Ready for Takeoff

Restoring Data on SSDs

More and more data in companies are stored on SSDs or flash drives. If files are lost, you have to take a different approach when restoring data to SSDs than you would for magnetic disks. Many recovery tools work with normal hard disks as well as with SSDs, but some tools support SSDs better and can recover files more efficiently. The tools not only help restore data on SSDs but also help recover lost data on USB sticks and SD cards.

When you save a Word document to a normal hard disk while editing, Windows always stores the file in the same place. The file grows with time, but it can be found easily by employing additional tools. However, SSDs work differently. The SSD controller stores each version to a different location on the SSD, which naturally complicates the recovery of data.

If a file has been deleted, you first have to find out which version you want to restore – a bit of a problem with frequent saves. The first step to restoring lost data on SSDs is to find the different versions. Only then should you start the restore. Sometimes it might be useful to restore multiple versions, which I'll show you how to do below.

One reason for data loss is that individual memory cells on SSDs and other flash drives can break down and become unreliable over time. If data is stored in compromised areas, it often cannot be restored. If the controller detects such areas, it marks them and, from then on, prevents data from being stored there. You can display such information with SDD management tools.

Therefore, it makes sense to install the vendor management tools on computers with SSDs and to check the SSDs regularly. On SSDs and other storage drives, it's not uncommon for no fewer than 128 storage units to be affected by bad sectors. Even if just one page is defective, the controller marks the entire area as unusable. The remaining 127 pages are basically still readable, but the controller blocks access to them.

Restoring Data

If you store data on SD cards, USB sticks, or SSDs, just one click is all it takes to delete all the files. Even if the confirmation queries in Windows and the recycle bin are deactivated or the recycle bin is full, additional tools need to be used to restore the data.

Because of TRIM technology, mentioned previously, you have to be careful when restoring. With normal hard disks, files marked as deleted can be overwritten immediately without doing anything to the data in those files. However, SSDs and other flash memory devices do not work this way: The controller truly has to delete existing data that are no longer needed. Controllers normally run these processes if a certain memory area is idle, which means that on SSDs and flash drives, it is possible a deleted file has in fact been completely removed, and not just its entry in the filesystem's allocation table.

The sooner you notice that data is deleted, the easier it will be to restore it. If the deletion process occurred a while ago, restoring can cause significant problems and decrease the chances of being able to recover the file. Another important aspect in this context is booting the computer. During every Windows startup, the operating system overwrites deleted files on SSDs and flash drives. If you want to restore data, you should avoid rebooting.

If you have already shut down the computer, you should not boot the operating system; instead, use a rescue CD or DVD. If you do not have any access to the hard disk at all, the controller itself is usually defective. In this case, additional tools will not help you either. In rare cases, management tools by SSD vendors or experts who specialize in defective hardware (e.g., Kroll Ontrack [5] or Stellar [6]) can help.

If the drives are encrypted and the controller is defective, major problems will arise when restoring the data. Even after "secure deletion" of data using additional tools, the data is often unrecoverable (which is the original purpose) and, if so, then only by specialists.

Recuva Freeware

Recuva [7] is the most popular tool for recovering data on SSDs and flash drives. To begin, install the software on the computer with the deleted data and accept the default options. On launching, Recuva comes up with a wizard that supports data recovery.

The procedure is always the same: First, you select the data you want to recover and where it was stored. Second, you scan the disk for deleted files; however, the tool rarely finds deleted files on SSDs. Therefore, the best thing to do is search the computer once again with a deep scan. Whereas a simple scan takes only a few seconds, a deep scan can take several hours. After scanning, Recuva shows the deleted files it found. You can then restore your desired files.

If neither the normal scan nor the deep scan find all deleted files, you can click Switch to advanced mode and then choose Options . In the Actions tab, you can choose to display hidden files and zero-byte files, as well as securely overwritten files. These options are useful if, for example, you have formatted a drive. You will only find the data again with these options, if at all.

After scanning, Recuva displays the files it found in a preview. If the tool cannot display a preview, the files are often destroyed, and at best, only parts of them can be restored. In addition to the preview, you can display the files as a list. The color of a file indicates its status. Recuva distinguishes between green (easily recoverable), yellow (partially defective), and red (destroyed) data. However, do not rely solely on the colors; a restore test is always useful. To restore files, select them, press the Recover button at bottom right, select the directory for the restored files, and check the files when done.