recovering data from flash and ssd. proprietary | kroll ontrack your presenters today jennifer duits...
Post on 01-Apr-2015
239 Views
Preview:
TRANSCRIPT
Recovering Data from Flash and SSD
Proprietary | Kroll Ontrack2
Your presenters today
Jennifer Duits
Sr. Marketing Specialist
Kroll Ontrack, Inc.
Steve Hruska
Research & Development Engineer
Kroll Ontrack, Inc.
Teleconference information -------------------------------------------------------
1-866-579-8110
Participant Pass code: 381605
Proprietary | Kroll Ontrack3
Today We Will Discuss:
SSD Survey Results
HDD vs. Flash/SSD Technology
Flash/SSD Data Recovery
SSD Data Encryption
SSD Data Erasure
Summary/Q&A
SSD Survey
Proprietary | Kroll Ontrack5
SSD Customer Survey –August 2013
HDD vs Flash/SSD Technology
Proprietary | Kroll Ontrack7
Deliveries HDD vs. SSD
2011 2012 2013 2014 2015 20160
200
400
600
800
1000
1200
1400
625673
770882
1012
1162
17 39 83 126175
239
HDD**SSD*
* Source: IHS iSuppli, January 2013 ** Source: Coughlin Associates, May 2012
in millions
Proprietary | Kroll Ontrack8
Hard Drive Internals
Spinning hard drives look like a record player with one or more disks (platters) and a read/write head on each side of each platter.
Hard drives store data by magnetizing parts of the disks and store data sequentially.
A cleanroom environment is necessary in the majority of recoveries.
Microscope view of magnetized bits on a platter
Data
Data
Servotracks +
ECC
Proprietary | Kroll Ontrack9
HDD Roadmap – HDD GAP
Performance Increase: » CPU 8-10x
» DRAM 7-9x
» Network 100x
» Bus 20x
Capacity Roadmap: » Heat Assisted Magnetic
Recording (HAMR)
» Bit Patterned Media (BPM)
» Shingled Magnetic Recording (SMR)
Performance GAP:Disk Drive 1.2x
Proprietary | Kroll Ontrack
Solid State Drive - SSD
Proprietary | Kroll Ontrack11
Solid State Drive Internals
Solid State Drives have no moving parts.
The data is not stored sequentially on the chips so the engineer must re-assemble the data, similar to a Raid recovery.
Connector
Controller Chip
Memory Chips
Memory Chips Removed
Proprietary | Kroll Ontrack12
Memory Chips - Blocks - Pages
= Page[smallest Unit]4 KB or 8 KB
Block[128 Pages = 1 Block]
Possible status:> free> filled with data marked for deletion badSmallest Unit to delete!
Memory-Chip[ n Blocks = 1 Chip ]
0
n
Proprietary | Kroll Ontrack13
NAND-Flash Type
SLC = Single Level Cell: Highest endurance; Highest performance; Most expensive
MLC = Multi Level Cell: Moderate cost; Read intense apps; Web server
eMLC = Enterprise MLC: Lowered wear rates at moderate cost; Database apps
TLC = Triple Level Cell: Low cost; High density; Consumer Electronics
Source: SAMSUNG
Proprietary | Kroll Ontrack14
HDD vs SSD Manufacturers: HDD
Graphic Source: Chris Ritter, Buzzfeed.com
Proprietary | Kroll Ontrack15
SSD Manufacturers
Six NAND Manufacturers but > 200 SSD Manufacturers
SSD is easy to build: Controller, NAND, Firmware,…
Proprietary | Kroll Ontrack16
Realities of SSDs
SSDs and HDDs are equally reliable» Susceptible to different types of failures
» Limited time for testing SSDs for Mean Time Between Failures (MTBF)
SSDs work well in a hybrid data storage environment» Adds speed for commonly accessed data
SSDs and HDDs measure endurance differently» SSDs increase in endurance when used for low-write processes
SSD data recoveries are more complex» Inconsistent standards between manufacturers
SSD Data Recovery
Proprietary | Kroll Ontrack
Types of HDD Failures
Proprietary | Kroll Ontrack19
Types of Flash/SSD Failures
Proprietary | Kroll Ontrack
Types of Flash/SSD Failures User Error/Environmental Influences
» Fire/Water Damage
» Broken Connector/Physical Damage
» Deleted Data
» Virus
Electronics Component Failure» Flash Controller
» Flash NAND Memory Chip
» Component Failure
System Area Corruption» Erased/Corrupted Mapping Table
» Erased/Corrupted Firmware
20
Proprietary | Kroll Ontrack21
Rise of SSD Deliveries and SSD Recoveries
2011 2012 2013 2014 2015 20160.0%
2.0%
4.0%
6.0%
8.0%
10.0%
12.0%
14.0%
16.0%
18.0%
% of SSDs Shipped
% of SSD Recoveries
SSD Drives Shipped Source: IHS iSuppli, January 2013 HDD Drives Shipped Source: Coughlin Associates, May 2012
Proprietary | Kroll Ontrack22
SSD Recovery Challenges
What? Why?
Software/Hardware Proprietary Tools Only a few tools are on the market -new tools are constantly in development
Time Consuming Need to research the algorithms used to originally store the data
Wear leveling (balances usage evenly across all disk sectors)
Creates added complexity when piecing the data back together – we see a lot of duplicate files
RAID-like configurationIndividual memory chips on devices make data less contiguous and difficult to piece back together
Lack of standardized configurationsMany recovery jobs bring new challenges and new algorithms
SSD Data Encryption
Proprietary | Kroll Ontrack24
Types of Encryption
Type of Encryption Risks and Opportunities
Software Encryption (eg. BitLocker, Pointsec, etc.)
The master key is in your hands – even when a data recovery from a physically damaged hard disk is necessary the use of the key, password or pass-phrase guarantees access to your stored data.
Hardware Encryption or Self-encrypted Drive (SED)
The device holds the key to the encrypted data on your drive. The data is stored encrypted by default.
Data Erasure for SSD
Proprietary | Kroll Ontrack26
SSD Data Erasure Study
Research from UCSD shows that techniques designed for erasing hard drives such as overwriting and using built-in secure erase commands are unreliable when used on SSDs and sometimes results in all the data remaining intact.
Individual file erasure techniques all failed and left at least 10MB of a 1000MB file
Proprietary | Kroll Ontrack27
The Challenges of Data Erasure
Retired Block:
One bad cell can make a block become retired
One Block has 128 pages
1 page 4 or 8 KB
Proprietary | Kroll Ontrack28
Data Erasure TechniquesSecure data erasure is at a very critical point with SSDs.
Erase Method Security Issues
Erase Software May not completely erase SSD -Bad blocks, firmware, smart data not erased
“Secure Erase Function” or “Enhanced Secure Erase Function”
Secure-but not supported by all Flash controllers
Physical Destruction Secure via shredding. Cannot re-use the drive
Cryptographical Erase Encryption needs to be set up before data is written on the drive
Proprietary | Kroll Ontrack29
Recommendations for Data Erasure
Our Recommendations for erasing sensitive data:
Use encryption on your SSD from day 1 Delete the remaining data with cryptographic erase by deleting the encryption key.
Employ multiple erase methods for encrypted drives Overwriting + Secure Erase + Cryptographic (SED)
Use physical destruction Shredding
If you want to be sure your data is erased – use Kroll Ontrack’s Erasure Verification Service
How Is Kroll Ontrack Overcoming Data Recovery Challenges?
Proprietary | Kroll Ontrack31
Staying Ahead Of The Curve
R&D team fully dedicated to advancing our capabilities.
Just In Time (JIT) development team available for customized software development and tools when needed.
Long-standing relationships with leading data storage manufacturers.
What Should You Take Away From Today’s Webinar?
Proprietary | Kroll Ontrack33
Summary
SSD technology will continue to grow.» Choose your technology wisely… Do your research for your needs
No matter how good or safe a technology is data loss can always happen.
Be prepared and make data recovery a part of your disaster recovery plan.
» Chose your data recovery provider carefully
– Availability 24/7/365
– Possibility of just-in-time development of client-built tools
– Do they provide R&D
– What about data safety and data protection
Don’t forget to back up your data regularly!
Proprietary | Kroll Ontrack
Kroll Ontrack – Worldwide Reach
34
EMEA • UK• France• Germany• Italy• Norway• Poland• Netherlands
NORTH AMERICA• Los Angeles• Minneapolis• Washington DC• New York City• Toronto
APAC• Singapore• Hong Kong• Japan• Australia
Proprietary | Kroll Ontrack35
Thank you for your interest!
What questions do you have?
Peter Magnuson
Key Account Manager
952.516.3527
www.krollontrack.com
Follow us on :
http://www.thedatarecoveryblog.com/
top related