read the bad sectors. I heard GNU dd_rescue is a good choice and, while there appears to be imaging/cloning tools for damaged drives that are as good as GNU dd_rescue, I haven't found any evidence that there are tools superior to it for imaging/cloning with reading bad sectors, save for whatever professional data recovery services employ. But I could be wrong.

Your explanation of SSDs is extremely insightful. I sure appreciate it.

It sounds like what you're saying, with respect to SSDs, bad blocks cannot be repaired and data cannot be recovered from these bad blocks using software tools. Am I correct on that? If so, it sounds like using GNU dd_rescue to read the bad blocks won't have any success. So, tools like HDD Regenerator, SpinRite, Veronica, MHDD..none of them will work on SSDs?

What I do know is that this SSD may not have had TRIM equipped. Even if it did, it's a moot point. From what I read, an encrypted drive essentially disables TRIM and the OS is Windows XP, which doesn't support TRIM. I imagine that can only help my chances in recovering data.

Thank you.

[HaQue]

would have thought if you were able to decrypt the image, then you shouldnt have lost anything. I am thinking similar to a corrupt zip file. I will admit that I dont deal with encryption in relation to recovering data, so I might be assuming things that arent true.

Bad blocks are usually managed quite well by the controller firmware, so you shouldnt have to worry about them. Even if there were data in them, you arent going to do much with it.

Your images you have are logical. these in no way shape or form are anywhere near close to a physical dump(image I guess) of the chips. There is likely 16 or so chips, each with 1 - 4 Banks, and data mix, wear levelling. Imagine getting 16 books (part odd a 16 set encyclopedia *google it young ones it is like wikipedia, but made of paper!)) Now tear the pages out and put them in a few piles, now shuffle them, now get random sentences and make a list of alternate spots on "spare" pages to replace ones that were not printed well. now you come close to what an SSD is like. Add encryption if you arent confused enough

If you can access the logical part of the disk, the physical part of the SSD itself isnt really an issue.

I would use GetDataBack, but I havent used R-Studio so I don't know the comparison.

It will be good to hear how you go, good luck !

[fzabkar]

would have thought if you were able to decrypt the image, then you shouldnt have lost anything. I am thinking similar to a corrupt zip file.

I would think that "Whole Disk Encryption" would be implemented on a sector-by-sector basis rather than file-by-file.

[HDDWizard]

would have thought if you were able to decrypt the image, then you shouldnt have lost anything. I am thinking similar to a corrupt zip file. I will admit that I dont deal with encryption in relation to recovering data, so I might be assuming things that arent true.

Bad blocks are usually managed quite well by the controller firmware, so you shouldnt have to worry about them. Even if there were data in them, you arent going to do much with it.

Your images you have are logical. these in no way shape or form are anywhere near close to a physical dump(image I guess) of the chips. There is likely 16 or so chips, each with 1 - 4 Banks, and data mix, wear levelling. Imagine getting 16 books (part odd a 16 set encyclopedia *google it young ones it is like wikipedia, but made of paper!)) Now tear the pages out and put them in a few piles, now shuffle them, now get random sentences and make a list of alternate spots on "spare" pages to replace ones that were not printed well. now you come close to what an SSD is like. Add encryption if you arent confused enough

If you can access the logical part of the disk, the physical part of the SSD itself isnt really an issue.

I would use GetDataBack, but I havent used R-Studio so I don't know the comparison.

It will be good to hear how you go, good luck !

I appreciate the lesson and knowledge transfer. Thanks for teaching this experienced dog some new tricks.

Unfortunately, the file system structure is corrupt and unreadable. Chkdsk couldn't even find the MFT to attempt repair, and this was after I authenticated the disk. As it stands, I am attempting to recover the data. But I do have a terrible feeling the SSD drive is physically damaged.

R-Studio is supposed to be very good. Some professional DR guys at another forum have recommended it for people like me, as well as GetDataBack. I'll hit the data with a few of these programs to, hopefully, get most or all of it back.

[labtech]

If you have the ability, I would suggest comparing the encrypted copy vs. decrypted copy in a hex viewer to ensure that the drive decrypted successfully. Winhex is an example.

Note: typically, IT departments do not have advanced data recovery knowledge. Typically, they have a rough understanding of file system along with a couple of software utilities used on the device to scan for data. That's about it in a nutshell. With respect to other IT areas, IT does not equal data recovery.

[HaQue]

shame that your best option, a reputable DR Firm that has SSD experience, has been ruled out.

[HDDWizard]

If you have the ability, I would suggest comparing the encrypted copy vs. decrypted copy in a hex viewer to ensure that the drive decrypted successfully. Winhex is an example.

Note: typically, IT departments do not have advanced data recovery knowledge. Typically, they have a rough understanding of file system along with a couple of software utilities used on the device to scan for data. That's about it in a nutshell. With respect to other IT areas, IT does not equal data recovery.

That's a good suggestion, thank you.

Yes, that's exactly why I didn't entrust my company's IT with this task. Even if they have the tools, they have a billion other things to do and tickets to close. They will not treat me special just because I want my data, especially since they're not getting anything extra out of it. I could see someone going the extra mile and leaving a ticket open a few weeks and devoting considerable time
to this assignment. But what I see as more likely is someone putting in some effort and realizing this is going to take way too long, it's too complex, and it's easier to just tell me they couldn't recover the data because the drive was in rough shape -- a half-truth. Those of us will have worked in IT should not be surprised. I've heard horror stories from other co-workers who had their laptops replaced and IT forgot to backup their data (luckily, some workers backup their own data).

[HDDWizard]

shame that your best option, a reputable DR Firm that has SSD experience, has been ruled out.

I work for a big company. I'm just a cog. I can guarantee you if I was a high-level manager or executive, they'd allocate budget to IT to send the drive out for repair. Or, at the very least, try to repair it themselves, however long it takes, until I can get at least some data back. Don't get me wrong. I'm not dumping on my company's IT -- or, more accurately, IT's Desktop Support division. They are good people. And they are willing to try recovering my data. But for something like this, which requires much time, resources, effort, and proper tools, I'm not confident in them. The reason I'm going through all this trouble is a) it's my data and b) when I give them back the laptop and SSD to troubleshoot, I want to my have my own image/clone I can work off of, in case they can't do anything or make it worse and lose my data.

[labtech]

b) when I give them back the laptop and SSD to troubleshoot, I want to my have my own image/clone I can work off of, in case they can't do anything or make it worse and lose my data.

Good thinking... most people do not do this.
Problem with data recovery is that likely more than 90% of the time, a successful recovery can be achieved in the first attempt. Once it goes through more than 2 set of hands and "creative brains" ( sorry, could not help it), then chances of recovery are almost nil.

[OwenFernan]

My Linux 17.1 seems to be operating so slow, the fact that it's on a 512GB Samsung 850 Pro SSD and with the rest of my laptop's good specs (16GB RAM, Intel i7) What could be the cause?

[labtech]

Flash wearing off probably OR just bug. I would back up asap before it completely becomes inaccessible.

Do you have a SMART report of the drive's current condition?