Hacker News Reader

Comment by nkurz | Hacker News Reader

I find it astonishing that none of the drives that died finished in a state where their data was accessible. Some of these drives even intentionally self-brick themselves at end-of-life:

  According to Intel, this end-of-life behavior generally   
  matches what's supposed to happen. The write errors 
  suggest the 335 Series had entered read-only mode. When 
  the power is cycled in this state, a sort of self-destruct 
  mechanism is triggered, rendering the drive unresponsive.

So you enter a read-only mode, and then on power cycle you self-destruct, making the intact data inaccessible? In what circumstance is that possibly the right choice?

  Intel says attempting writes in the read-only state could   
  cause problems, so the fact that Anvil kept trying to push 
  data onto the drive may have been a factor.

Oh, I see. Maybe it's to prevent the unwanted writes from damaging the drive. Wait, what? The attempted writes can damage a drive that is in read-only mode?

View on HN

Yeah, by all means they can block further writes to the drive, but you should always be able to read from it, even if the drive can't guarantee that the data is correct.

I've recovered many hard disks that have gone bad in various ways, including multiple Seagate Barracuda 7200.11 drives that suffered from the BSY bug, and I've never had a disk that I couldn't recover at least some of the data from, even if that meant hooking up serial cables and re-reading the data multiple times (eg: Spinrite).

But a drive that disappears completely when things go bad is never a good outcome.

I imagine it is to stop people trying to sell second-hand almost-dead SSDs to non-savy customers who do not know about SMART etc.

You will notice that their Enterprise SSDs do not self-brick.

[EDIT] Read down for clarification regarding "almost-dead"

My guess is that Intel couldn't coerce the SandForce controller into behaving nicely. Of course if anyone asks them about the behavior, it's a feature, not a bug. But really, selling almost-dead SSDs is not a big problem. These endurance tests show that you'd have to overwrite a 240GB SSD every day for 5 years before getting close to exhausting it. Drives will become obsolete before they wear out.

Last I checked, Intel used their own controllers in their enterprise SSDs. Now I wonder if their older consumer drives like the X25-M (which used in-house controllers) become read-only instead of bricking themselves.

Now I wonder if their older consumer drives like the X25-M (which used in-house controllers) become read-only instead of bricking themselves.

http://www.xtremesystems.org/forums/showthread.php?271063-SS...

X25-M G1 dies at ~883TB written (without TRIM, so in reality much more), also by just failing to be detected.

On the first page of that thread you see an X25-V (40GB) with 1.5PB written and apparently it is still alive as of earlier this year...

http://www.xtremesystems.org/forums/showthread.php?271063-SS...

> every day for 5 years

Or, in some OLTP scenarios, every few minutes for a month or so.

This behavior doesn't stop you from selling an almost dead SSD. And if you sell a dead one it will be obvious that it can't be written to; that's not going to be a very convincing scam.

Sorry, clarification: "almost-dead" in this case means "on the verge of the intel software self-bricking itself" rather than the drive itself being buggered.

Based on what I read from the article it implies that at this point the drive itself MAY be ok but not reliable so the intel software pro-actively commits suicide.

Without the self-bricking you could sell a drive that has reached this point to some unsuspecting person since it ostensibly works but is unreliable, if it fails 2 months later then the seller can just deny responsibility.

Although why it 100% self-bricks instead of going into "read-only brick" mode is a good question.

Is the consumer market for second-hand drives large for them to be concerned about it? I always thought that >99% of people keep the drive their desktop/laptop came with and junk/sell/donate the whole thing without ever turning a screw. The number of people who are savvy enough to know about SSD, be willing to upgrade a drive, willing to shop for a used one vs a new one from Dell/Amazon/Newegg, and still be able to be duped might be a pretty small market.

Not to mention the number of drives bricked by overuse in the hands of unscrupulous sellers willing to put in the effort to earn a (rather pitiful) sum on the second-hand market for an outdated driver is probably... zero. Or vanishingly small, in any case.

Good point. Ok, but does Intel provide a published specification of how to send some sort of custom command to resurrect the drive in read-only mode, you know, so I can take it to a friendly geek and get my data back?

That is a good point, as long as it can only be done after it self-bricks and it only restores to read-only then I cannot see a problem with regards to my earlier point since any consumer is going to notice pretty damn quick that they cannot write to the drive.

>You will notice that their Enterprise SSDs do not self-brick.

How do you know? Was there a test that managed to put one of the enterprise drives into Read only mode? Nope.

This brisking of intel wasnt intentional, it sounds like a broken firmware.

From the article

> Intel really doesn't want its client SSDs to be used after the flash has exceeded its lifetime spec. The firm's enterprise drives are designed to remain in logical disable mode after the MWI bottoms out, regardless of whether the power is cycled. Those server-focused SSDs will still brick themselves if data integrity can't be verified, though.

Yes, its pretty logical to kill the drive instead of giving you read only mode.

> So you enter a read-only mode, and then on power cycle you self-destruct, making the intact data inaccessible? In what circumstance is that possibly the right choice?

I agree with you - I was surprised by the behaviour the article describes. That said, the obvious alternative of entering a permanent read only state is still problematic: how do you dispose of such a drive safely when you can't overwrite the data that remains? You'd need people to be aware of the secure erase command and continue to support that in read only mode.

You cannot erase data from SSD and know it is erased. The last time I researched the subject the official DoD policy for secure SSD erasing was - grind them to dust. And I happen to agree with them.

There's nothing keeping a properly implemented secure erase from working -- all the data on disk should be written out encrypted so secure erase is just cycling the key. It has the advantage of being much faster and something you can do in software (and repeatedly)

Of course, for retiring a drive there's no good reason not to just physically destroy it.

> there's no good reason not to just physically destroy it.

You should do it with some care so to keep the various materials easily recyclable.

What if your key cycling write fails?

That's just as much of a problem with Intel's current solution though - the data's still present and can probably be retrieved with the correct tools, it's just inaccessable to the user. What's more, the brick mode almost certainly blocks access to the secure erase commands needed to safely dispose of the drive along with every other command, whereas a better end-of-life mode could allow secure erase.

or since it's already broken you just bash it with a sledgehammer a few times.

Standard drive disposal procedure anyway.

I dunno.. throw it into a smelting furnace if you're THAT concerned?

Filesystem needs to shutdown and sync correctly. I think best way is to make writes slower and slower. FS can still close, and admin will notice something is wrong.

That's a good idea, although it feels kind of dirty to intentionally degrade performance when S.M.A.R.T. can allegedly provide ample warning.

I say "allegedly" because implementation of S.M.A.R.T. attributes is so inconsistent between drives/vendors, and is often totally undocumented. Most manufacturers seem to provide a Windows program that monitors the attributes, but since they're usually undocumented you're kind of out of luck if you're on another OS...

Agree about the inconsistency, but >if you're on another OS... try:

    http://www.smartmontools.org
    http://smartmontools.sourceforge.net/

Agreed. It's discussed in the comments of the article as well. Some quotes:

> For a drive that voluntarily went into read only mode, I didn't expect it to get bricked, especially for a consumer drive. I am disappointed with Intel's engineers.

> I'd like to be able to read my data, even most of my data, if my SSD has failed. Disabling writes seems quite fair, disabling reads seems unnecessary and potentially cruel, depending on what data has been laid down since the last backup.

> ...I think it's a big deal, I'd want my SSD drive to tell me when it's time to move my data safely to another drive, right?

> Not only Intel but all three. Read only, even with some corrupt data, is far far better than becoming inaccessible. The three failed miserably, SMART warnings and writing-much-over-spec notwithstanding.

> ...I find it concerning since the SSDs appear to brick themselves instead of going into read only mode, once they have reached their write limits.

It doesn't matter if this single drive is unreadable because backups.

Seriously, it's the 21st centuary and everyone should always be making backups.

I don't think automatically bricking reading is the right approach but if you have sensitive data on the device some way to erase it is a good thing.

Will a consumer-class OS (Windows/OSX/Ubuntu) even boot if all writes to a system drive are failing?

I don't know about the consumer-grade OSs you mentioned, but I have booted Ubuntu from read-only media countless times - it's a good way to start compute nodes that'll get and save their data to a network.

It shouldn't be a problem to boot a Linux from a read-only device.

This site is so cute. Half the time it's the Ed Snowden show, all about how to use PGP to thwart the NSA. Half of the time it's complaining about privacy protections in SSDs.

Think about it. If the SSD fails to erase, do you want that to mean it's readable forever? Would you be happy if the NSA was snooping around and your SSD refused to do anything other than disgorge secrets? This feature is good privacyware. If the drive can't be erased it also can't be read.

Which is better: my SSD fails, taking all unbacked up data with it, or my SSD fails and I can rescue my data and dispose of the drive carefully?

You seem to live in a bizarre fantasy world where if a drive dies, people just go out onto the street and hand it to random strangers, saying 'please! try to take my data and invade my privacy!' No, what happens when a drive dies is that it gets chucked and hit with a hammer if it had (unencrypted) data on it.

I am sure the three-letter agencies have electrical engineers who can swap out or reflash the controller chips on the SSDs, and recover most of the data.

Maybe. Does your wife have one? Your boss?

Maybe. Am I involved in a lawsuit with my wife or my boss or my ex-partner? Perhaps a lucrative divorce option?

If so, I think she/he can afford to spare a few thousand dollars to some recovery service to read my drive.

But you started talking about this being a "privacy" feature, and now that they told you it's not really protective, you go on about how it's good enough for one's "wife". As if that's where privacy concerns end...

The FBI is known to pick apart spinning disk drives and retrieve data directly from the platter using a scanning tunneling electron microscope. What makes you think the NSA doesn't know how to do the same and perhaps with SSDs?

Reply on news.ycombinator.com