Data Storage Devices and Data Recovery
Complementary to my previous article on data privacy, here we are to take a peek into data storage devices and data recovery. It might seem these two topics, “Storage Devices” and “Data Recovery” should be addressed separately. Yet, I thought it might be better to combine the two since having a better understanding of the data storage devices will help to understand how and why data recovery works the way it does. So let’s start with a brief introduction into HDDs and SSDs.
Hard Disk Drives, aka HDDs store data in rotating magnetic disks. These disks consist of data tracks. The tracks include blocks. Each magnetic disk has a read/write head placed above it, which allows reading data from the disk. If you have ever seen a gramophone, then you can visualize the interior of a hard drive as an advanced implementation of the gramophone. (Of course without the sound horn in Gramaphone). The read/write head will read data in the magnetic disks at the block level. That means if you need to acquire data in a specific block, you will have to read the whole block, regardless of how small the amount of data you need to retrieve. Reading data from a mechanically spinning disk takes precision and an ample amount of time. The head has to wait for the disk to rotate and align with the specific block that contains the data, then read the block of data and transfer it to RAM for processing.
If you are interested in reading more about how hard disks work. See Hard drives.
Solid State Drives comes from a different world than that of HDDs. As the name suggests, SSDs have no spinning or moving parts. Instead, they consist of non-volatile NAND flashes. Unlike the HDDs, which comprised of tracks, SSDs consist of blocks. Each block has a set of pages. SSDs take advantage of having no moving parts, which increase the data read/write speed dramatically when compared with traditional SSDs. Sounds cool? Why use HDDs anymore, let’s throw them out and switch to SSDs? Hold on to your thoughts for a while.
One apparent reason why we are still using HDDs is that SSDs are relatively expensive. Apart from that, while it’s true, SSDs possess far superior performance when it comes to reading and writing data on empty pages, SSDs struggle with overwriting/deleting data. The reason is, even though SSDs are capable of reading/writing data at the page level, the current technology limits its ability to delete data only to block-level. So whenever it has to overwrite or delete some pages of data, first, it has to copy the corresponding block of data to the RAM, make changes or delete the pages and rewrite the whole block back to the drive (clear the block and rewrite). This overhead of transferring an entire block back and forth takes additional time, which we can avoid if we were able to delete data on a page level.
As we discussed above, one major drawback of SSDs is slowness in overwriting data. What if we don’t have to overwrite data at all. Yes, that’s where overprovisioning becomes helpful. It maintains a reserved space on the SSD, a set of empty blocks so that whenever the drive has to write new data, overprovisioning will guarantee that empty blocks are available at disposal for writing the data. How does it achieve this functionality? It moves pages from partially filled blocks into other blocks until a predefined number of blocks are entirely empty. So that whenever the drive has to write new data, it doesn’t have to wait until blocks are clear since overprovisioning has already taken care of clearing the blocks for you. The overprovisioned disk space is not available for users since the SSD manages it. That’s why you might see reduced disk sizes in SSDs than the usual HDD counterparts.
Read more on overprovisioning: Understanding SSD Over-provisioning (OP)
I already mentioned that the SSDs consist of NAND flashes, and they are super fast when compared with traditional HDDs. However, there is a catch to that. The NAND flashes only have a definite number of program/erase circles. After that, the NAND flashes become unreliable for storing/writing new data. If the same set of blocks are used repetitively and excessively than the other blocks, they will wear more quickly than the rest of the blocks. To even out the wearing of the blocks, wear leveling takes care of managing the blocks and to provide the least-used blocks for next write cycles. Hence making sure that the SSD remains reliable for the maximum number of write cycles. So eventually, the higher the capacity of the device, the higher the number of blocks available for writing data. Hence lifespan of an SSD increases with its size. If you are interested in finding out how long your SSD will last before wearing out, refer to the link below for more details.
In short, overprovisioning takes care of performance while wear-leveling takes care of the durability of the device.
How does data recovery work?
Okay, since now we have a rough idea of how the storage devices work, let’s see how the so-called recovery software magically recover deleted data from your hard disks. After all, there no magic to it at all. You’ll see.
Have you ever noticed that deleting a large data file takes less time than copying it to another directory? Or moving a file within a partition takes less time than moving a file between storage devices or partitions? Here’s the trick. When you are deleting a file, what the operating system does is just removing the file index from the partition table. So the operating system will not have to spend more time deleting every bit of data. The same thing happens when you perform a quick format on a drive; it just recreates the partition table leaving the data files intact. When you need to write new data, the operating system will consider the blocks containing the deleted files (files already removed from the partition table) as free space and overwrite it with new data. This shortcut method of removing files is one technique used in operating systems to increase file management performance.
Recovery software depends on the data which has not been overwritten with new data and uses various algorithms to identify the file types and allows the user to recover the files. That’s why experts recommend not to make any modifications to the drive if you have accidentally deleted some files and need to recover. More data you write to the drive, the lesser the chance you will have in successfully recovering your deleted files since there is a chance they might get overwritten by new data. Especially if your storage device is an SSD, there is a chance overprovisioning will automatically clean the data blocks even without you noticing. The most common practice in such cases is to create a bitwise backup of the drive and performing the recovery operations on the copy made. (Unlike a regular copy, a bitwise copy is a bit by bit copy of the storage device. So it will include the data from deleted files as well. )
What if I want to delete data permanently?
In case you are going to sell your laptop, mobile phone, or any other device, it is a good practice to wipe your storage clean to avoid any of your data getting compromised. (I explained this in my previous article Level Up Your Mobile Data Privacy) While there are built-in features in modern operating systems to allow you to wipe your system clean, there are a bunch of free tools for both computers and mobile devices available, which erases the storage for you. (I would recommend wiping only the free space to avoid any system files from getting deleted. If you don’t want to leave the system files as well, go ahead and do a full wipe.) I have tried these free apps for both mobile and laptop for wiping and recovery, and they seem to be doing just well enough. Some research papers suggest that you need to overwrite the disks with random bits multiple times to ensure that data is beyond recoverable. However, It would require advanced professional-level forensic data recovery tools to make it possible to achieve that level of recoverability.
For more curious minds, I will drop the following link for further reading. Computer Forensic Investigation on Hard Drive Data Recovery: A Review Study
Is that it? That’s enough?
Recent technological improvements have made it possible to recover data from wiped HDDs as well. Up until this point, I haven’t found any sources mentioning the possibility of recovering data from wiped SSDs. I will direct you to an old but exciting research paper written on that. Secure Deletion of Data from Magnetic and Solid-State Memory
If you have read my previous article, Level Up Your Mobile Data Privacy, you know how I concluded the article about security. I guess I will have to say the same about recovery. You can’t be too sure that anything is non-recoverable (Unless you physically destroy the drive). Maybe the future is holding surprises for us on that. Or perhaps those technologies are not so popular yet ;) If you know what I mean. Well, we are not here to discuss conspiracy theories, are we? Thanks for reading, and I hope it was worth your while. Don’t hold back, drop a comment below, if you have any further questions.