SSD Recovery: How Pros Bring Flash Memory Back To Life

What Matters?

In an earlier article we did on data recovery, at least one commenter noted that essentially anyone could get into the recovery business and that Flashback was a small fry operation on a completely different level than more recognized names. Of course, the proof is in the recovery results and the client roster, which includes a broad spectrum of commercial and government accounts.

According to Chozick, Flashback’s lead engineers have over 15 years of experience in data recovery. The company has hundreds of thousands of dollars in equipment and parts inventory.

“It is very difficult to learn this stuff yourself.,” he says. “It has taken years of R&D to get to where we are. Flashback is not as tiny as we seem. We have a 5000 sq. ft. lab with very high security. We have a four-zone biometric access system to our lab with 24x7 video monitoring. We have full ESD (anti-static) flooring in the lab with copper strips run to ground, so there is no risk of electrical damage due to static. We have a steel evidence cage for secure data that is being stored for media involved in litigation. And for hard drives, we have Class 10 and Class 100 laminar flow clean workstations. Our Forensics Lab is the only private ASCLD internationally accredited lab in the world (ISO 17025).“

Not So Small, After All

The data recovery portion of Flashback’s lab consists of three rooms. First, there’s a large space lined with computers containing solder stations, recovery machines, imaging machines, and firmware machines. The area also contains servers for data storage and similar tasks. Another room stores parts, including thousands of hard drives, different firmware versions, and an avalanche of device models and makes and sizes so that techs have parts on-hand, whether they need circuit boards, internal read/write heads, or anything else. Not least of all, there’s the clean room, stocked with forced airflow workstations for working on hard drives.

One additional layer of security guards the forensic area, where all of the law enforcement or litigation cases go. Flashback uses a big evidence cage (see prior page) that is bolted to the ground with motion sensors all around it.

Again, regardless of Flashback’s size, this article should give you a sense of what goes on behind the scenes of a reputable recovery company trusted with your money, your broken flash storage, and your irreplaceable data. It’s not simply a matter of plug-and-copy. A formidable amount of work and expertise goes into reviving your bits from beyond the pale. We all hope never to need such services, but if the time ever comes that you need them, this is what you can expect to happen.

  • Eggz
    What did I just look at? Maybe it's displaying wrong on my screen, but there were no words and the pictures were pretty bad.
    Reply
  • Snipergod87
    Needs more JPEG.
    Reply
  • kamhagh
    i would push the ssd in chest and yell BREATH BREATH !!!!!
    Reply
  • artk2219
    Thanks for the story! Very cool to get a general overview of the flash media based file recovery process.
    Reply
  • TechnoD
    Intriguing article. This is the kind of stuff I enjoy reading on Tom's.
    Reply
  • mouse24
    Theses Image articles are annoying to read.
    Reply
  • TyrOd
    "In an earlier article we did on data recovery, at least one commenter noted that essentially anyone could get into the recovery business and that Flashback was a small fry operation on a completely different level than more recognized names. Of course, the proof is in the recovery results and the client roster, which includes a broad spectrum of commercial and government accounts."

    No. Nobody was conflating the physical(or financial) size of the business or name recognition with the level of their technical capabilities.

    In fact, the biggest and most recognized data recovery labs are the most notorious for abandoning attempts at complex recoveries due to the shear volume of cases they receive.

    The point that you are still missing is that everything you saw at flashback was commercially available to start-ups.

    In fact there are literally dozens of labs out their that have sprung up in the past 10 years with the same array of tools.

    One laughably obvious example of the basic marketing spin is slide 12.

    Where exactly do you think "Flashback's Special Imagers" came from?

    Hw exactly do you call a commercially available tool,sold by the thousands to data recovery start ups for years "Special".

    Also, I literally Laughed out loud when I read the bit about ASCLD cert.

    Do you really believe that ASCLD Lab Cert actual says anything about the technical capabilities of a forensic lab?

    ASCLD lab is an operational certification and it's completely irrelevant to Data Recovery Labs on the technical level.
    Hoiw do I know this? because I called them and asked.
    I verbatim said "what criteria are used to test for technical the capabilities of a proprietary piece of hardware in Recovering forensically sound images?"
    There response was "...as long as it does what you say it does"
    Funny, right?

    Though Flashback seems to be making an honest effort, at least from a marketing standpoint, of doing complex recoveries(like monolithic/SSD Flash rebuilds) it says very little about their actual ability to minimize corruption and maximize recovered data.

    I was actually impressed by the thoroughness of this article, but unfortunately it could have been done at dozens of other labs with similar technology.
    Reply
  • TyrOd
    I also want to mention that ASCLD lab is definitely a robust qualification for Forensic Labs. But it only extend it's relevance to the Computer Forensics aspects that only sparsely overlap with physical data recovery.

    you actually see a lot of this cert padding among bigger labs, because people don't understand how different a data recovery Lab is from the rest of the IT world.

    For example: If you use a piece of encryption software or Virtual machine platform of some kind and something goes wrong, how useful is having a engineer certified by the software maker?

    For the IT professional, the answer is probably "useful' generally speaking.

    What about when their are physically damaged sectors and it's not possible to recover a few hundred sectors?

    Then what?

    Well you call the encryption software maker...you get elevated to their highest level of support...and they tell you it's not possible...in fat they don't even understand the difference between bits and sectors, claiming literally every single bit has to be read to decrypt with their software.

    That's the normal everyday of how far a certification, even from manufacturers will get you in the Data recovery field.

    Beyond that you're on your own to develop solutions.
    Reply
  • Eggz
    13365168 said:
    Texts are on the right side of the images. Perhaps you need to update your browser to make images along with text visible.

    Thanks. For some reason, the computer I was using didn't update the text corresponding to pictures. So when I scrolled photos, the text for only the first photo was displayed. Got it now. Great article! Thanks for keeping a flow of stuff like this.
    Reply
  • smeezekitty
    This is why on the fly encryption is a bad idea. And not only that, its pointless.
    Because if someone has access to the drive it does exactly zero. It only stops reads directly from the flash chips.
    Reply