Many devices such as USB flash drives, Solid State Drives (SSD), and memory cards (CF, SD, etc) use NAND memory to store data. NAND memory is inexpensive however it does have its faults. These are some interesting things i’ve learned while recovering data from bad USB flash drives:

1. Files ARE NOT deleted

While NAND memory is solid state (no moving parts) individual sectors fail after 10K to 100K writes. To prevent failure each write operation stores data in a different location (wear leveling). If a file is deleted or overwritten numerous times using a “file shredder” application the original data will remain on the physical chip because each pass will write to a different physical sector. The only secure way to use flash devices is with an encryption layer such as TrueCrypt for USB drives and BitLocker for Solid State Drives (SSD).

2. Cheap Components

As flash drives come down in price so have the quality of components. Many USB flash drive manufacturers are using untested NAND memory, choosing to rely upon the controller to handle bad blocks. Bad clock generators, faulty controllers, and buggy firmware are other common failures. While it’s no guarantee (*cough* PNY Attache) I recommend buying flash drives from known manufacturers and staying away from inexpensive unbranded drives.

3. Flash Drives ARE NOT Indestructible

USB Flash Drives are susceptible to wear and tear, static shock and power fluctuations. One frequent killer of USB Flash drives is removal during a write operation. This can cause corruption to the internal wear leveling tables that tell the controller where each sector is stored on the NAND flash chip. To prevent further corruption the drive will stop working resulting in errors like “Unknown Device” or “Unrecognized Device” and incorrect drive capacities (ie. Total Size: 0MB). Never unplug the drive while it’s in use. If possible, always use the “Safely Remove Hardware” applet.

4. Short Lifetime

Newer high capacity NAND chips (MLC) have a shorter life time (~10K writes per sector) than older SLC chips (~100k writes per sector). Remapping bad blocks, wear leveling, and error correcting code (ECC) are used to prevent and identify failure. These technologies show their faults when there is no free space and a file is continually written to. For example premature failure can occur if the drive is full and the page file is actively used.

5. Data Recovery

While data recovery is usually possible if the NAND chip isn’t physically damaged, this often involves removing the NAND chip and reverse engineering the controller to decode the data. Unlike hard drive data recovery, NAND data recovery is a relatively new field. Besides us, there are very few small data recovery shops that specialize in it. Most NAND data recovery is performed by the government and big data recovery shops at a high price. As with any other storage medium, keep backups of your important data.