SSD Update Part Four Jeff Hedlesky, Guidance Software Chris Bross, DriveSavers 1
Master Title HD To SSD Transition 2
TRADITIONAL HD SALES Hmmm Something is displacing Notebook & Desktop Hard Drives 3 3
TRADITIONAL HD SALES Stifel MD Aaron Rakers, chief Seagate analyst: Seagate has a plan to reduce its HDD manufacturing capacity footprint by 35 per cent. April 2016 4 4
Master Title SSD Flavors: A Review 5
SATA Introduced ~ 2004-2007 Originally came in IDE, SCSI Crazy expensive until ± the last five years Increasingly seen as general purpose settled on a 2.5 hard drive form factor Maximum throughput ~ 600 MB/s 3D NAND will drive costs even lower, capacities higher 6 6
msata Introduced in 2010 msata = mini-sata Don t confuse with usata (micro-sata) Ultra-thin and embedded devices 50.8mm x 29.85mm Maximum throughput ~ 600 MB/s Already being phased out 7 7
M.2 Introduced in 2012 Replaces msata Ultra-thin and embedded devices Variety of sizes Multiple keyed-connectors Three types of logical interfaces M.2 is also used for Wi-Fi, WWAN, Bluetooth, GPS, NFC as well as PCIe and SATA 8 8
M.2 - Models Multiple options are confusing! 9 9
M.2 physical size 2280 (WWHH) 22mm wide x 80mm high Common M.2 sizes: 2280, 2260, 2242, 22110 2280 2260 2242 10 10
M.2 Connector M.2 SSDs are usually B, M or both B + M B = PCIe x2/sata M = PCIe x4/sata B + M B 11 11
M.2 Logical interface Three different logical interface types: M.2 SATA (AHCI) M.2 PCIe (AHCI or NVMe) All look identical physically Not really interchangeable M.2 PCIe M.2 SSD M.2 SATA AHCI NVMe AHCI 12 12
NVMe STANDARD NVMe = Non-Volatile Memory express New standard developed for SSDs by a group of vendors (Intel) Maximizes performance of SSD memory over PCIe Will replace aging AHCI standard for PCIe SSDs OS drivers already available 13 13
PCI CARD SSDs Consumer versions in 2011 Workstations and servers PCIe lane width: 2x, 4x, 8x, 16x Various form factors Similar in size to PCI video card Some PCI SSDs require custom drivers (software RAID) Will become more common as they get cheaper 14 14
PCI card SSDs HHHL PCIe x4 FHHL PCIe x8 HHHL PCIe x8 15 15
U.2 SFF-8639 renamed to U.2 (June 2015) PCIe SSD in 2.5 size Up to 4x PCI lanes Similar to SATA/SAS connector 16 16
And what about apple? 2010 2012 custom connector (with SATA signals) 2013 present custom connector (with PCIe signals) Incompatible with standard adapters 17 17
How to image apple custom SSDs? Boot Mac in Target Disk Mode and use a Tableau FireWire product (T9, TD3, T35689iu) For Macs with Thunderbolt, use a Thunderbolt to FireWire adapter Or 18 18
APPLE USB 3.0 SSD ADAPTER www.macsales.com (Other World Computing) Search for Envoy adapters Different models for 2010 present MB, MBA, MBP 19 19
Master Title SATA Today, PCI Tomorrow Guidance Software s Solutions 20
New Tableau adapters M.2 PCIe adapter PCIe card adapter Compatible with upcoming Tableau PCIe products Spring / Summer 2016 21 21
22 22
TABLEAU FORENSIC UNIVERSAL BRIDGE Natively supports write-blocked imaging of: PCIe USB 3.0/2.0/1.1 SATA FireWire 800/400 IDE SAS Read / Write mode capabilities for all device ports via internal DIP switch Write-Block or Read/Write mode visibility via colored LED indicators SuperSpeed USB 3.0 host computer connection Mounts in one 5.25 half-height drive-bay at the front of a forensic workstation 23 23
Questions? Jeff Hedlesky, Forensic Evangelist jeff.hedlesky@guid.com 314.702.0009 24
Master Title SSD Update: From the Forensic Data Recovery Lab Chris Bross, CTO Chris.bross@drivesavers.com 415.225.0383 25
GROWTH IN TOTAL GLOBAL STORAGE DEMAND 3x growth in total capacity shipped over 5 years! 26 26
Master Title Hard Disk Drives: Advances in HDD Technology (they aren t dead yet!) 27
SMR Shingled Magnetic Recording Stacking the tracks for greater density LBA to PBA translation layer required like SSD Tracks grouped into bands like SSD Slower write performance and designed for cold storage When rewriting or updating existing data, SMR drives change targeted data, and read all other data within its associated tracks in band, and then rewrite that data to a different location 28 28
SMR 29 29
HELIUM HGST, now Seagate in the game First hermetically sealed HDD to trap helium gas inside Lower power consumption Lower operating temperature Less turbulence on spindle More, thinner platters 6, 8, and 10TB! 30 30
HELIUM 31 31
HELIUM 32 32
KINETIC / ETHERNET HDD Seagate is the main player Ethernet interface (2) on HDD Open source API for object based storage For Hyperscale & Cloud Eliminates stack OS/FS overhead Optimized for low power and high efficiency Do you have an adapter for this one? 33 33
KINETIC / ETHERNET HDD 34 34
HAMR Heat Assisted Magnetic Recording Greater density Uses a laser to heat magnetic media when it writes the bit New media and heads required Reliability issues continue in testing 20TB+ designs proposed 2018 shipping (delayed) 35 35
Master Title Solid State Drives: Advances in SSD Technology & Capacity 36
2016 SSD MARKET LEADERS (UNITS SHIPPED) 37 37
QUICK HISTORY OF NAND FLASH 38 38
3D VERTICAL NAND FLASH Hynix, Samsung, Sandisk, Toshiba, Intel & Micron all in the game Stack the layers up to 48x for density, then stack the die 16x for capacity Larger cells increase performance and endurance and reduce latency Used with MLC and TLC NAND Lower costs lead to greater adoption Still requires garbage collection routines for self maintenance 39 39
3D VERTICAL NAND FLASH 3.5TB M.2 SSD using 3D NAND 40 40
3D VERTICAL NAND FLASH 16TB 2.5 SSD using 3D NAND 41 41
INTEL/MICRON 3D XPOINT MEMORY The game has changed with a new class of memory! Transistor-less cross point 3d checkerboard architecture Property Change, not Phase Change technology Memory is written at bit level where cells can be addressed individually Traditional Garbage Collection may not be required Fast, durable and dense 42 42
INTEL 3D XPOINT MEMORY 43 43
INTEL 3D XPOINT MEMORY 44 44
Master Title IN THE DATA RECOVERY LAB: New Technologies and Techniques for SSD 45
SERIAL PORT ACCESS Used when the device has a distinct and addressable NAND flash hardware controller Pins/pads may be obvious on PCB or may not be implemented Used in development and debugging by manufacturer May require IP from controller maker to interpret logs Provides ability to load special firmware In some cases allows for (very slow) physical image to be accessed 46 46
CHIP-OFF FOR SSD Used when there is no controller access, JTAG, ISP or serial support Any BGA or TSOP can be read at a physical layer But there are many formats and new ones emerging Multiple packages typically on PCB Data encryption obviously complicates this process, but does not make it impossible if you have manufacturer cooperation 47 47
CHIP-OFF FOR SSD NAND flash readers/programmers support some but not all chips, you need more than one Adapters required for each format Rework/reflow/microscope workstations essential as PCBs and chips shrink Software required to emulate controllers and determine XOR, ECC blocks and NAND bitmap info You need a bigger toolbox! 48 48
CASE STUDY: SSD CHIP-OFF Kingston SSD Now V series, model SNV125-S2/64GB EOL in 2010, no support available Drive appeared to be locked at BIOS level, but not password protected or encrypted No firmware access Kingston f/a engineers could not determine root cause 49 49
CASE STUDY: SSD CHIP-OFF Toshiba controller TH58NVG5D1DTG20 MLC NAND TSOP48 mounted, 16 packages on PCB Chip-off all NAND and clean contacts Use NAND reader/programmer to create 16 individual images/files Determine ECC layout, die order, measure block and page size, and emulate controller in software Virtually reassemble the SSD Extract best effort LBA image Recover file system and data 50 50
Master Title Storage Networking Industry Association: Special Interest Group (SIG) for Data Recovery/Erase 51
GOALS OF THE CHARTER Provide a forum for service providers, developers and SSD manufacturers to collaborate to enable data recovery and erase capabilities on solid state devices Develop standards-based technologies to make this process cost-effective, expeditious and with a high likelihood of success. http://www.snia.org/forums/sssi/dresig#sthash.ul H88ySD.dpuf SSD Manufacturers 52 52
SNIA SIG MEMBERS 53 53
FORENSIC EXAMINER POV Senior Director of Global Forensics for major international bank: We won t buy your SSDs unless we know they are recoverable and that they support verified secure erase capabilities. March 2016 54 54
TECHNICAL WHITE PAPER IN THE WORKS Cooperative Authorship Data Erasure & Sanitization Selective Secure Erase Forensic Imaging Data Recoverability Call to Action for Standards Bodies 55 55
REALITY AND LOOKING FORWARD Standards bodies must understand the need to make changes Manufacturers must see the value proposition to implement changes Don t hold your breath, as changes may be slow and incremental Join the SNIA sig if you want your voice to be heard! http://www.snia.org/forums/sssi/about/join 56 56
WHAT YOU NEED TO REMEMBER All Solid State storage technologies are growing in volume HDD volume is in decline Be aware of new storage technologies and challenges coming to market Look to hardware and software developers and specialized service labs to provide solutions Guidance/Tableau, TeelTech, WiebeTech, and many other resources available 57 57
Questions? Chris Bross, CTO Chris.bross@drivesavers.com 415.225.0383 58