Products > Computers

Data extraction from failing SSD (MacBook Pro)

(1/1)

ElectronicSupersonic:
Want to share a story of my recent attempt to extract date from a failing SSD.

This particular MacBook Pro had some bad experience with latte - a kid spilled some latte on the notebook while watching YouTube. To make matters worst, it was dropped at the same time. Since it was brought to me rather quickly, I managed to revive it after some extensive cleaning (using IPA cleaner).

Most of the liquid "landed" on the SSD. It got damaged. Some solder joints "went missing" and had to be restored (which is not an easy task without a microscope). After repair SSD was now working, but controller IC was getting noticeably hot. It still worked fine though. For few months. Which is expected.

The owner was reminded to make regular backups, which he never did. :palm:  Now the SSD started failing (doesn't boot or freezes randomly). I was asked to copy date from it. Since it somehow worked from cold start, I've decided to temporarily fix overheating issue using heatsink and a 120mm fan running at full speed. A thermal paste was applied directly to the IC, then a cooper shim placed on top, then again a layer of thermal paste and finally the heatsink (removed from an old desktop PC MB). To attach the heatsink, I've used high-tech rubber bands :)

Below are few pics of the contraption.

MrMobodies:
They're lucky they found you in time.

I have a few of those copper shims for when the thermals pads breakdown.

What I am trying to do now is get the customers to buy external usb hard drives now they're cheaper so after I am finished I can make a disc image and a backup script so not all maybe lost in the worst case.

amyk:
I've heard that these are encrypted so even a flash dump wouldn't help if the controller dies, because the keys are in that and basically impossible to extract (unless you have really really valuable data and willing to pay the probably >$10M to reverse-engineer the thing and figure out how to crack it...) Good you got to it before that!

--- Quote from: ElectronicSupersonic on June 11, 2019, 06:43:10 pm ---This particular MacBook Pro had some bad experience with latte - a kid spilled some latte on the notebook while watching YouTube.
--- End quote ---
Did he also happen to be sitting in a Starbucks...? :D

CJay:

--- Quote from: amyk on June 12, 2019, 03:35:59 am ---I've heard that these are encrypted so even a flash dump wouldn't help if the controller dies, because the keys are in that and basically impossible to extract (unless you have really really valuable data and willing to pay the probably >$10M to reverse-engineer the thing and figure out how to crack it...) Good you got to it before that!

--- Quote from: ElectronicSupersonic on June 11, 2019, 06:43:10 pm ---This particular MacBook Pro had some bad experience with latte - a kid spilled some latte on the notebook while watching YouTube.
--- End quote ---
Did he also happen to be sitting in a Starbucks...? :D

--- End quote ---

My understanding is that most if not all SSD devices are SED (Self Encrypting Device), many modern spinning rust drives are also SED, I could be wrong.

If the device supports 'Secure Erase' then it's encrypted, the secure erase wipes the keys and that's it, irretrievable (unless there's some shadowy organisation with a master key or back door)

Interesting to note though, when I've doen the secure erase (we secure erase all SSDs, SATA, NVME, M2 before shipping out for disposal), it takes a variable amount of time, some take a minute or so, others can be up to an hour, so it would seem it's not *just*  erasing the keys.

ElectronicSupersonic:

--- Quote from: amyk on June 12, 2019, 03:35:59 am ---Did he also happen to be sitting in a Starbucks...? :D

--- End quote ---
  :-DD Nope - a home accident

Navigation

[0] Message Index