When Storage Media Fails: Evaluating Hard Disk Drives and Solid-State Drives

As data centers and artificial intelligence infrastructure expand, storage media remains a critical point of failure. Hard Disk Drives (HDDs) and Solid-State Drives (SSDs) can fail for different reasons, and determining the cause requires more than a visual inspection or an error light. Field and laboratory testing can distinguish an individual drive failure from an issue in the larger storage system and provide evidence to support repair, replacement, recovery, and salvage decisions.

HDD and SSD Failure Modes

HDDs and SSDs have different failure modes, although some overlap. Common HDD failure modes include:

• Head crash
• Firmware (software) issue
• Bad sectors due to normal wear and tear
• Stiction
• Misaligned read/write heads

By comparison, SSDs lack moving parts, so read/write head failures don’t apply. SSDs can still have firmware issues, controller problems, and bad blocks/pages (virtual sectors) from normal wear and tear, often evidenced by the drive exceeding its endurance rating.

In both technologies, the most common causes of these failures are abrupt power loss that corrupts the firmware and/or data, as well as wear-out. Within the IT community, the typical expected lifespan of an HDD or SSD is generally accepted to be between 3 and 5 years. 

How Workload Affects Drive Life

Due to the limited lifespan of a drive, most drives are optimized for a specific purpose, such as power saving, surveillance systems (write-intensive), enterprise-grade for data centres, web servers (read-intensive), etc. If a drive is used outside its intended purpose, it may wear out sooner because it is not being used as designed. Knowing the equipment, its intended purpose, and its specifications is critical to providing evidence of the cause of a failure.

Using Logs and RAID Data as Evidence

The drive log files show the history of usage, errors over time, and how the drive has performed by correcting itself as the manufacturer designed. The logs compare these statistics against manufacturer-set thresholds, making them key evidence of the drive’s history. But the logs aren't the only evidence.  

Data storage devices like servers, Network Area Storage (NAS) and Storage Area Network (SAN) devices utilize technology known as Redundant Array of Independent Disks (RAID). RAID is a configuration to prevent data loss, as different RAID levels increase redundancy at the cost of storage capacity. This configuration can be corrupted, deleted, or lost, but knowing the configured RAID is a foundation of an investigation. With redundancy from the RAID configuration, you can have drives fail and the storage device continues to operate, so a drive could physically fail, and the redundancy is still intact, meaning no data (or production) is lost. 

However, once enough drives fail to exceed redundancy, data is lost. Data storage devices and RAID controllers often keep logs that can provide a timeline of events to support the cause of a failure, including human error. The order in which the drives fail can also be important in determining the cause of the loss. 

How Storage Media is Evaluated

This is where understanding how the drives are configured (RAID), testing, and obtaining log files play an integral role in determining the cause of an event. Exercising the drives with different read tests and capturing the resulting read errors provides evidence of the cause of the failure. Mapping the errors also verifies the error logged. Coupled with log files from the drives, this data is analyzed and provides the reason for the loss. 

The testing may be completed with our specialized equipment onsite, or when equipment is shipped to an Envista lab. Testing may take hours or days, depending on the drive’s capacity and the number of drives being evaluated. If the drives store sensitive data, they may not be available for lab testing, so onsite testing is required. 

After initial testing, further testing, such as mapping the read/write heads for each sector, may be needed to confirm the noted issues. In addition, writing data and safely opening an HDD (both destructive tests) are options to further evaluate the equipment. These tests require permission because they are destructive. Every step is not necessary in most cases, but relying on one piece of evidence such as a visual examination or error light is not sufficient. This is because many drives are tested which have no issues. The real issue may be with the storage device or RAID. 

Recovery and Salvage Considerations

Even in losses where equipment is contaminated, sustains an overtemperature event, or encounters shipping damage, evaluating drives can help determine whether the equipment can be reused or salvaged. Transferring drives to identical equipment is sometimes a viable recovery method. For example, Enterprise SSDs vary widely in price, with many read/write-intensive versions costing more than $3,000 per SSD. These drives retain value for data recovery and for installation in other equipment to add storage. Testing the drives provides a scientific way to determine whether they are operational and worth keeping.

Supporting Claims Decisions

The evaluation and diagnosis of IT equipment must follow a meticulous, systematic evidence-based approach. This involves initial visual inspections, detailed component-level testing, and the use of log files to gather precise information for informed decision-making. This methodology supports the cause-of-loss determination and provides evidence for the repair/replacement or salvage portion of the claims process.

When sensitive data or business-critical equipment is involved, early coordination with a forensic expert can help preserve evidence and identify the appropriate testing approach.