I understand that I might be in a situation that I need a professional
to try recovering data. But what I would like to know, for my
edification, is what exactly would a professional do?
The 'pro'
The difference between you and a data recovery specialist is that he gets cases like this all the time, and more often than not the specialist is not on an island but embedded in a network other data recovery specialists. At least that's my experience considering independent data recovery labs that I am familiar with. Fun fact may be that there's no school one can visit to become a data recovery specialist.
So as a result a lot of knowledge and potential solutions may be known or accessible to the data recovery specialist.
For example, specific models may be 'recovered' from some firmware issue by simply switching the drive to 'techno mode' and back. Some models are known to self-recover in specific cases by simply giving them time while only being connected to power.
Some models 'like' some heat using a pre-heater, some respond better to applying cold. Such solutions may seem rather amateurish but heat and cold influence NAND quantum processes and are often based on experimentation and experience. Just randomly applying these methods may accomplish the opposite (of recovery).
So what would he/she do?
Diagnostics
Often process starts by a non invasive inspection. So this may be visual inspection under a microscope (you'd be surprised how often damage, unseen by the naked eye is obliviously obvious under a microscope), simple measurements using a multi-meter. An off-spec filtering capacitor can be enough to render a SSD drive useless.
Then at some point briefly connecting the device can not be avoided. While being connected we can observe if a component gets abnormally hot (suggesting a short-> replace component if possible).
Repair and NAND 'swap'
If the 'PCB' is damaged beyond repair then transplanting NAND chips to a matching donor can be tried. This only works if the firmware is on the NAND chips themselves and involves unsoldering and re-balling the NAND chips. While this can be done using relatively inexpensive tools by anyone IMO, not making things worse requires experience and what the German's refer to as Fingerspitzengefühl (high sensitivity at the top of the fingers).
Again, remember when I told you the independent data recovery specialist isn't working on an island; specially in cases like these, the experience of peers is priceless. Rather than just blindly moving NAND chips to a donor, he's likely to consult with peers and learn if anyone at some point swapped NAND on a specific model SSD and if this has a chance of success or not.
Specialist tools
The SSD however is never connected to a PC directly, it is connected to specialist hardware instead. Some times this alone is enough to get an unresponsive SSD to correctly ID and if that's the case, no time is wasted and cloning/imaging the drive is attempted. Some times the 'simple' DeepSpar USB stabilizer is enough to get the SSD to ID.
Cloning/imaging
Cloning/imaging always involves specialist equipment so progress can be monitored and, more importantly, tweaked. In general cloning for data recovery purposes means tweaking so that excessive retrying and error handling done by the controller is interrupted, in favor of reading areas that can be read without error. The better the tools used 'speak' the device's native language, the better the control we have over what happens.
On really poorly behaving devices, the recovery can be directed at only recover areas that matter (like file system meta data initially, then based on that only selected files) and create a very selective disk image.
Firmware Repair
That leaves us with malfunctioning controllers or corrupt firmware.
If we're dealing with controller issues it may be possible to move either NAND to a functioning SSD, or move a functioning controller to the malfunctioning SSD. In my experience there's a preference for moving the NAND to a healthy donor since we know that apart from the controller, other components on the donor are functioning where it remains to be seen if this is true for the patient SSD as well.
Firmware issues are very common and unfortunately very difficult to deal with. Rule of thumb is: If PC3000 SSD/Portable supports the device it may be fixable/recoverable (check here). The PC3000 is hardware/software 'complex', it is expensive and can not be used without training.
Firmware issues can result in the SSD not ID'ing at all, another common symptom is that it actually ID's but with wrong model name (SATAFIRM being an example) or with a dramatically reduced physical capacity: The device is in 'safe mode' or 'techno mode' or 'factor mode' (I have seen many different terms for this).
I take firmware in a broader sense, we should see an SSD as a mini computer in it's own right that takes care of wear leveling, and a complex RAID like file system. I suppose we have all seen or heard of NTFS chkdsk 'trashing' a file system and similar mechanisms may take place in the SSD too.
Chip-off
What we have no yet discussed is 'chip-off', the process where we unsolder NAND chips and dump their contents directly, bypassing the controller. Since modern SSD's tend to encrypt data, chip-off isn't a viable option, although it is sometimes possible on older SSD drives, though this is the exception. Once we have the (non encrypted) dumps, the next step would be descrambling, ECC correcting and resolving the RAID like data structures.
Success rate
My answer would not be complete without telling that SSD data recovery success rates are low compared to those with regards to spinning hard drives.
Specialist tools (some examples)
Do it yourself
Now what if you decide your data is not worth the attention of a specialist?
I'd like to start with this observation: Once an SSD starts acting up it is not uncommon to see the situation worsen quite rapidly. This means the more you fiddle with it without the decisive action, the less chance you have recovering the data.
Therefor my advice would be:
- Disconnect the SSD
- Prepare the recovery
- Only once you have everything setup you enable the SSD again
Recovery attempt should not be running a number of file recovery tools, you should attempt to clone/image the drive using HDDSuperClone (free / open source).
Only once you have HDDSuperClone setup (USB boot device containing HDDSuperClone), familiarized yourself with the procedure (practice using some dummy or USB flash drive) and a drive connected that's setup and ready to receive the clone, you power up the SSD.
To increase your chances you try to limit the amount of time the controller/firmware can spend on exceptions and errors. So this means using small read-time out settings: you do not want the firmware to get busy on read errors, you want to keep going so you cancel the read and get on with the next sectors.
To deal with SSD's that stop responding entirely during imaging or at some point only return failed sectors, HDDSuperClone can be paired with a power relay so the drive can be power-cycled which is often the only way to get the drive going again.
Once you hopefully get the bulk of the data this way, you can re-configure and spend more time on sectors that weren't recovered during a first pass.
