Unallocated SSD Recovery Case Study: Liteon mSATA SSD

When you first plug in a pristine hard drive or solid state drive, the drive starts out as unallocated. There’s nothing quite like the feeling of a totally new solid state drive (although, sorry, there’s no “new SSD smell”). There’s no filesystem on the drive, there are no partitions to store your data. The drive is filled with nothing but unsullied, unspoiled zeroes. You plant your flag, stake out your territory, and the brand new hard drive is yours. But sometimes a drive you’ve been using for quite some time suddenly shows up as unallocated. And this is a much less enjoyable situation. In this unallocated SSD recovery case, the data on the client’s Liteon SSD suddenly vanished.

If the drive you boot your computer from doesn’t have any boot files (or at least, none your computer can find), you’ll be met with an error message such as “Non system disk, press any key” instead of the usual startup sequence. This is the error message the client found when they started their computer up one inauspicious morning. Removing the mSATA SSD from their computer and trying to observe its contents on a different machine did nothing to soothe the client’s distress. When plugged into a different computer, the SSD showed up in disk management as “unallocated”.

Of course, the client’s Liteon SSD couldn’t be blank—it was filled with critical work-related documents that needed to be recovered. Gillware’s data recovery technicians were on the case.

Unallocated SSD Recovery

When a data storage device suddenly shows up as empty out of the blue, there can be any number of potential culprits. There could be a problem with the device’s physical components. Its firmware could be faulty. Or there could be a logical issue with the device.

Our data recovery technicians found that this unallocated SSD did, in fact, have a logical issue. A chain of logic leads your computer to the data on any storage medium, be it a hard drive, SSD, flash drive, SD card, or other device. The boot sector, superblock, file definitions, and directory structure on the device all serve as links in this chain. And if something severs even a single link in the chain, data loss results.

Data corruption can sever one of these logical links, and can occur not due to misuse or physical failure of a device, but simply as a result of the natural “wear and tear” on the device as old and overused cells in the NAND chips die out. The vast majority of this kind of corruption is harmless. But if it occurs in just the right place… the device can become inaccessible. Our engineers encountered 200 read errors over the course of imaging the client’s Liteon SSD. Some of these bad portions of the SSD just happened to be in exactly the wrong places.

In this unallocated SSD recovery case, the very first link in the chain had been severed. As a result of boot sector corruption, the client’s computers couldn’t read any of the data on the device. To them, the drive was totally blank—even though the client knew better. And the logical recovery technicians at Gillware knew better, too.

BitLocker Data Recovery

There were two major partitions on the client’s Liteon SSD, and both had been encrypted using Bitlocker. Bitlocker is a full-volume encryption tool first featured in Microsoft Windows Vista. With it, users can password-protect their hard drive or SSD with secure 256-bit AES encryption. BitLocker is one of the many full-drive encryption techniques our data recovery engineers see in our lab.

Full-drive encryption presents a few additional data recovery hurdles for our engineers. When imaging an encrypted hard drive in our lab, there’s no way to decrypt the data on the fly. We can only decrypt the data after we’ve finished making an image of the failed drive. When a device suffers from physical failures, this produces obvious complications.

Furthermore, the encryption metadata for the drives’ logical volumes exists on only a few spots on the devices. If any of these spots can’t be recovered, then our engineers can’t decrypt any of the data—even with the password. The decryption process can also take a lot of time—up to several days, in fact.

Both of this client’s partitions were encrypted with different passwords, and so each partition had to be decrypted separately. When this process finished, our data recovery technicians took a look at the results. The decryption process had gone off without a hitch. We had fully recovered the vast majority of the critical documents from the client’s unallocated SSD. Our engineers rated this Liteon SSD recovery case a 9 on our ten-point scale.