SSD Data Recovery via Invisible Storage Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Solid-state drives (SSDs) lack effective backup and recovery mechanisms for deleted data, particularly when deleted due to malicious or erroneous operations by privileged users, and the unpredictable retention time of deleted data complicates data forensics and recovery.
Innovation Solution
A method and system for SSDs that involve a first storage area visible to the operating system and a second storage area invisible to it, where user operations are detected, and deleted data is synchronized and backed up to a mirrored and deleted data storage area, respectively, with authentication commands enabling specific operations for data recovery and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If upper management schemes are used for data backup and recovery, then data backup and recovery can be achieved under normal circumstances, but effective detection and data recovery cannot be provided when data is deleted by privileged system users who can modify or disable the upper management schemes
Solution Approach 1:
The SSD storage space is segmented into multiple independent areas: a first storage area visible to the operating system for normal data operations, and a second storage area invisible to the operating system for backup and deleted data. This segmentation isolates the backup mechanism from privileged user operations, ensuring that even if users modify or disable upper management schemes, the backup data in the second storage area remains protected and can be used for recovery.
2Ease of operation
If traditional data forensics and recovery technology applied to mechanical hard disk is used on solid-state drives, then data recovery may be achieved in some cases, but it faces unprecedented challenges due to the garbage collection algorithm and TRIM deletion mechanism of the SSD
Solution Approach 1:
The system performs preliminary actions by automatically synchronizing and backing up data to the second storage area before deletion operations occur. When data is deleted from the first storage area, the system proactively copies it to the second storage area's deleted data storage area. This preliminary backup action eliminates the need for complex forensic recovery techniques, making data recovery as simple as accessing the second storage area.
Solution Approach 2:
The system creates a copy of the first storage area in the second storage area's mirrored data storage area, and also creates a copy of deleted data in the deleted data storage area. This copying mechanism bypasses the complexities of SSD garbage collection and TRIM mechanisms, as the backup copies are maintained independently of these processes, enabling straightforward data recovery without traditional forensic techniques.
3Reliability
If a second storage area invisible to the operating system is created for data backup, then data security and recovery capability are improved, but the device complexity and management overhead increase
Solution Approach 1:
The SSD controller automatically performs data synchronization and backup operations between the first and second storage areas without requiring external intervention. The system self-manages the mirroring of data to the mirrored data storage area and the copying of deleted data to the deleted data storage area, eliminating the need for complex external management mechanisms while maintaining high data security.
Solution Approach 2:
The second storage area serves multiple functions: it acts as a real-time mirror of the first storage area for continuous backup, a deleted data storage area for recovery operations, and a secure storage area protected from operating system access. This multi-functionality reduces the need for separate dedicated backup devices or complex management systems, as a single second storage area accomplishes multiple data protection goals.
Data Source
AI summary
The present disclosure discloses a method, a system, and a solid-state drive for data processing. The method includes detecting the user operations on a first storage area which is visible to an operating system in a solid-state drive; if the user operation is a reading or writing operation, keeping the data of the first storage area and the data of a mirrored data storage area of a second storage area to be synchronization; if the user operation is a deleting operation or a TRIM operation, keeping the data of the first storage area and the data of the mirrored data storage area of the second storage area to be synchronization, and backing up the deleted data from the first storage area to a deleted data storage area of the second storage area. The second storage area is set to be invisible to the operating system in the solid-state disk.