Forensics 101

Techno Mode – The Fastest Way To Access Digital Evidence On Damaged SSDs

by Roman Morozov, NAND Data Recovery Tutor, ACE Lab

Recent statistics show that solid-state drives are getting a good share of the market of storage devices. And the popularity of SSDs is only expected to grow. There is already a large number of little-known manufacturers, who cut corners on parts of their drives. As a result, numerous low-quality products that can easily fail hit store shelves.

Digital forensic experts have to be prepared for this and are always looking for efficient ways of solving issues that may arise in their daily work. Almost all present-day SSDs have hardware data encryption. That’s why the chip-off method becomes useless for accessing the digital evidence on a damaged device. In this case, the Techno Mode is the only possible way to restore logical access to data on the SSD.

This article will explain the reason SSDs break down without exhausting the number of available rewriting cycles and will provide a method to access the data on devices that have ceased to function. To understand better how it works, let’s start with an overview of SSD internal structure.

Today’s SSDs are manufactured based on NAND Flash microchips. As with any sophisticated electronic devices, these chips are subject to technological aging. This is foremost due to the memory cells, the base of NAND Flash chips, wearing out and being unable to keep an electric charge.

A layer of special insulation separates the cells of a chip. On every process of writing and rewriting, a memory cell gets a current of 12V that punches through insulation and remains inside. The thinner this layer of insulation, the fewer cycles of rewriting any particular chip can bear.

Modern chips are produced under minimal techno processes – 19nm, 15nm, 14nm. As such, their lifespans are not expected to be very long. In addition, most affordable SSDs are manufactured with the cheap TLC memory type (Triple Level Cell). This memory type stores 3 bits of info in every cell, thus expanding the amount of storage space. However, TLC-based NAND Flash devices are very unreliable and are much more prone to malfunctions. Anywhere between 30 and 90 cycles of rewriting are enough to reach a critical number of damaged cells. Compare this to SLC (30000 to 100000 cycles) and MLC (1000 to 5000 cycles) microchips for a second!

However, all that can’t be a reason for a newly bought SSD with an available memory of 128-512 GB to malfunction: just think of the time needed to rewrite the whole of a storage space!

Service Area and Data Placement Area in SSD

Solid State Drives have a special space that is called the Service Area (SA). This area is dedicated to service components, modules, special tables, parts of a microcode, firmware info, etc. Changes made in a user Data Area (DA) register into the so-called translator tables that reside inside the SA. The SA has a fixed (and a very small) portion of the whole available storage space, thus writing and rewriting of service information may quickly exhaust the number of bearable cycles. Even 20 or 30 cycles may be enough to clog up the SA with damaged cells and completely break the translator. Typically, in such cases, SSDs show the following symptoms: up to 2 Mb of free space available, a constant BSY state of the drive, ABR error on addressing the DA, or a total inability to register the drive in device manager. However, there is a cure that can help to access the data even on a seemingly dead device.

All SSDs come with a pre-manufactured Techno Mode. This special mode is designed to debug devices; manufacturers use it to examine broken drives in order to identify the damaged part of a microcode and address the cause in future firmware versions.

Access to the Techno Mode – with a software command and with a hardware shorting

ACE Lab engineers took this a step further. Years of research produced a method of using the Techno Mode to actually restore an access to data on damaged SSDs.

This is achieved by the use of specific utilities that force the damaged device into the Techno Mode. Since the most common cause of SSD malfunctions is a broken translator, the Techno Mode gives an ability to build a new one from parts of firmware. A new translator is uploaded into the RAM of the device, a task is created in the special software, and the user gets full access to the file structure of the SSD.

PC-3000 SSD Utilities may help to:

  1. Get access to Service Area
  2. Build a translator to access the digital evidence
  3. Receive information on the number of memory chips and logical parts
  4. Save the images of chips without soldering the NAND
  5. Temporarily disable the TRIM command
  6. Detect the passwords previously set on SSDs
  7. View defects of memory chips with a Defect manager
  8. Use Low-Level Format commands to format the drives and restore the original Repair Functions

At the moment PC-3000 SSD supports a wide range of Solid State Drives of many vendors: ADATA, AMD, Corsair, Crucial, OCZ, Intel, Kingston, Micron, Patriot, Plextor, Lite-On, PNY, Samsung, SanDisk, Seagate, Silicon Power, Smartbuy, GoodRAM, Seagate, G.Skill, RunCore and others.

A lot of SSDs are manufactured with the universally used Techno Mode, so the outlined method may be applied to various devices. However, SSDs often come with their own versions of Techno Mode. Even two similar models of, say, Plextor, Sandisk, Micron or Crucial may have different pairs of “Firmware-Controller”. ACE Lab conducts constant research in order to enhance the method, the software and tools, to include every known brand and producer.

In addition, to restore the operability of damaged SSDs, the Techno Mode may help with recovering deleted files that usually can be completely erased in a few hours. Another important advantage of using the Techno Mode is an ability to both bypass and detect the passwords previously set on SSDs. This option is very beneficial when a criminal uses the same password on a computer, cell phone, email account or other drives.


ACE Lab is internationally recognized as an innovator in the development of the most cutting-edge solutions for recovering data and evidence from storage devices like HDD, SSD, Flash drives, RAID and others. ACE Lab has set the benchmark for professional data recovery and remains the proven leader in the field for 26 years since its foundation in 1992. Data recovery engineers and digital forensics experts from over 115 countries award their trust to the PC-3000 solutions as the most comprehensive and reliable professional data recovery tools.

About scar

Scar de Courcier is an assistant editor at Forensic Focus.

Discussion

No comments yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,146 other followers

%d bloggers like this: