Data recovery from SSD. Restoring a damaged SSD SSD drive failure

Owners of solid-state or SSD drives are not insured against data loss in the same way as owners of regular HDDs. However, recovering information from a solid-state drive, be it OCZ, Kingston or any other, is much more difficult to carry out. Below we will consider how you can still try to recover data from an SSD using the examples of OCZ and Kingston, and also why this process for a solid-state drive and, for example, for a regular flash drive is so different.

When you can and cannot extract data from a solid-state drive

Flash drives, which also write to chips, differ radically from OCZ and Kingston SSDs in that the latter have a TRIM interface command. It forces the solid-state drive to physically clear data blocks of any information after deleting a file. However, files with OCZ are not instantly destroyed - after receiving the appropriate command Data blocks are cleared only after a certain period of time, however, which one is impossible to predict.

Algorithm for the TRIM command

The TRIM command is aimed at maintaining constant high performance of devices, but if the disk has managed to execute it, then we can say with almost complete certainty that the deleted data has been completely destroyed and cannot be restored. However, not in all cases TRIM is performed, therefore, data from the drive can be recovered in the same way as on the HDD.

You can effectively extract data from OCZ and Kingston SSDs in the following cases:

  1. Older versions of Apple's OS prior to OS X 10.10.4 did not support TRIM technology for any third-party SSD;
  2. TRIM does not work in older versions of Windows either, so if you have XP or Vista installed, then recovering deleted data from OCZ will not be difficult;
  3. USB and FireWire protocols also do not work with TRIM, so retrieving information from external SSD drives will not be difficult.

And another situation in which files from a solid-state drive are not deleted by the TRIM command is file system failures and disk damage. In this case, you can scan it, for example, with the Hetman Partition Recovery application and extract all the necessary documents, images, etc. from it without any problems.

Hetman Partition Recovery program

The application works with all media, including an OCZ or Kingston SSD drive.

Even beginners should not have any problems recovering deleted files with this application thanks to the built-in wizard, which explains the sequence of actions to the user step-by-step.

The program offers a preview of all the information found on the right side of the window. It could be any text documents, MP3 audio files, photographs and archives. Also, the functionality of Hetman Partition Recovery provides the user with the ability to create an image of the drive for further work with it.

Recovering data from SSD using DMDE

This program is also capable of saving a lot of information from a solid-state drive in some cases. In contrast, it works without paying for a license, but with restrictions - this way you can only restore files one at a time.

The procedure for working with DMDE is as follows:

  1. After launching the application, select a language and accept the terms of the license agreement;
  2. In the main DMDE window, select the media from which data will need to be restored;
  3. Click Ok, the program will analyze the structure of the OCZ disk and provide maximum information about the partitions detected on the drive;
  4. Select the one you need from the list and click the open volume button;
  5. In the left part of the window, select the “Found + reconstruction” item, on the right, specify the reading parameters - “clean” reconstruction, and in the drop-down list below - “including deleted”;
  6. Next, a window will open with all the files found - available and already deleted, which are marked with a cross;
  7. Here you can select the disk, file or group of interest to the user and context menu of the selected item, give a command to restore the object.

SSD Recovery | When a good memory gets into trouble

This time we contacted the Flashback Data laboratory, whose employees work on all types of data storage devices, but have special experience in working with flash memory. Representatives from Flashback Data agreed to show us what efforts a top-notch laboratory would take to save our precious flash memory.


SSD Recovery | Reading range

In its early days, Flashback primarily focused on replacing faulty chips, but over time this became increasingly difficult to do as manufacturers began using different components at different stages of production in the same model. Some devices now have encryption, which makes data recovery even more difficult. In this case, Flashback needed to be able to read memory directly, which in turn meant having an incredible number of ways to read chips from such a wide variety of flash memory available.

Note that when Flashback refers to "encryption", this state is typically unknown to the user. For example, around 2006, SanDisk began encrypting data on all of its drives, as Flashback co-founder and vice president Russell Chozick told us. As with automatic hard drive encryption, the controller encrypts all data stored in flash memory. Since there is no password to lock the encryption, the data is decrypted and retrieved from the media. So in case of damage printed circuit board Flashback employees are trying to move the controller and memory chips into the new device. “If the controller burns out, it is almost impossible to get the data back, since it contains information about how exactly the data needs to be decrypted. If you cannot work with the controller, you are faced with a big problem.”

SSD Recovery | Types of Flash Memory

These dark gray TSOP48 chips have been typical components of USB flash drives and SSD/SD/CF memory cards for many years, but recently they have opened the way for other chips as well. The bottommost sample in the picture shows the back of the TLGA chip and you can see that there are no pins on the side and the modules are located on the back side. Such chips are common for all types of flash memory and work in e.g. the latest smartphones iPhone.

During the rebuild process, Flashback employees insert TSOP48 chips into the readers, but the TLGAs must also be soldered. Obviously, the processes of analyzing and restoring information are much more complicated. So with the introduction of more compact flash memory into smartphones, the old “monolithic” formats seem simpler in comparison.

LaCie SD cards and USB devices also have monolithic chips. While most memory cards have separate controller and memory chips, a monolithic chip combines both components into one tiny module. Obviously, malfunctions of such devices can occur for any of a variety of reasons. If the controller stops working, technicians can still access the data through other means instead of using pins to connect to a card reader, smartphone or camera. In the photo, you can see how the device's casing has been partially removed, as technicians need to remove some of the soldered black coating in order to find certain points for connection to the logic analyzer. Once all points have been identified, the card will be connected as shown in the following pictures.

To remove some of the coating, Flashback employees use surprisingly simple tools: sanding paste and a polishing wheel. Chemicals can be used to achieve this goal, but we were told that it is better to use a slow and thorough polishing process. Very thin contacts can easily be damaged during the grinding process. We initially asked to connect a LaCie drive, but then abandoned the idea after learning that such a job could take a technician all day.

SSD Recovery | Common flash drive errors

We've seen photos of damaged hard drives, most of which were damaged due to the head colliding with tracks in the magnetic media. Almost all SSD and flash memory damage that Flashback detects is invisible. In rare cases, you may see a burn mark on the circuit board, but in general, broken controllers and burnt fuses leave no visible marks. As a result, specialists have to work for a long time testing each resistor. In comparison, disconnecting the connector, as shown in the photo, is a piece of cake for repair specialists.

SSD Recovery | What about wear and tear?

We have previously written about the constant race between two processes - improving reading algorithms as capacity increases and reducing lithography, which is reminiscent of a tug of war. In particular, we are concerned that flash and SSD drives that have been in use for several years may show signs of wear and tear.

Fortunately, we are told that most of the SSD drives that arrive at the Flashback laboratory are not even a year old, so the NAND memory does not wear out. In fact, cases of actual wear and tear are extremely rare. Although with USB flash drives (especially older models with less advanced alignment algorithms), wear is a little more common. Reading from the chips works fine, but when checking the information, a lot of ECC errors occur, and no data can be retrieved. The presence of four red dots (further in the pictures) indicates problems with ECC. On the contrary, major wear problems will be marked with four green dots.

There were also cases when specialists carried out an analysis, took out the chip, cleaned the lamella and put everything back in place, exacerbating the problem with reading the data, which now required more time. So wear and tear can indeed be regarded as a real danger, but there is no talk of any crisis here, although many might think about it.

SSD Recovery | Heat it up

Chips must be removed from the circuit board using a special soldering jig, and one of the main tools for this step is hot air. The picture shows how specialists remove the TLGA chip from a USB device. They control the temperature and air pressure, heating the device enough to melt the solder points. Such soldering stations also contain soldering irons, welding flux, ohmmeters and other diagnostic devices. Some of these stations occupy Flashback's main laboratory, which measures approximately 465 square meters.



CONTENT

A solid-state drive has the following advantages over a hard drive: high level performance and reliability, low power consumption, no noise and much more. Therefore, more and more users are choosing SSD as their system one. When connecting such a drive, you may find that it is not detected by the system or is not even displayed in the BIOS. This may look like there is no disk in "Explorer", Windows settings or in the BIOS boot selection list.

Problems with displaying the SSD in the system can occur for reasons such as a missing drive letter or initialization, the presence of hidden partitions, and a file system incompatible with Windows. At the same time, this may occur due to incorrect BIOS settings and physical damage to the disk itself or one of the connection elements between the motherboard and the SSD.

Reason 1: The disk is not initialized

It often happens that a new disk is not initialized when connected to a computer and, as a result, it is not visible in the system. The solution is to perform the procedure manually according to the following algorithm.

  1. Press simultaneously "Win+R" and in the window that appears, enter compmgmt.msc. Then click "OK".
  2. A window will open where you need to click "Disk Management".
  3. Right-click on the desired drive and select from the menu that opens "Initialize disk".
  4. Next, make sure that in the field "Disc 1" check the box, and place a marker next to the item mentioning MBR or GPT. "Basic boot record» compatible with all Windows versions, but if you plan to use only current releases of this OS, it is better to choose "Table with GUID partitions".
  5. After completing the procedure, you should create new section. To do this, click on the disk and select "Create Simple Volume".
  6. Will open "New Volume Wizard", in which we press "Next".
  7. Then you need to specify the size. You can leave the default value, which is the maximum disk size, or select a smaller value. After making the necessary changes, click "Next".
  8. In the next window, agree with the proposed volume letter option and click "Next". If desired, you can assign another letter, the main thing is that it does not coincide with the existing one.
  9. Next you need to perform formatting. Leave the recommended values ​​in the fields "File system", "Volume Label" and in addition we enable the option "Quick Format".
  10. Click "Ready".

As a result, the disk should appear in the system.

Reason 2: Missing drive letter

Sometimes the SSD does not have a letter and therefore does not appear in "Explorer". In this case, you need to assign a letter to it.


After this, the specified information storage device is recognized by the OS, and standard operations can be performed with it.

Reason 3: Missing partitions

If the purchased disc is not new and has already been used for a long time, it may also not appear in "My computer". This may be due to damage system file or MBR tables due to failure, virus file infection, improper operation, etc. In this case, the SSD is displayed in "Disk Management", but his status is "Not initialized". In this case, it is usually recommended to perform initialization, but due to the risk of data loss, it is still not worth doing this.

In addition, a situation is also possible in which the drive is displayed as one unallocated area. Creating a new volume as usual may also result in data loss. The solution here may be to restore the partition. To do this, you need certain knowledge and software, for example, MiniTool Partition Wizard, which has the appropriate option.


This should help solve the problem, but in a situation where there is no necessary knowledge and the necessary data is on the disk, it is better to turn to professionals.

Reason 4: Hidden section

Sometimes an SSD is not visible in Windows due to the presence of a hidden partition. This is possible if the user has hidden the volume using third-party software to prevent access to the data. The solution is to restore the partition using disk software. The same MiniTool Partition Wizard copes well with this task.


After this, hidden sections will appear in "Explorer".

Reason 5: Unsupported file system

If after performing the above steps the SSD still does not appear in "Explorer" It's possible that the disk's file system is different from FAT32 or NTFS, which Windows works with. Typically, such a drive appears in the disk manager as an area "RAW". To fix the problem, you need to follow the following algorithm.


Reason 6: Problems with BIOS and hardware

There are four main reasons why the BIOS does not detect the presence of an internal SSD.

SATA is disabled or has the wrong mode


Incorrect BIOS settings

The BIOS will also not recognize the drive if the settings are incorrect. This can be easily checked by the system date - if it does not correspond to the true one, this indicates a failure. To resolve it, you need to reset and return to standard settings according to the sequence of actions below.


Alternatively, you can remove the battery, which in our case is located next to the PCIe connectors.

Data cable faulty

The BIOS will also not detect the SSD if the CATA cable is damaged. In this case, you need to check all connections between the motherboard and the SSD. It is advisable not to allow any bends or pinching of the cable when laying. All this can lead to damage to the wires inside the insulation, although externally the material may look normal. If there is any doubt about the condition of the cable, it is better to replace it. When connecting SATA devices, Seagate recommends using cables less than 1 meter in length. Longer ones can sometimes fall out of the connectors, so be sure to check that they are firmly connected to the SATA ports.

Failed SSD

If after carrying out the above procedures the disk is still not shown in the BIOS, most likely there is a manufacturing defect or physical damage to the device. Here you need to contact a computer repair shop or SSD supplier, first making sure that there is a warranty.

Conclusion

In this article, we looked at the reasons for the absence of a solid-state drive in the system or in the BIOS when it is connected. The source of such a problem can be either the condition of the disk or cable, or various software glitches and incorrect settings. Before proceeding with the fix using one of the listed methods, it is recommended to check all connections between the SSD and the motherboard and try replacing the SATA cable.

Repair of flash drives at the client's site

Prepared equipment and software for field data recovery work. This service is now quite in demand. Mainly for privacy reasons. People want to be sure that media with sensitive (intimate, secret, worth a lot of dollars - underline as appropriate) data does not physically leave the office or apartment and remains at the complete disposal of the owner.

The client is always right, and I am ready to perform repairs in front of him and on his computer. I don’t specifically bring a laptop so as not to plant a seed of doubt. Although this makes the work much more difficult. After all, the platform on which you have to work can be anything - from the ancient Windows 98 to Windows 7 or one of the representatives of the Linux family.

Of course, you can’t do without a programmer, a hair dryer and soldering accessories. The same with a multimeter, a set of running parts and laces. Everything is of high quality to ensure the result. There are the necessary optics (several magnifying glasses plus a pocket 40x microscope) and light, and technical fluids, where would we be without them - the contacts have to be cleaned regularly.

One of the first trips was to the then new product - a flash drive with a built-in fingerprint scanner. The client thought that this would give him impenetrable protection. Alas, the built-in utility for checking “fingers” froze after a month, burying two gigabytes of data. I remember fiddling with this for a long time

But the software and documentation are most important, because their selection is very specific. There are technological utilities from various manufacturers, in many versions totaling over 400, and a datasheet for the main controllers, and a database of memory chips, and a description of previous attempts (materialized experience, so to speak), and various auxiliary programs. A total of eight gigabytes, just enough for a decent flash drive or two DVDs. This entire set, plus the ability to use it, is the property of a repairman.

⇡ Flash drives are flying...

Every week a Transcend JetFlash V60 with a capacity of 16 GB is brought in for repair. This model is quite popular due to its compactness and low price, but its reliability leaves much to be desired. The batch was unsuccessful, or something, but after three or four months of operation, the flash drives are closed for writing - it is impossible to either create or edit the file, formatting also does not work.

This usually happens due to memory defects: if they grow, the controller blocks the write to prevent further damage (due to its design, flash memory is damaged mainly when writing). Low-level formatting restores performance, however, at the cost of reducing the usable capacity by 200-600 KB. Several defective blocks are excluded from addressing.

Moral: when looking for a flash drive, look for reviews on the Internet. It happens that two neighboring models in a line differ noticeably in reliability. There is no need to dig into the reasons, just take a less capricious option, even if you don’t like it.

⇡ How important it is to be friends with your mother

They brought a computer and an 8 GB Kingston flash drive with an interesting problem - this flash drive works on other computers, but it doesn’t want to be friends with one of them. Reading goes fine, but as soon as you try to write something down, the writing speed drops almost to zero, the flash drive freezes, and then disappears from the list of devices. With other drives everything is fine. Motherboard Gigabyte GA-MA770-DS3.

It seems that the timing diagrams of the Kingston controller and the southbridge do not match.

What to do? You can switch the USB host to 1.1 mode through the BIOS, but then the speed will not suit anyone. It is more profitable to carry out low-level formatting of a flash drive, increasing the access time to cells from 50 to 66 ns. After this operation, performance dropped, but only slightly, and the drive became noticeably more stable.

⇡ Expensive complications

The client brought an expensive one Sony laptop Vaio Z. On the phone, he muttered inaudibly about a lost disk and categorically did not want to let go of his computer (he is the director of a raw materials company, and such people, as well as lawyers, are painfully suspicious). On site, it turned out that the device contains a 120 GB SSD, and it cannot be removed: the mounting screws are sealed with warranty stickers, and the warranty is still valid (the laptop was purchased six months ago). Here's an ambush from Aunt Sonya. And I already prepared the SATA fittings for connection to the stand...

I had to launch the LiveCD, and of the three options I had, only one worked, LamygoBoot - that’s what new hardware means. The SSD turned out to be somewhat outdated and did not give SMART any value. There are already dips in the speed graph, which means the wear of the flash memory is progressing. The proven R-Studio resuscitation program worked with an SSD only a little less than with a traditional disk of the same capacity (about an hour and a half).

SSD with two interfaces - USB 2.0 and SATA II. Can be used both as an internal and external device (the latter is especially useful for laptops)

I extracted a huge number of files and recorded them on an external drive. The main problem is the 32 GB SDHC card inserted into the built-in card reader. The director drove her head and tail, enrolling 52,000 (!) workers in a few years and archive files. The total volume recorded is 24 GB. Yes, not everyone can do this. Despite the fact that the main files are curly designed Excel tables, with dynamic graphics and much more.

The owner firmly believed that the card would not fail, despite the fact that he did not remove it from the slot (it is important to him that the edge does not stick out, and in case of force majeure it is easy to hide, I was embarrassed to ask where). Backups didn’t do it - he didn’t realize what was needed, and his system administrator didn’t insist ( attention, attention, professional incompetence has been detected!).

In the end, the card (a mediocre model from Transcend), as expected, failed. As always - at the most inopportune moment. Now there is no access to the data, you will need to take a physical dump and assemble the file system. The work is painstaking, something like putting together a mosaic of eight million pieces.

Unsoldering the memory chip from the SD card. The peculiarity of these drives is that the board is as thick as a sheet of paper; you must be extremely careful when working

Moral of the story: Don't keep all your years' worth of work on one weak card. Well, it is not intended for this, its life program is to take photographs during serial shooting on SLR camera, then transfer all the content to your computer and format it with relief. All! Therefore, even if you wake up at night from nightmares in the style of “OBEP, let's start a mask show!”, you still need to make backup copies.

⇡ Weak link

They brought another flash drive with the missing “most necessary” file. If you constantly edit the same file day after day, sooner or later it will “go bad.” It is enough for the power supply to become weak (for example, from connecting other USB devices) or for the controller to fail.

When a certain area is repeatedly rewritten, the wear of the involved cells increases, and to level it out, a procedure for rebuilding the translator is launched, which sometimes takes a noticeable amount of time (this does not appear externally at all - the activity LED does not light up). At this point, the data is very vulnerable. The controller firmware does not provide any protective mechanisms, unlike hard drives and even SSD.

In this case, no matter how hard I tried, I couldn’t restore the xls file. The owner will have to type it again using paper documents. He will probably spend more than a day instead of ten seconds creating a backup copy.

⇡ How not to handle memory cards

The miniSD card was placed in the camera through an adapter; it was filled with frames while on vacation, and upon returning it was inserted into the card reader for reading. It looks like it was inserted incorrectly and the card is stuck. They pulled her out using force and sharp nail clippers.

This did not end well: the card case fell apart (miniSD has a very thin one), and the internal tracks on the board, which were as thick as a sheet of paper, were torn. After this, there was nothing left to do but give the fragments of the card to a specialist to extract the data.

The owner found some kind of “jack-of-all-trades”. After two weeks of suffering, he couldn’t find anything better than to unsolder the memory chip from the card and put it on the board of the first flash drive he came across. Of course, with a completely different controller, this did not help, and, as it turned out later, it did a lot of harm. They brought me the chip itself on someone else’s flash drive and half of the fragments of the card body with the controller completely demolished. And this is important: by marking the latter, the file system assembly algorithm is determined.

Well, I considered the dump, I tried 4 assembly options. No FAT tables were found in all of them, although some JPEGs were visible. It turned out that someone else's controller simply reset the place where the FAT was located. If questionable experiments had not been carried out, all the images would have been restored. And so we managed to save less than half, and even twenty percent in varying degrees of cutting.

Moral: rarely move cards from the camera (player, navigator, etc.) to the card reader and back. It is safer to connect the gadget itself to the PC. Not only mechanical breakdowns are possible, cards are often damaged by static, especially formats with open contacts. Adapters (microSD-miniSD-SD) only complicate matters, adding another point of failure.

⇡ Non-standard form factor as a risk factor

We brought a PQI Card Drive U510 flash drive for repair. This is a flat aluminum plate in the format of a business card, from which a USB connector comes out on a flexible cable, and there is also an activity indicator on it. It was this cable that failed: a couple of tracks were frayed. It is not easy to restore a 7 mm wide cable; it is even more difficult to ensure its long life after repair. But there is nothing to replace it with - the part is non-standard. In general, the expensive drive was thrown away. To get the necessary data (as usual, there is an archive on a flash drive for two years without backups), I unsoldered the memory chips and counted the dumps. The design added problems here too: the board is glued with its entire surface to the aluminum cover. This is good for work (the heat dissipation is ideal), but bad for repairs - desoldering the chips is difficult. I had to take a powerful industrial hair dryer and heat it twice as long as usual, which significantly increases the risk of data damage. Indeed, there were a lot of errors on one of the two chips (however, memory is now completely error-free). Some files were not completely restored, but the client was satisfied.

The flash drive is in disassembled condition. A broken cable is visible

Only such a hefty hairdryer was able to unsolder the chips

Moral: keep it simple. Flash drives with an elaborate design are almost always less reliable and repairable than standard “whistles” and “sticks”. If the shaped cap gets lost or some part gets jammed (for example, a retractable connector), it’s not so bad. But in this case, the non-standard form factor caused the destruction of the drive and led to significant losses for the client (time, data, money). In the end, I still bought a regular flash drive. Leave the exotic ones for gifts (especially for enemies), and work with standard media, and of reasonable capacity. I have already explained why excess capacity is harmful. Greed—it destroys many people.

⇡ Typical faults

All flash drives (USB drives, memory cards and SSDs) are designed the same way, and their faults are similar. Let's look at the main causes of failure and measures to restore data in each case.

  • Damage to the translator
    Any modern flash drive has a translation system that shuffles data blocks in memory. Attached to each block is a translation table and a number of markers (in particular, a counter for the number of records in the block); they are updated simultaneously with the data being written. The serviceability of these service fields is critical for user access to data.

    And this is where we touch on weak point flash technologies. To change even one byte in flash memory, you need to read into the buffer, change (that same byte), erase and write the entire block. Any failure during recording (poor contact in a loose connector, unstable power supply, defective cells on the flash drive itself, etc.) can lead to a situation where the block did not have time to be recorded along with its markers and translation table.

My away gentleman's set. The black flash drive (on the right) was purchased recently (the leader in speed in its class), all the others are of advanced age, but do not complain about their health

In this case, the integrity of the translator is violated, and correct memory addressing is lost. This blocks the user’s access to it, which outwardly looks like a message like “Insert the disk into the drive”, “Device not recognized”, freeze, etc. From the point of view of the flash drive controller, this malfunction is purely software and can be cured by erasing the entire amount of memory and creating a new translator.

For this purpose, technological utilities are used in factories for the initial firmware of flash drives; many of them can be found, for example, on flashboot.ru. The term “firmware” is not entirely accurate, since the true firmware of a flash drive (that same firmware) is not located on the flash memory chips, but in the controller and is installed during its manufacture. Cases of firmware corruption with a working controller are extremely rare, and they can be ignored. Creating a new translator is more correctly called low-level formatting.

A “double-barreled” flash drive with two interfaces is fast, but expensive. With the advent of USB 3.0, the relevance of such solutions is fading

Obviously, such a procedure is detrimental to data, although there have been reports of cases where data on a flash drive was saved when formatting was interrupted.

However, there is no system in these messages, and they should not be taken into account. Most the right way Data recovery in such cases involves unsoldering the memory chips, reading them on the programmer and adding the resulting dumps into the required data. The last stage can be very non-trivial and lengthy.

  • Hardware faults
    This includes burnt controllers and stabilizers, broken connectors, torn current-carrying tracks on the board, cracked resistors and filters, dead crystals, etc.
    Characteristic symptoms - the flash drive does not show signs of life when connected, or gets very hot, so that after a few seconds your hand can’t stand it.
    If the controller is working properly, repair is quite possible by replacing parts and restoring contacts. The data remains in place. In other cases (and they are the majority), the data recovery technology is the same as described above.

    Previously, when this technology did not yet exist, many repairmen tried to resolder a burnt-out controller. It was possible to recover data in no more than 20% of cases, so this approach was abandoned. The reason is the difference in firmware in different versions controllers and difficulties in obtaining the required version. In fact, for the success of the work, it was necessary to find a donor flash drive not only of the same model, but also from the same batch.

  • Logic faults
    The flash drive is working properly, is recognized and allows access according to logic, but the file system is damaged (it appears, for example, empty or unformatted). The main method of data recovery is to copy the entire flash memory into an image file and parse it using recovery programs. There are now a huge number of the latter, both paid and free; the choice of utility is determined by the experience and preferences of the repairman. A number of free utilities are reviewed in a review on 3DNews. Here (and only here) remote assistance is possible - from sending an image to launching a recovery agent that transfers the results to a remote computer.

    It is perhaps worth saying a few words about typical failures during data recovery.

  • Mechanical damage to the memory chip
    An unnoticeable crack is enough to break the thinnest conductors connecting the crystal to the terminals. Then there is nothing to catch. Fortunately, the chip is protected by the case, as well as the board itself, and it is located far from the USB connector - the most vulnerable spot. So chip damage is quite rare.
    However, with strong impacts problems cannot be avoided. In my experience, there was an SD memory card that did not survive a car accident (the card was in the camera, and the device was in the glove compartment of the crashed car). The camera, of course, is in the trash. The card was bent by a screw, and the chip crumbled when trying to unsolder it.
  • Data encoding on the chip that could not be solved. This happened at an early stage, when there was little experience and statistics, and the most exotic controllers came across. Now there is no such obstacle: almost all encoding schemes have been dismantled, and the variety of controllers has decreased.
  • Unsolved problem - hardware encryption(AES-128 and AES-256 standards).
    For this, special controllers are used; just a couple of years ago they were quite expensive and slow, they were installed in a few models of flash drives (Kingston Security Edition, etc.). Now the price has dropped sharply, the operating speed has increased, and an on-the-fly encrypting controller is included in many models (with a price, however, still above average). Encrypted data from the chip cannot be read. The key is hardwired into the controller; removing it even from a working chip is a problem. And they mostly bring them burnt.
  • Finally, sometimes The flash drive spoils itself. NAND flash memory has a bulk erase operation (typically 128 KB) that is completed in milliseconds. As a result of a power failure, an error in the operation of the translator, or other reasons, the memory may receive an erase signal, and then the data will be over. The block will consist of FF bytes (the erased cell acquires the value of a logical one). Blocks in the area of ​​file system tables (FAT) are especially often affected. Work with them is carried out most actively; FAT is updated every time any of the files on the flash drive are changed. And since people sometimes record thousands of files and edit them intensively, at some point the translator can’t handle it. The result is logical damage to the file system that can no longer be repaired. After all, the overwritten 128 KB is a lot for FAT. It’s especially annoying when tightly coupled databases like 1C collapse. Lost a couple of files out of a hundred, and hello.
    Here, by the way, there is a significant difference with hard drives. Recording on magnetic plates occurs, although very quickly, but strictly sequentially, so spontaneous overwriting of large fragments practically does not occur. The only exception is the Security Erase command, which erases the entire user area of ​​the disk without transferring it over the interface. But it is not used in regular (non-repair) software.

⇡ Counterfeits attack

Counterfeits are a big and long-standing problem in the world of flash drives. They became possible thanks to the extreme simplicity of the design of a typical flash drive: a controller, a dozen wiring parts, a couple of memory chips. All this is installed on a board measuring 3-4 cm, equipped with a USB connector and housed in a suitable case. The labeling and packaging, which are almost perfectly similar to the original, is also not a problem.

Pseudo-flash drives can be produced almost in makeshift conditions, which is what numerous Chinese (and other) scammers do. In addition, there is also a “third shift” in legal production. Night “drummers” use cheap scrap parts, placing them in original cases and providing them with branded packaging. The capacity of such a flash drive corresponds to the declared one, at first it even works, but defects quickly appear, the recorded files are spoiled, and then the controller is completely blocked, and the drive can be thrown away.

The point, of course, is not about lost money (not that much, although it is not superfluous), but about missing data. In defective chips, the cells “leak”, i.e. lose charge very quickly - recorded files become unreadable after a few days, or even hours. Let me remind you that normal flash memory should retain information for 10 years.

You can find out the location of defective areas and isolate them using a technological utility, unique for each controller model. I think that it is unlikely that any ordinary user will spend time on this. Those who are meticulous will find utilities and instructions on thematic sites and forums.

There are a lot of fakes in the memory card segment, especially those that are more expensive. This is especially true for the Memory Stick format produced by Sony: “non-original” cards occupy, according to estimates, up to half of our market. They are usually functional, but the speed and resource are noticeably lower than the original. In addition, cards may not be recognized in all devices (PDAs and game consoles are capricious; they used to even advise distinguishing fakes by the behavior of the card on the latter). It is possible to navigate the intricacies of packaging and labeling, but it is difficult: the qualifications of counterfeiters have grown so much that their products sometimes look better than the original. Thus, markings on the body can be applied with a laser, while Sony traditionally uses paint.

Fake Memory Stick Pro. Recognized on the computer, but not in any mobile device(PDA and PSP) never worked. Pay attention to the wear and corrosion of the contacts: it looks like the gold plating is also fake

If we return to the main array of fakes, then their essence is a sharp increase in capacity, sometimes by an order of magnitude or more. It is clear that this allows you to make excess profits, even if the “product” is sold at half the regular price. A 2-4 GB flash drive is flashed using a technological utility (stolen, by the way, from a legal manufacturer) to a capacity of 16-32 GB, or even higher. There are no restrictions here: what you write in the INI file of the utility is what will be issued in response to a request from the operating system.

As you know, the task of any fraud is to prevent the deception from being revealed at the time of payment (and until the fraudster is removed to a safe distance from the disappointed client). In this case, this is supported by the property of flashed flash drives that writing to fictitious addresses exceeding the real capacity occurs apparently normally and without errors. This is exactly what sellers demonstrate by uploading large films or simply archives of considerable size into a fake flash drive. In reality, of course, there is no record, and the subsequent reading of the data returns only zeros. All files located outside the actual capacity of the flash drive will be “broken.” With a high probability, the flash drive itself will no longer be recognized. But the unlucky buyer will understand this much later...

I advise buyers to be careful, not to purchase flash drives from dubious places or from not very reliable sellers on eBay, and also to save receipts, warranty documents and packaging. At the first sign of problems, stop using the drive and replace it under warranty. I hope you don’t have to face a situation where a crafty seller interprets a “lifetime warranty” as a guarantee for the time until the first failure of the drive.

Restless scammers are increasingly offering not only USB flash drives on steroids, but also memory cards. Making the latter is technologically more difficult (reflashing requires special equipment), but, apparently, the profit is greater. Cards of the most popular SDHC/microSDHC format today are in great demand; they are used in a huge number of gadgets - from players and smartphones to video cameras and e-books. So there are no problems with sales.

Most often, of course, expensive 32 and 64 GB cards are counterfeited. In addition to firmware for large capacity, counterfeiters also cheat with performance. High-speed models (class 6 and higher) with the same capacity are noticeably more expensive, so a banal relabeling to a higher class in itself gives a good gain. Not everyone will make a claim on a brake card, so the sale of such counterfeits is, in addition, relatively safe. In addition, you can always refer to unsuitable equipment, bad cables, etc. That’s why on eBay and other flea markets such “good” is a dime a dozen.

But let's get back to flash drives. New on the counterfeit market are models of enormous capacity, 256 GB and even 2 TB, at an absurdly low price. So, real 256 GB flash drives cost at least 15,000 rubles. and are quite rare to find on sale. Counterfeits, which look no different in appearance, are offered en masse for around a thousand.

The flash drive body is quite thick to accommodate all the memory chips. On a fake it is simply filled with air

Relying, as always, on the greed and laziness of buyers. Just look at the prices for flash memory to understand: chips of the required capacity alone will cost at least $50 (and this is at exchange prices, where they sell by the carload), not counting everything else. Some sellers, however, are already ashamed. Here is an advertisement from one of the auctions, at least honest:

« Selling flash drive256 GB Flash Memory Drive!New, sealed. Inexpensive!

Of course, there is no 256 GB (a little less), the flash drive is made in China, but you can safely count on 8-32 GB. It may need to be formatted, but that's not a problem.

I don’t know what the actual capacity is, I’m selling it as is. Negotiable!

An even more egregious case is a flash drive of the most ordinary type, supposedly with a capacity of 2 TB and a price of almost 4,000 rubles. Is this real? 32 memory chips of 64 GB each (the maximum available today) will definitely not fit into a standard case. The power consumption of such a kit is also quite large; power from the USB port (500 mA) is hardly enough.

In short, making a two-terabyte flash drive is unrealistic today. Terabyte internal SSDs in the format of a full-size PCI card (otherwise it would be impossible to fit all the chips) appeared quite recently and at a very inhumane price. About external solid state drive It is not yet possible to talk about such a capacity.

This is what a super fake looks like. Does anyone believe the numbers on the case?

And this is how it is determined in the computer. The thirteen-digit capacity is the fruit of the skill of Chinese-Israeli craftsmen (on the packaging the manufacturer is simply indicated: Israel)

So we have an extremely blatant fake. It would be interesting to know its real capacity (tera-flash drives have not yet reached Moscow, everyone is settling in Siberia). I'm guessing it's 32GB or so. It's pretty big number for an external drive, so the unlucky buyer will not go beyond its boundaries right away. And then the corruption of files, the collapse of the file system and other joys will begin.

⇡ MLC on the march

All modern flash drives use memory chips built using MLC technology. Each cell stores 2 or even 3 bits of data (in the latter case, the technology is sometimes called TLC), unlike the one used ahead of memory SLC with single-bit packing. It is clear that such a thin structure is not very stable. The number of erase-write cycles in an MLC cell does not exceed 10-30 thousand, but in reality it is 2-3 times less (the SLC resource reached 100-300 thousand cycles).

Moreover, the storage time of recorded information decreases exponentially depending on the type of recording it is. Passports are guaranteed for 10 years only for a “fresh” cell. The exponent index is not a standardized thing; it strongly depends on the purity of the source materials, the technological process of chip manufacturing and, of course, the operating features. In general, it’s a lottery - it’s almost impossible to predict when files from a flash drive will stop being read. It happens that the cells “leak” after 2-3 months (degradation is 50 times, however).

In this sense, SLC chips with a guaranteed 100 thousand records per cell and a long shelf life win. However, their capacity does not suit many users. Indeed, with the same technological process and standard packaging, you can place only 2 GB on a chip and, accordingly, make an 8 GB flash drive in the usual design (4 chips on the board). There were attempts to release 16 GB models on eight chips, but they turned out to be bulky and expensive (about $200), were in little demand and were discontinued.

But everything is not so bad, we are witnesses to how sophisticated “software” (microprograms) overcomes the shortcomings of “silicon” (low resource and low performance of MLC memory). First of all, these are wear leveling algorithms used in modern controllers. They have advanced a lot lately, which allows MLC flash drives to last up to two years even with active use. It would be possible to provide an even greater resource, but, apparently, this is not necessary: ​​no one has canceled obsolescence. All the same, in a year and a half, the drive will be replaced by an attractive new product.

As for the long time required for rewriting by MLC chips, current flash drives use two- or four-channel technology, when recording is performed simultaneously in 2 or 4 blocks (higher-speed SSDs have up to ten channels). Together with various caching disciplines, this brings the streaming write speed to 24 MB/s - just like the best SLC flash drives. Serious slowdown is observed only when writing randomly to widely spaced blocks, but how often does this occur in practice?

⇡ Murphy's Law for SSDs

Finally, a few words about solid-state drives, which use a unique memory management system. A dynamically reconfigured translator (in order to level out wear and increase recording speed) actually prevents confidential data from being reliably erased. On the other hand, the controller tries everything that can be cleared to form previously erased blocks, so it may not be possible to restore a recently deleted file. In short, if you want to recover deleted data, then you cannot do this. If you want to destroy them, then you cannot do that either. This is such a “Murphy’s law” for storing data on an SSD. It would seem that reliably destroying data is not a problem: you delete files, and then everything free space you copy incompressible content like MPEG files (this is a measure against SandForce-level controllers that compress on the fly), and that’s it. However, SSDs always have a capacity reserve of 20-30%, and the controller regularly rebuilds the translator to level out the wear of the blocks. It may turn out that some physical areas have already been excluded from addressing, and old versions of files remain in them.

And they cannot be erased by any copying - after all, logically there is no access to the files. But if you count the chips on the programmer, then everything rises perfectly. It turns out that a used SSD stores its entire backstory, and certain people in certain circumstances may be interested in it.

This problem is still far from being solved, except for such a radical remedy as a hammer. Therefore, selling used SSDs carries a certain risk. I note that buying them is not very wise: the flash memory resource may be running out, and finding out is not always easy (you need a computer with a diagnostic program). Therefore, it is better to take a new copy and keep the old ones under lock and key. From sin.

Share