Data Recovery & Solid State 249
theoverlay writes "With all of the recent hype about solid-state drives in both consumer applications and enterprise environments I have a real concern about data recovery on these devices. I know there are services for flash memory restoration but has anyone been involved in data restoration projects on ssd drives? What are the limits and circumstances that have surfaced so far? What tools will law enforcement and government use to retrieve data for investigations and the like?"
Re:SSDs have one infallible data recovery option (Score:5, Informative)
Re:Honk! Honk! (Score:4, Informative)
Re:What is the Data recovery % for non SSD drives? (Score:2, Informative)
Backup, backup, backup. Those that don't will pay the price. Literally.
Re:Honk! Honk! (Score:5, Informative)
Re:Honk! Honk! (Score:5, Informative)
Re:Use the gForce (Score:5, Informative)
Ask Slashdot: When a slashvertisement just won't do, since you've only got yourself to sell.
Re:Honk! Honk! (Score:4, Informative)
0->0 = 0
1->1 = 1
1->0 = 0.1
0->1 = 0.9
0.9->1 = 0.99
0.9->0 = 0.09
0.09->1 = 0.909
so you can guess the sequence of transitions from the value.
I know battery-backed RAM can't be recovered that way - it's like it was constantly writing to itself, you'll have a thousand write cycles in matter of miliseconds. I don't know how data is stored in flash though.
Makes you wonder if you could quadruple the capacity of the harddrives that way too.
Re:SSDs have one infallible data recovery option (Score:5, Informative)
Re:Pointless (Score:5, Informative)
AFAIK, the only way you get data corruption in a SSD is from power fluctuations causing a bad write.
Re:Honk! Honk! (Score:4, Informative)
Re:MOD PARENT UP (not a troll) (Score:1, Informative)
The submitter wants to know what tools are available to recover data from a SSD, not how to protect data. What tools do or will law enforcement use to recover data from an SSD? Does a criminal simply need to switch to using SSD and simply erase the data, then write over the disk once more and everything is completely gone forever, no chance of recovery?
Re:Honk! Honk! (Score:5, Informative)
Here's the relevant part of new epilogue:
Quick and Most Secure Drive Erasing (Score:5, Informative)
Actually... (Score:1, Informative)
Overwriting with a single pass of /dev/urandom will only make recovery very labour intensive and hugely expensive, but not impossible.
Two wipes makes it harder still. It is a statistics game, each write makes the odds go down (and steeply at that) that the data can be recovered.
Anyway, wiping once is not enough to keep our lab from looking at your pr0n.
Re:The real danger is a loss of recovery companies (Score:3, Informative)
I have a few thoughts on this matter and will post them in point form:
1. The elimination of the clean room?
- For obvious reasons, the necessity of a clean room for solid state devices will be drastically reduced. However, due to the price and size constraints, I don't foresee the elimination of the traditional hard drive for some time to come. Of course, that could be 5 years or 15 years, depending on industry trends.
2. The stability of solid state hard drives?
- I'd say that SSHD are more stable from the perspective of being bumped around. However, a simple power surge could render the data lost forever. This is where the traditional drive has a hope. The electronics can be toast, but the data is still on the platters.
- To the most part, traditional hard drives show signs of dying before they completely crash where a SSHD is going to work or not work, with the exception of failing bits.
3. Will SSHDs be the data recovery lab killer?
- I doubt it. It is true that hardware failure is the number one reason for data loss. But, a close second is human failure and I believe that will never change. So, the SSHD may become a more stable drive, but it won't be the end of data loss. If anything at all, the SSHD technology will create more false security, making for more critical data loss.
4. Will SSHDs affect the cost of data recovery?
- I suspect that we will see three different quotes for these devices: 1. around $500, 2. around $2000 and 3. unrecoverable.
All in all, I am excited about the technology and look forward to putting my first 250GB SSHD into my MacBook Pro. But, until we see the prices drop and the capacities increase, we won't be seeing these drives in anything other than a few overpaid executive's laptops.
Re:Honk! Honk! (Score:3, Informative)
Re:Honk! Honk! (Score:2, Informative)
[Citation Needed] (Score:3, Informative)
Any ferrous material brought above the Curie Point [wikipedia.org] is no longer magnetic, and looses any magnetism it had prior to heating. You can test this yourself with a magnet, a butter knife and a blowtorch. No matter what combination of iron and impurities your drive surface has, its Curie Point is easily below the temperature of molten iron - the product of your thermite reaction.
So even if the discs were heated by thermite, rather than just plain destroyed, it's unlikely that the heating would allow any data to survive unless the iron was already pretty cold.
That said, this was a surveillance plane flying over a foreign country in a (presumably) covert fashion. If it had such a self-destruct, it would be a mil-spec component. In case of a crash, I doubt there would be much of a plane left, let alone drive platter pieces to be recovered.
Re:SSDs have one infallible data erasure option (Score:2, Informative)
We liked Sandblasting our RM05s (Score:3, Informative)
Our disk drives were RM-05s, which had stacks of a dozen or so 14" platters. Most computer administrators had one on their wall showing the effects of a head crash, with various tracks scraped into the oxide finish. I was no longer running the lab when we decommissioned the VAX, but my successor got to take the disks down to the machine shop in the basement to have them sandblasted. The platter on her wall didn't have any oxide left - it was smooth and shiny metal.
Re:Honk! Honk! (Score:5, Informative)
Re:Honk! Honk! (Score:4, Informative)
You my anonymous friend, are a no good, stinking liar. There is no software method for reading the magnetic flux levels of the bits of a hard drive as obviously the drive firmware interprets that data itself and present the 1 or 0 to you, and you do not have an ETM that can be anything like precise enough for the density of modern hard drives, and even if you did how quickly could you read the data and what could you do with it? The bits are essentially stored as analogue data so apart from what the current setting is supposed to represent (1 or 0) how do you propose to get any useful information about the history of that bit?
I can believe you recover data from drives people think they have "wiped", but if I overwrite every bit on my hard drive with garbage you are not going to get anything but garbage from it.
Re:Honk! Honk! (Score:2, Informative)