Case Study

Recovered Data from Failed SSD with Firmware Corruption

150 GB inaccessible data, with no backup

Published On : Aug 14, 2019

Overview

This case overviews recovery of data from a physically failed Kingston^®Solid State drive (SSD) - model SA400S37 with 240 GB storage capacity.

The user had reported an inability to access the data stored on the SSD because the drive was unable to initialize. Despite making repeat attempts to access the device on different host devices and via different USB cables, the drive had failed to initialize and remained inaccessible.

Previously, the user had reportedly come across common drive failure indicators such as “no boot device” error, read-only state, and Blue Screen of Death, however he had continued using the device. Consequently, the SSD failed due to which the 150 GB data stored on the drive had reached an inaccessible state, with seemingly no possibilities of recovering it. Unfortunately, there was no backup of this data.

The user sought the data recovery expertise of Stellar^® and submitted the drive at one of the company’s service centers. Initial examination of the SSD at Stellar^® data recovery lab revealed that it had been physically tampered, as the casing had distinct scratches and one of the NAND chips was found slightly dislodged.

It turned out after enquiring with the client that the drive had been previously handed over to a local data recovery service vendor without prior validation of their competency for the job. This could be an expensive mistake with potential to jeopardize the data. Later on, after lab diagnosis of the SSD, Stellar^® data recovery experts found that firmware of SSD was corrupted due to which it was unable to initialize.

Dismantled Kingston^® SSD model SA400S37

Problem Statement

Recover data from a self-encrypting SSD that had failed due to firmware corruption.

Data Recovery — Challenges and Approach

Stellar^®data saviors identified 3 distinct areas of challenge in this case—

Firmware corruption which was the root cause of this problem, due to which the controller couldn’t initialize the drive to read/write information on the NAND chips.
AES-256 self-encryption due to which all the information on the SSD was by default in an encrypted form. Though the encryption key was stored in the SSD, finding it in absence of the controller was virtually impossible.
Impossibility of using disk imaging as a standard procedure for recovery from physically failed drives because the controller wasn’t available to tackle aspects such as error correction, address translation and decryption.

Data Recovery Approach

Recognizing this as an exceptionally complicated case, the data care experts at Stellar^®decided to employ Factory Access mode for data recovery. Factory Access mode is a highly sophisticated procedure that involves forensic imaging of SSDs for recovering the information.

Note: There are no documented procedures, set practices or commands for switching an SSD into Factory Access mode or accessing the data in that mode. Factory Access mode is only available to the service centers of OEMs.

The data care experts at Stellar^® employed the following steps for data recovery:

Switch Over to Factory Access Mode: Connected the SSD to a special NAND reader which switched the drive to Factory Access mode by sending a service command to the SSD controller.
Read the Firmware and System Areas: Read the SSD service area to reconstruct the damaged translation tables and rewrite the microcode.
Refreshing the Controller RAM with Fresh Code: Uploaded the microcode, translation table and other system data to the SSD controller RAM
Creating a Standard Image of the SSD: Scanned the SSD (comprising 4 storage chips with each chip having 2 parts) for creating a standard image to facilitate logical data recovery process.
Data Recovery through Disk Image: Used a proprietary data recovery software to scan the SSD image and recover 150 GB of lost data.

Result

Stellar^® data care experts managed to recover the complete data from the SSD. Further, the data was recovered with 100% integrity and delivered within the committed timeline.Stellar is global leader in data recovery and our experts have expertise and experience in recovering data from all type of Solid State Drives. Read more about our SSD Data Recovery experties .

Related Article: Some Common Warning Signs Of SSD Failure