SSD Flash Hard Drives - Shmoocon 2008 - Part 6

How Solid State Flash Hard Drives work and how to rebuild them for data recovery. This presentation was at Shmoocon 2008 given by Forensic Expert Scott Moulton from My Hard Drive Died, and Forensic Strategy Services.

Category:

Science & Technology

Tags:

• SSD
• Solid
• State
• Hard
• Drive
• Data
• Recovery
• Rebuild
• Flash
• Memory
• Sticks
• Scott
• Moulton

[SuperFlyFlippingA]

You have to clear the G-List to get them, or use the "Secure Erase" feature built in to your hard drive from the ATA spec and it will deleted the content in the bad block. Look for Secure Erase from the Center for Magnetic Recording Research to find what I am talking about.

[SuperFlyFlippingA]

I forgot to mention if they fail on writes you do not loose the data, it just writes to a new location and flags the orignal sector/block bad. If it is on a hard drive it means your data is still on the drive in the bad block and some data wiping software will not wipe those sectors and will think they are blank.

[SuperFlyFlippingA]

Yes, they fail on Writes, when checking for data. On Reads if they fail, usually you have a bad block and the data does not change so you might be able to recover it. It fails on reads because the content does not match ECC in most cases. If it failed and remapped you would not be able to recover data. That is primarly what data recovery houses do, is recover from this type of failure.

[jaymbhalodia]

Awesome presentation Scott. Can you share more knowledge on it in detail ?

[pallidinyou]

Nice presentations! I've learned more from this than from vendor marketing hype.

Hope you make more vids!

[AppA]

I'm wondering, is there a way of securely deleting content on an SSD so that it can't be recovered?

I'm sorry if I've missed the clue, it was a bit of an information overload, but nevertheless thanks for putting it up!

[RonJr7700]

I would really like to learn more about how to do this type of forensic type work and I was wondering if you could recommend any good books to start with. This really sounds like something I would love to get into.

Thanks so much for these videos!

[RonJr7700]

I'm loving these videos. Very interesting stuff. I've been repairing computers for about 10yrs now and I would always get people coming in with bad HDD's and I would have to try to recover data and if GetDataBack didn't pull it back then that was it. I never really new about what else to do. Now after watching these videos and hearing about some of the software that you mentioned and how to repair the HDD itself I will try this on some I have sitting around.

[Ichinin]

Intresting! However, wouldnt filling the entire memory device with files sort of "erase" the content on it? Would that work with writing a file that is byte to the block or would it require the whole block to be filled?

And that figuring out how "where leveling" works, couldnt that be some sort of simple N ^ X Mod X (X = prime) thing that cycle through a long series of non repeating numbers..?

[Meowbay]

Great, Scott! Thanks for putting these online. I could not be there, so this is a great way of sharing the knowledge.

I was just wondering: What about the statements from (among others) Intel that they will always fail first at write, not at read, in order to be safer (so you can still copy-read what is already on it and never really lose any data). They say the SSD will inform you of that, or something down those lines.. How do they do that?