Chapter 3 — Key Takeaways
The big idea
The medium decides what is possible. Before any tool runs, the first question on the bench — what am I holding, and how healthy is it? — determines everything that follows, because each storage technology stores data differently and, far more consequentially, loses it differently. A reformatted hard drive still holds years of data as undisturbed magnetization; the same reformat on a TRIM-enabled SSD may already be physically erased. A RAID array's redundancy survives a disk failure but replicates a deletion to every member. Identify the medium correctly and respect how it fails, and the rest of the craft has a foundation. Misidentify it — wait on an SSD, power-cycle a clicking drive, rebuild a RAID on its originals — and you destroy the very data you were hired to save.
How each medium stores — and loses
| Medium | Stores a bit as… | Signature failure modes | "Deleted" usually means… |
|---|---|---|---|
| HDD | magnetic orientation on a spinning platter | head crash (click of death), motor seizure/stiction, PCB burn, service-area corruption, bad sectors | recoverable — persists until overwritten |
| SSD | trapped charge in a NAND cell | controller death, NAND wear-out, sudden-power-loss FTL corruption, charge fade | maybe gone — TRIM + garbage collection can erase it in minutes |
| Flash (USB/SD) | trapped charge in NAND | controller death, fake-capacity, snapped connector; monolithic vs standard construction | depends on construction and TRIM |
- An HDD fails mechanically and often races a clock: every spin-up of a clicking or seizing drive is a withdrawal you cannot refill. Image once, gently, or stop and refer to a clean room.
- An SSD hides NAND's erase-before-write nature behind a proprietary, often-encrypting Flash Translation Layer. You program a page but can only erase a whole block; the FTL wear-levels, garbage-collects, and remaps constantly. Lose the FTL map and intact NAND becomes an unassemblable jigsaw — which is why chip-off so often fails on modern SSDs.
- SLC → MLC → TLC → QLC trades endurance and speed for density; more bits per cell means narrower voltage windows, faster wear, and heavier reliance on error correction.
RAID at a glance
| Level | Technique | Usable capacity | Disk failures survived |
|---|---|---|---|
| 0 | striping | N × disk | 0 — any loss kills it |
| 1 | mirroring | 1 × disk | N − 1 |
| 5 | striping + 1 parity (XOR) | (N − 1) × disk | exactly 1 |
| 6 | striping + 2 parities (XOR + Reed-Solomon) | (N − 2) × disk | 2 |
| 10 | mirror of stripes | N / 2 | 1 per mirror pair |
- Parity is just XOR:
P = D1 ⊕ D2 ⊕ D3 ⊕ …, so any one missing block equals the XOR of the survivors. Two missing blocks in a RAID 5 stripe is one too many. - RAID is not a backup. Redundancy covers disk failure only — never deletion, format, corruption, ransomware, or human error.
- The cardinal rule: image every member individually, then reconstruct the array virtually — never rebuild on the originals (the rebuild is the most dangerous moment, where a URE on an aging survivor triggers a second failure).
- Reassembly needs five parameters: disk order, stripe size, parity rotation/direction, start offset, and the level. NAS serves files, SAN serves blocks (the LUN is the unit of evidence).
You can now…
- ☐ Identify a device as HDD, SSD, flash, or RAID member, and explain why that call changes the whole approach.
- ☐ Name the parts of an HDD and an SSD and map each failure mode to its symptom at intake.
- ☐ Explain NAND's page/block asymmetry and why TRIM, garbage collection, and the FTL can make SSD deletion irreversible.
- ☐ Diagram RAID 0/1/5/6/10, compute capacity and fault tolerance, and reconstruct a missing block with XOR.
- ☐ Triage a drive read-only with SMART/NVMe data — trusting raw attributes, not the "PASSED" flag — and state when data is genuinely unrecoverable.
Looking ahead
Chapter 4 — File Systems. You now know how the hardware holds raw sectors; next you climb one layer to how NTFS, ext4, APFS, FAT, exFAT, and HFS+ organize those sectors into files and directories — and exactly what each one does, and leaves behind, when a file is "deleted."
One sentence to carry forward: Identify the medium before you act — because how a device stores data and how it loses it are the same question, answered by the technology in your hand.