The buzzword of the year is “cloud,” and it carries with it an implication that your data is somewhere magical and safe, and in a way, it is. But there’s no getting around the fact that our appetite for storage is increasing by leaps and bounds, whether it’s stored locally or remotely. There’s always the possibility of catastrophic failure, and of course the flip side of that is that there is always the need to instantly and permanently delete our data.
I’ve always found both necessities, and the methods for achieving them, interesting topics. And with densities increasing and SSDs on the rise, the recovery and security scene is getting more complex by the day. I spoke with Chris Bross, a data recovery expert at DriveSavers, in order to get a feel for what the recovery practices are out there today.
Drives by the billion
The hard disk drive market today, says Bross, is vastly different from what it was like 20 years ago. Manufacturers have consumed one another until there are essentially only two majors today: Western Digital and Seagate. All told over 650 million hard drives are sold every year, and as the price per gig is still far better for HDDs, that number isn’t likely to go down any time soon. Enterprise and cloud storage are still exploding.
Naturally, as these numbers go up, the failure numbers go up as well. Just the failure rates resulting from natural manufacturing tolerances and such produce millions of failed drives per year (remember that many drives stay in service for years, making the total number of active HDDs in the world somewhat difficult to estimate), and in addition to that, there are huge amounts of catastrophic-type failures like dropped drives, water damage, and crush damage.
In fact, DriveSavers has been offering its recovery services for free to people affected by the tsunami in Japan. Water damage is a common and well-understood failure — unlike, say, irradiation or a corrupted driver.
Chris mentioned that they have a sort of symbiotic relationship with drive manufacturers: Drivesavers gets access to special tools for recovering data, and the manufacturers get access to a ton of failure data (some interesting examples here). That relationship is important, since the huge volume means manufacturers can’t address every issue, and the increasing density and precision of hard drives makes recovery more difficult every year. But as long as the platters are reasonably intact, it’s just a matter of careful dissection and re-mounting the drives.
Solid state difficulty
SSDs are a different story. Bross pointed out that the situation out there is more like a couple decades ago in HDDs, when there were a dozen or more drive manufacturers. By DriveSavers’ count, there are over 100 manufacturers of flash and SSD storage, and quite a few companies putting together drivers, interfaces, and other management software. It’s a jungle out there.
Interestingly, the first generation of SSDs, which relied on single-layer cell technology, was far more reliable than the current multi-layer cell devices; reliability per cell was much higher — but the drive controllers were primitive. Major advances in write patterns, wear control, and so on are rolling out constantly, and it’s difficult to stay abreast of all the different kinds of failures possible out there. Failure rates on SSDs are still relatively high (though data is hard to come by and harder to interpret), so consider yourself warned.
A failure on an SSD can happen in a number of ways, and unlike HDDs, it seems that they are more likely to fail irrecoverably than in a way you can reverse. This is partially due to the way data is written on the drives — the new MLC flash necessitates an almost random pattern of writes in order to control cell wear, and if this pattern can’t be derived from the driver or encryption, the drive is essentially filled with garbage data.
Sanitation services
This same “problem” is in fact a powerful security feature. One of the services DriveSavers offers, though you can of course do it yourself, is “drive sanitation.” It’s when you want to be absolutely sure that data isn’t recoverable, and SSDs make that an easy job.
On normal HDDs, zeroing out the drive can take quite a long time, and with the right tools there’s no guarantee formatting or zeroing is enough. There are more industrial-strength techniques for killing a drive (DriveSavers degausses the drive and then puts it in a “crush box” for total destruction), but as it turns out, the most practical thing is to use a self-encrypting drive. If you’re concerned about security, this is a must. They cost a bit more and you’ll have to manage the encryption via software, but by “losing” the encryption key, the data is instantaneously rendered unrecoverable.
SSDs are naturally encrypted, since it’s built into the drive controller. Again, by losing the key or destroying the encryption device, the data is instantly rendered garbage, even to professionals. Technically the data is still there, though, so the ultra-paranoid data sanitation expert will actually grind down the SSD to dust. Short of nuking from orbit, it’s the only way to be sure.
My final question was regarding that situation we all fear may come one day: you look out the window some day and lo, there are black helicopters descending. They’re here for you — and your precious data. You have 30 seconds before they break down the door. How do you make sure they can’t get a single byte off those drives? It turns out that no amount of sledgehammering or thermite can do as thorough a job as a 256-bit encryption process can do by throwing away the key. Plus, sledgehammering your drives looks kind of suspicious. Just sit calmly down, go to your disk encryption manager, and hit the appropriate button. Then turn off your computer, sit down on the couch and look innocent.
The world of drive recovery is always growing more sophisticated, but the take-home message is that there’s no excuse not to back up. If your data is worth sending to someone to be recovered, it’s worth paying for an extra drive and some backup software, or even better, an off-site service. It’s also nice to know that these days, your data is exactly as secure as you make it — that is, if it’s within reach.
[header image credit: Seagate]