Recover data from NAND flash based drives, SD, USB pendrive, SSD, etc..
In general same procedures as with data recovery from magnetic drives. So:
- Assess / diagnose the situation
- If possible create a clone or disk image
- Recover files and folders from clone or disk image
There are also differences, for example for diagnostics we can not rely on our hearing to 'detect' mechanical damage because there are no moving mechanical parts. Since we have to do without this powerful aid, after all scratching and ticking noises are a very strong signal to stop moving a device, step 2 is even more vital.
What I am trying to say is, even if you still have access to the device, it may fail at any moment without audible warning.
1. Assess / diagnose the situation
First question you should always ask yourself is, 'what's the value of the data?'. If the answer is I can not live without it, because of monetary or emotional reasons it's best to stop tinkering sooner rather than later.
Failing flash based drives tend to fail all at once, so a binary situation, works or doesn't work. If there are however warning signs of degradation (the device being very slow for example), NAND flash based drives tend to degrade rapidly.
The main factor that decides between recovery being DIY-able is, is the device detected with the correct capacity:
If not then 99 against 1 you're dealing with a firmware issue that is most likely the result of degraded NAND.
2. Create a clone or disk image
This a mandatory step unless you only need to recover say 1 - 100 smaller files from the drive. This is highly arbitrary: you could argue simply copying these files is less taxing than cloning the entire drive. And the less stress / tax we put on the drive, the better.
To create a disk clone (drive > drive) or image file (drive > file) you'll need a tool that:
- preferably bypasses the OS for disk access
- creates a sector-by-sector disk image
- logs it's progress so you can continue even if the process is interrupted for whatever reason
- bonus points if we can configure read time-outs
There are several tools that meet these requirements, consider that you image based drive back up tool is most likely not one of those. So Norton Ghost type tools are best avoided even if they allow for bypassing of bad sectors, and offer a sector by sector image/copy option!
Examples of tools you can use:
The tools that tick all marks are HDDSuperCLone (open source) and DMDE (free version).
Generic imaging strategy:
Assuming we're imaging for example a USB flash drive or NVMe SSD with the help of a USB adapter, set up the imaging tool for SCSI I/O.
Use shortest time-out you can get away with specially during first pass.
3. Recover files and folders from clone or disk image
Once you have a disk image or copy of the drive, you bought yourself all the time in the World you need to find the best file recovery tool, without having to worry about the drive failing completely.
(For added security you can create a copy of the disk image file).
You can try/use any file recovery tool that can analyse dd type disk images, and any serious tool should be able to do so. Examples, are FileScavenger, R-Studio, UFS Explorer, DMDE, Klennet Data Recovery and many more.
Success of file recovery depends on the amount of sectors we couldn't copy, state of the file system, and the software used.
If file system is reasonably intact, any of the above tools should work. Advantage is that files are likely recoverable including the original file names and folder structure.
If not you're down to carving: a carver is a tool that ignores the file system and detects files based on magic bytes or signatures. PhotoRec (open source) is an example of an excellent carver. Carvers generate file names and can not recover the original folder structure.
Special carving cases:
If file system is damaged then generic carvers may not work to well for, for example MP4 video files. For example GoPro's produce fragmented files, so you'd need a tool that was specifically designed to reconstruct such videos (Klennet Carver, GoPro Recovery are example of such tools).
Specifics to NAND based drive recoveries
I mentioned before NAND flash based drive tend to fail sudden and in a binary fashion; they either work or they don't. There are tell-tale signs however the drive is approaching this point, they tend to get really slow, and read errors may increase rapidly.
Another peculiarity is the influence of the firmware/controller, more so than with spinning drives. An example is a read error or drop down in speed does not necessarily correspond with the sector you're trying to read. Often it's due to the firmware that stops responding to our requests and a reset + retry may return the sector without issues.
Therefore limiting time-outs is important and helpful to speed up the recovery.
One thing we can not ignore and that is very specific to NAND based drives is TRIM.
There are excellent answers to be found on this site with regards to the why's and how's of TRIM. From a data recovery perspective it's is important to realize TRIM often makes data recovery as good as impossible.
In general TRIM commands are executed as soon as we purposely delete data. So a modern OS will send a TRIM command if it deletes a file. Or if it formats a drive. TRIM is not a factor if we're for example dealing with file system corruption (like a RAW drive).
So upon deletion the OS sends TRIM commands to the SSD drive to 'tell' it about LBA sectors it no longer needs. The OS may do so immediately or on a schedule (Windows for example does both).
Simplified: Since the drive now 'knows' the data in these LBA addresses can be considered deleted it will return zero filled sectors when we try to recover data from these sectors. In effect the data has thus become unrecoverable. Even if we can recover files (because file system meta data itself is not trimmed), it will be zero filled sectors (demonstration).
Modern SSD's, modern SSD enclosures support TRIM. SD and CF cards support TRIM like commands, USB Flash Drives do not.
Professional data recovery
A data recovery specialist offers some advantages:
- he/she does not need to discover how to best recover the drive, he can rely on experience.
- he/she has the tools to efficiently clone/image the drive
- in case of firmware issues he/she may be able to bypass these issues.
Reviving 'dead' drives
Often asked variants of the question "how to recover data from .." is , "can I somehow revive my failed SD card, USB flash drive, SSD?".
In general the answer to the question is 'no'. Often the firmware 'issue' is the result of an underlying problem which is not resolved by repairing the firmware. So the question on should really ask IMO is, "even if it were possible to repair the device, should I, if it means I end up with an unreliable drive, that has already failed me before?".