recovering data from flash and ssd. proprietary | kroll ontrack your presenters today jennifer duits...

35
Recovering Data from Flash and SSD

Upload: julianna-ellwood

Post on 01-Apr-2015

241 views

Category:

Documents


26 download

TRANSCRIPT

Page 1: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Recovering Data from Flash and SSD

Page 2: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack2

Your presenters today

Jennifer Duits

Sr. Marketing Specialist

Kroll Ontrack, Inc.

Steve Hruska

Research & Development Engineer

Kroll Ontrack, Inc.

Teleconference information -------------------------------------------------------

1-866-579-8110 

Participant Pass code: 381605

Page 3: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack3

Today We Will Discuss:

SSD Survey Results

HDD vs. Flash/SSD Technology

Flash/SSD Data Recovery

SSD Data Encryption

SSD Data Erasure

Summary/Q&A

Page 4: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

SSD Survey

Page 5: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack5

SSD Customer Survey –August 2013

Page 6: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

HDD vs Flash/SSD Technology

Page 7: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack7

Deliveries HDD vs. SSD

2011 2012 2013 2014 2015 20160

200

400

600

800

1000

1200

1400

625673

770882

1012

1162

17 39 83 126175

239

HDD**SSD*

* Source: IHS iSuppli, January 2013 ** Source: Coughlin Associates, May 2012

in millions

Page 8: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack8

Hard Drive Internals

Spinning hard drives look like a record player with one or more disks (platters) and a read/write head on each side of each platter.

Hard drives store data by magnetizing parts of the disks and store data sequentially.

A cleanroom environment is necessary in the majority of recoveries.

Microscope view of magnetized bits on a platter

Data

Data

Servotracks +

ECC

Page 9: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack9

HDD Roadmap – HDD GAP

Performance Increase: » CPU 8-10x

» DRAM 7-9x

» Network 100x

» Bus 20x

Capacity Roadmap: » Heat Assisted Magnetic

Recording (HAMR)

» Bit Patterned Media (BPM)

» Shingled Magnetic Recording (SMR)

Performance GAP:Disk Drive 1.2x

Page 10: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack

Solid State Drive - SSD

Page 11: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack11

Solid State Drive Internals

Solid State Drives have no moving parts.

The data is not stored sequentially on the chips so the engineer must re-assemble the data, similar to a Raid recovery.

Connector

Controller Chip

Memory Chips

Memory Chips Removed

Page 12: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack12

Memory Chips - Blocks - Pages

= Page[smallest Unit]4 KB or 8 KB

Block[128 Pages = 1 Block]

Possible status:> free> filled with data marked for deletion badSmallest Unit to delete!

Memory-Chip[ n Blocks = 1 Chip ]

0

n

Goss, Karen
Are these subsets of filled with data or are they supposed to be the same > as free and filled with data?
Page 13: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack13

NAND-Flash Type

SLC = Single Level Cell: Highest endurance; Highest performance; Most expensive

MLC = Multi Level Cell: Moderate cost; Read intense apps; Web server

eMLC = Enterprise MLC: Lowered wear rates at moderate cost; Database apps

TLC = Triple Level Cell: Low cost; High density; Consumer Electronics

Source: SAMSUNG

Page 14: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack14

HDD vs SSD Manufacturers: HDD

Graphic Source: Chris Ritter, Buzzfeed.com

Page 15: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack15

SSD Manufacturers

Six NAND Manufacturers but > 200 SSD Manufacturers

SSD is easy to build: Controller, NAND, Firmware,…

Page 16: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack16

Realities of SSDs

SSDs and HDDs are equally reliable» Susceptible to different types of failures

» Limited time for testing SSDs for Mean Time Between Failures (MTBF)

SSDs work well in a hybrid data storage environment» Adds speed for commonly accessed data

SSDs and HDDs measure endurance differently» SSDs increase in endurance when used for low-write processes

SSD data recoveries are more complex» Inconsistent standards between manufacturers

Page 17: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

SSD Data Recovery

Page 18: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack

Types of HDD Failures

Page 20: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack

Types of Flash/SSD Failures User Error/Environmental Influences

» Fire/Water Damage

» Broken Connector/Physical Damage

» Deleted Data

» Virus

Electronics Component Failure» Flash Controller

» Flash NAND Memory Chip

» Component Failure

System Area Corruption» Erased/Corrupted Mapping Table

» Erased/Corrupted Firmware

20

Page 21: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack21

Rise of SSD Deliveries and SSD Recoveries

2011 2012 2013 2014 2015 20160.0%

2.0%

4.0%

6.0%

8.0%

10.0%

12.0%

14.0%

16.0%

18.0%

% of SSDs Shipped

% of SSD Recoveries

SSD Drives Shipped Source: IHS iSuppli, January 2013 HDD Drives Shipped Source: Coughlin Associates, May 2012

Page 22: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack22

SSD Recovery Challenges

What? Why?

Software/Hardware Proprietary Tools Only a few tools are on the market -new tools are constantly in development

Time Consuming Need to research the algorithms used to originally store the data

Wear leveling (balances usage evenly across all disk sectors)

Creates added complexity when piecing the data back together – we see a lot of duplicate files

RAID-like configurationIndividual memory chips on devices make data less contiguous and difficult to piece back together

Lack of standardized configurationsMany recovery jobs bring new challenges and new algorithms

Page 23: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

SSD Data Encryption

Page 24: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack24

Types of Encryption

Type of Encryption Risks and Opportunities

Software Encryption (eg. BitLocker, Pointsec, etc.)

The master key is in your hands – even when a data recovery from a physically damaged hard disk is necessary the use of the key, password or pass-phrase guarantees access to your stored data.

Hardware Encryption or Self-encrypted Drive (SED)

The device holds the key to the encrypted data on your drive. The data is stored encrypted by default.

Page 25: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Data Erasure for SSD

Page 26: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack26

SSD Data Erasure Study

Research from UCSD shows that techniques designed for erasing hard drives such as overwriting and using built-in secure erase commands are unreliable when used on SSDs and sometimes results in all the data remaining intact.

Individual file erasure techniques all failed and left at least 10MB of a 1000MB file

Page 27: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack27

The Challenges of Data Erasure

Retired Block:

One bad cell can make a block become retired

One Block has 128 pages

1 page 4 or 8 KB

Page 28: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack28

Data Erasure TechniquesSecure data erasure is at a very critical point with SSDs.

Erase Method Security Issues

Erase Software May not completely erase SSD -Bad blocks, firmware, smart data not erased

“Secure Erase Function” or “Enhanced Secure Erase Function”

Secure-but not supported by all Flash controllers

Physical Destruction Secure via shredding. Cannot re-use the drive

Cryptographical Erase Encryption needs to be set up before data is written on the drive

Page 29: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack29

Recommendations for Data Erasure

Our Recommendations for erasing sensitive data:

Use encryption on your SSD from day 1 Delete the remaining data with cryptographic erase by deleting the encryption key.

Employ multiple erase methods for encrypted drives Overwriting + Secure Erase + Cryptographic (SED)

Use physical destruction Shredding

If you want to be sure your data is erased – use Kroll Ontrack’s Erasure Verification Service

Page 30: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

How Is Kroll Ontrack Overcoming Data Recovery Challenges?

Page 31: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack31

Staying Ahead Of The Curve

R&D team fully dedicated to advancing our capabilities.

Just In Time (JIT) development team available for customized software development and tools when needed.

Long-standing relationships with leading data storage manufacturers.

Page 32: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

What Should You Take Away From Today’s Webinar?

Page 33: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack33

Summary

SSD technology will continue to grow.» Choose your technology wisely… Do your research for your needs

No matter how good or safe a technology is data loss can always happen.

Be prepared and make data recovery a part of your disaster recovery plan.

» Chose your data recovery provider carefully

– Availability 24/7/365

– Possibility of just-in-time development of client-built tools

– Do they provide R&D

– What about data safety and data protection

Don’t forget to back up your data regularly!

Page 34: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack

Kroll Ontrack – Worldwide Reach

34

EMEA • UK• France• Germany• Italy• Norway• Poland• Netherlands

NORTH AMERICA• Los Angeles• Minneapolis• Washington DC• New York City• Toronto

APAC• Singapore• Hong Kong• Japan• Australia

Page 35: Recovering Data from Flash and SSD. Proprietary | Kroll Ontrack Your presenters today Jennifer Duits Sr. Marketing Specialist Kroll Ontrack, Inc. Steve

Proprietary | Kroll Ontrack35

Thank you for your interest!

What questions do you have?

Peter Magnuson

Key Account Manager

952.516.3527

www.krollontrack.com

Follow us on :

http://www.thedatarecoveryblog.com/