SSD Update Part Four. Jeff Hedlesky, Guidance Software Chris Bross, DriveSavers

Transcription

1 SSD Update Part Four Jeff Hedlesky, Guidance Software Chris Bross, DriveSavers 1

2 Master Title HD To SSD Transition 2

3 TRADITIONAL HD SALES Hmmm Something is displacing Notebook & Desktop Hard Drives 3 3

4 TRADITIONAL HD SALES Stifel MD Aaron Rakers, chief Seagate analyst: Seagate has a plan to reduce its HDD manufacturing capacity footprint by 35 per cent. April

5 Master Title SSD Flavors: A Review 5

6 SATA Introduced ~ Originally came in IDE, SCSI Crazy expensive until ± the last five years Increasingly seen as general purpose settled on a 2.5 hard drive form factor Maximum throughput ~ 600 MB/s 3D NAND will drive costs even lower, capacities higher 6 6

7 msata Introduced in 2010 msata = mini-sata Don t confuse with usata (micro-sata) Ultra-thin and embedded devices 50.8mm x 29.85mm Maximum throughput ~ 600 MB/s Already being phased out 7 7

8 M.2 Introduced in 2012 Replaces msata Ultra-thin and embedded devices Variety of sizes Multiple keyed-connectors Three types of logical interfaces M.2 is also used for Wi-Fi, WWAN, Bluetooth, GPS, NFC as well as PCIe and SATA 8 8

9 M.2 - Models Multiple options are confusing! 9 9

10 M.2 physical size 2280 (WWHH) 22mm wide x 80mm high Common M.2 sizes: 2280, 2260, 2242,

11 M.2 Connector M.2 SSDs are usually B, M or both B + M B = PCIe x2/sata M = PCIe x4/sata B + M B 11 11

12 M.2 Logical interface Three different logical interface types: M.2 SATA (AHCI) M.2 PCIe (AHCI or NVMe) All look identical physically Not really interchangeable M.2 PCIe M.2 SSD M.2 SATA AHCI NVMe AHCI 12 12

13 NVMe STANDARD NVMe = Non-Volatile Memory express New standard developed for SSDs by a group of vendors (Intel) Maximizes performance of SSD memory over PCIe Will replace aging AHCI standard for PCIe SSDs OS drivers already available 13 13

14 PCI CARD SSDs Consumer versions in 2011 Workstations and servers PCIe lane width: 2x, 4x, 8x, 16x Various form factors Similar in size to PCI video card Some PCI SSDs require custom drivers (software RAID) Will become more common as they get cheaper 14 14

15 PCI card SSDs HHHL PCIe x4 FHHL PCIe x8 HHHL PCIe x

16 U.2 SFF-8639 renamed to U.2 (June 2015) PCIe SSD in 2.5 size Up to 4x PCI lanes Similar to SATA/SAS connector 16 16

17 And what about apple? custom connector (with SATA signals) 2013 present custom connector (with PCIe signals) Incompatible with standard adapters 17 17

18 How to image apple custom SSDs? Boot Mac in Target Disk Mode and use a Tableau FireWire product (T9, TD3, T35689iu) For Macs with Thunderbolt, use a Thunderbolt to FireWire adapter Or 18 18

19 APPLE USB 3.0 SSD ADAPTER (Other World Computing) Search for Envoy adapters Different models for 2010 present MB, MBA, MBP 19 19

20 Master Title SATA Today, PCI Tomorrow Guidance Software s Solutions 20

21 New Tableau adapters M.2 PCIe adapter PCIe card adapter Compatible with upcoming Tableau PCIe products Spring / Summer

22 22 22

23 TABLEAU FORENSIC UNIVERSAL BRIDGE Natively supports write-blocked imaging of: PCIe USB 3.0/2.0/1.1 SATA FireWire 800/400 IDE SAS Read / Write mode capabilities for all device ports via internal DIP switch Write-Block or Read/Write mode visibility via colored LED indicators SuperSpeed USB 3.0 host computer connection Mounts in one 5.25 half-height drive-bay at the front of a forensic workstation 23 23

24 Questions? Jeff Hedlesky, Forensic Evangelist

25 Master Title SSD Update: From the Forensic Data Recovery Lab Chris Bross, CTO

26 GROWTH IN TOTAL GLOBAL STORAGE DEMAND 3x growth in total capacity shipped over 5 years! 26 26

27 Master Title Hard Disk Drives: Advances in HDD Technology (they aren t dead yet!) 27

28 SMR Shingled Magnetic Recording Stacking the tracks for greater density LBA to PBA translation layer required like SSD Tracks grouped into bands like SSD Slower write performance and designed for cold storage When rewriting or updating existing data, SMR drives change targeted data, and read all other data within its associated tracks in band, and then rewrite that data to a different location 28 28

29 SMR 29 29

30 HELIUM HGST, now Seagate in the game First hermetically sealed HDD to trap helium gas inside Lower power consumption Lower operating temperature Less turbulence on spindle More, thinner platters 6, 8, and 10TB! 30 30

31 HELIUM 31 31

32 HELIUM 32 32

33 KINETIC / ETHERNET HDD Seagate is the main player Ethernet interface (2) on HDD Open source API for object based storage For Hyperscale & Cloud Eliminates stack OS/FS overhead Optimized for low power and high efficiency Do you have an adapter for this one? 33 33

34 KINETIC / ETHERNET HDD 34 34

35 HAMR Heat Assisted Magnetic Recording Greater density Uses a laser to heat magnetic media when it writes the bit New media and heads required Reliability issues continue in testing 20TB+ designs proposed 2018 shipping (delayed) 35 35

36 Master Title Solid State Drives: Advances in SSD Technology & Capacity 36

37 2016 SSD MARKET LEADERS (UNITS SHIPPED) 37 37

38 QUICK HISTORY OF NAND FLASH 38 38

39 3D VERTICAL NAND FLASH Hynix, Samsung, Sandisk, Toshiba, Intel & Micron all in the game Stack the layers up to 48x for density, then stack the die 16x for capacity Larger cells increase performance and endurance and reduce latency Used with MLC and TLC NAND Lower costs lead to greater adoption Still requires garbage collection routines for self maintenance 39 39

40 3D VERTICAL NAND FLASH 3.5TB M.2 SSD using 3D NAND 40 40

41 3D VERTICAL NAND FLASH 16TB 2.5 SSD using 3D NAND 41 41

42 INTEL/MICRON 3D XPOINT MEMORY The game has changed with a new class of memory! Transistor-less cross point 3d checkerboard architecture Property Change, not Phase Change technology Memory is written at bit level where cells can be addressed individually Traditional Garbage Collection may not be required Fast, durable and dense 42 42

43 INTEL 3D XPOINT MEMORY 43 43

44 INTEL 3D XPOINT MEMORY 44 44

45 Master Title IN THE DATA RECOVERY LAB: New Technologies and Techniques for SSD 45

46 SERIAL PORT ACCESS Used when the device has a distinct and addressable NAND flash hardware controller Pins/pads may be obvious on PCB or may not be implemented Used in development and debugging by manufacturer May require IP from controller maker to interpret logs Provides ability to load special firmware In some cases allows for (very slow) physical image to be accessed 46 46

47 CHIP-OFF FOR SSD Used when there is no controller access, JTAG, ISP or serial support Any BGA or TSOP can be read at a physical layer But there are many formats and new ones emerging Multiple packages typically on PCB Data encryption obviously complicates this process, but does not make it impossible if you have manufacturer cooperation 47 47

48 CHIP-OFF FOR SSD NAND flash readers/programmers support some but not all chips, you need more than one Adapters required for each format Rework/reflow/microscope workstations essential as PCBs and chips shrink Software required to emulate controllers and determine XOR, ECC blocks and NAND bitmap info You need a bigger toolbox! 48 48

49 CASE STUDY: SSD CHIP-OFF Kingston SSD Now V series, model SNV125-S2/64GB EOL in 2010, no support available Drive appeared to be locked at BIOS level, but not password protected or encrypted No firmware access Kingston f/a engineers could not determine root cause 49 49

50 CASE STUDY: SSD CHIP-OFF Toshiba controller TH58NVG5D1DTG20 MLC NAND TSOP48 mounted, 16 packages on PCB Chip-off all NAND and clean contacts Use NAND reader/programmer to create 16 individual images/files Determine ECC layout, die order, measure block and page size, and emulate controller in software Virtually reassemble the SSD Extract best effort LBA image Recover file system and data 50 50

51 Master Title Storage Networking Industry Association: Special Interest Group (SIG) for Data Recovery/Erase 51

52 GOALS OF THE CHARTER Provide a forum for service providers, developers and SSD manufacturers to collaborate to enable data recovery and erase capabilities on solid state devices Develop standards-based technologies to make this process cost-effective, expeditious and with a high likelihood of success. H88ySD.dpuf SSD Manufacturers 52 52

53 SNIA SIG MEMBERS 53 53

54 FORENSIC EXAMINER POV Senior Director of Global Forensics for major international bank: We won t buy your SSDs unless we know they are recoverable and that they support verified secure erase capabilities. March

55 TECHNICAL WHITE PAPER IN THE WORKS Cooperative Authorship Data Erasure & Sanitization Selective Secure Erase Forensic Imaging Data Recoverability Call to Action for Standards Bodies 55 55

56 REALITY AND LOOKING FORWARD Standards bodies must understand the need to make changes Manufacturers must see the value proposition to implement changes Don t hold your breath, as changes may be slow and incremental Join the SNIA sig if you want your voice to be heard!

57 WHAT YOU NEED TO REMEMBER All Solid State storage technologies are growing in volume HDD volume is in decline Be aware of new storage technologies and challenges coming to market Look to hardware and software developers and specialized service labs to provide solutions Guidance/Tableau, TeelTech, WiebeTech, and many other resources available 57 57

58 Questions? Chris Bross, CTO