Armand

Recovering Files From Broken SSD

Recommended Posts

Kind of depends on what you mean by broken.

Broken as in the SSD is physically damage. Say for example, the video where the SSD was hit by a golf club and the SSD was broken into pieces. Is there still a way to retrieve the data with this kind of damage?

Share this post


Link to post
Share on other sites

Broken as in the SSD is physically damage. Say for example, the video where the SSD was hit by a golf club and the SSD was broken into pieces. Is there still a way to retrieve the data with this kind of damage?

Only if you have millions of dollars in equipment and staff (like say the NSA) would you even consider trying.

This probably goes back to that old meme: If it isn't backed up, it doesn't exist.

Share this post


Link to post
Share on other sites

Is there a way to recover files from a broken SSD? Until what state does an SSD should be for the files to be recovered?

Probably not. Maybe if you are very skilled at putting it back together...on second thought, I doubt it. The best thing to prevent data loss is to make sure you back things up.

Share this post


Link to post
Share on other sites

Not at home in your basement, no. Maybe professional data recovery companies could set up some custom circuitry to interface directly with the pins on the NAND chips themselves, if the SSD circuit board is broken. But it would be much more expensive than recovery of data from hard disk platters, since it would be a more painstaking process, that would have to be tailored to each SSD model. And if a NAND chip is broken, there's no chance of recovering the data IMO. Unless someone develops a way to determine the state of a NAND cell by some external means (like x-raying it, but it would have to determine the charge stored in each cell - very tricky, probably impossible with current or near future technology).

This is all speculation, however. For all I know, you could just solder the NAND chips to the circuit board of the same model of SSD and it would all magically work. But I doubt it's that easy.

Share this post


Link to post
Share on other sites

If all the individual NAND chips still work, it's possible. I believe equipment to recover individual NAND flash chips has already existed on the (professional) market for a while. Or you could make a NAND chip reader yourself if you have the necessary skills and resources. It would require desoldering all NAND chips from the PCB and extracting all the raw data with the chip reader. However, a successful recovery of all user data on an SSD would depend on the following factors:

  • Detailed knowledge of the inner workings of the SSD controller (this may not be necessary if recovery of a particular SSD design is already supported in a commercial recovery solution). You'll probably not get this information from the manufacturer unless you are a large respectable company and sign the necessary NDAs. Then your only option is reverse engineering.
  • A successful recovery of all metadata on the SSD. This is important since the data will be scattered in seemingly random order due to the wear-leveling mechanism. Without the metadata that contains the block address mapping tables it will be impossible to reconstruct the data.

In the end this will probably not be feasible for the typical hardware hacker in the home basement, but I'm sure the leading recovery companies have already developed/acquired (or are in the process of developing/acquiring) the knowledge, skills and equipment to do these types of recoveries. But again, it all depends on the state of the individual NAND chips and if the metadata is recoverable.

Edited by Florz

Share this post


Link to post
Share on other sites

If all the individual NAND chips still work, it's possible. I believe equipment to recover individual NAND flash chips has already existed on the (professional) market for a while. Or you could make a NAND chip reader yourself if you have the necessary skills and resources. It would require desoldering all NAND chips from the PCB and extracting all the raw data with the chip reader. However, a successful recovery of all user data on an SSD would depend on the following factors:

  • Detailed knowledge of the inner workings of the SSD controller (this may not be necessary if recovery of a particular SSD design is already supported in a commercial recovery solution). You'll probably not get this information from the manufacturer unless you are a large respectable company and sign the necessary NDAs. Then your only option is reverse engineering.
  • A successful recovery of all metadata on the SSD. This is important since the data will be scattered in seemingly random order due to the wear-leveling mechanism. Without the metadata that contains the block address mapping tables it will be impossible to reconstruct the data.

In the end this will probably not be feasible for the typical hardware hacker in the home basement, but I'm sure the leading recovery companies have already developed/acquired (or are in the process of developing/acquiring) the knowledge, skills and equipment to do these types of recoveries. But again, it all depends on the state of the individual NAND chips and if the metadata is recoverable.

That's the answer - as long as the actual NAND chips are intact the data stays on them, but getting it off will be rather difficult.

On that note... there was a documentary on some plane crash a few years ago... so this is older than 5 years definitely - it was old too I think, so might actually be older still, but I wouldn't bet on it.

In that case they had the flash memory from the voice recorder which kept the last few minutes of conversation - well, that meant getting the data of flash modules... and it worked.

So it is possible - but you can't do it yourself - on that note though: You cannot repair a broken HDD yourself either.

Share this post


Link to post
Share on other sites

One interesting point I failed to mention in my discussion above, is that SandForce SSD controllers include SandForce's RAID-like technology called RAISE (Redundant Array of Independent Silicon Elements). In theory, one should be able to recover all data even if one of the NAND flash chips is damaged. A SandForce based SSD may even continue to work with one failed NAND chip, if we are to believe the marketing hype.

In addition to RAISE, SandForce controllers also employ technologies like deduplication/compression and AES-128 encryption. Various SSD manufacturers may also use customized firmwares with their own unique feature set. All these technologies and features add to the complexity of the recovery process. The raw data contained in a single NAND chip may appear to be completely random. You'll need a software tool that, in effect, emulates the particular SSD controller and firmware in order to extract the user data from the raw data.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now