Generally speaking if you have lost data due to drive failure, you will likely be able to recover it. However, if you delete a file and the drive is functioning properly (i.e. the file was not being stored on a failing disk), then recovering that file usually is not possible. Both scenarios can appear very similar to the individual who suffered them, yet they are nearly opposite in terms of what occurred during their loss. For instance, let’s look at a Dell SSD caught mid-TRIM.
TRIM eliminates all of the space behind deleted files on a block-by-block basis within minutes; once those blocks have been eliminated by TRIM, the information contained in those blocks cannot be restored. While this seems to eliminate the possibility of restoring deleted files entirely, it does so under one condition: the drive must be functioning normally for TRIM to eliminate those blocks. Therefore, when a disk fails completely, it will preserve the data that existed on it before its failure. Conversely, deleting a file removes access to the data contained in that file but leaves the underlying physical structure intact until TRIM occurs and deletes those structures.
The most common serious form of SSD failure is the controller or its firmware rather than the flash itself. The drive disappears from the BIOS; shows up with a blank model string in disk manager; or displays an impossibility as its reported size, and yet behind all this, the data remains on the NAND. Recovery involves getting into the controller in vendor specific tech mode, reading the tables of translations which tell you how to get at your logical address space physically located within the flash, then imaging read-only from those locations.
If a damaged controller cannot be restored to its former glory, we can attempt to access the data on the NAND. The NAND can then be deinterleaved, corrected using any error correction codes (ECC), and finally unscrambled in accordance with how the original controller had been set up. This process is very time-consuming and requires special equipment and expertise. In many cases, this may be too costly of an option.
When you delete a file on an active SSD (a working one), this will typically trigger the TRIM command from your operating system to the controller of that SSD. The OS lets the controller know which sectors have been used by files now deleted, so when they are free again, the controller can erase those sectors as part of keeping your write speeds as high as possible. This erasing is a physical process and occurs within minutes. Therefore, a file deleted from a healthy, TRIM enabled SSD is very likely to be completely inaccessible to anyone, not due to tool limitations, but because the actual data does not exist.
Exceptions are important: TRIM can’t pass-through most USB-enclosure products; TRIM isn’t supported by some legacy file systems (older versions); and TRIM will never work if the SSD has crashed. And that’s the issue with SSDs: when an SSD fails, the write cycle to that particular area of the SSD is frozen in time; therefore, a dead SSD is often preferred over a live SSD.
By design, many SSDs are encrypted on their own; the portable T-series from Samsung is one of them (and so are drives that are configured as Class 0 or TCG Opal), and if an encryption method such as BitLocker has been applied to the Windows system then all of your files will be encrypted automatically. So even if the flash memory is completely intact in every way, without access to a password or decryption key (if one was set), no one can decrypt your data.
Establishing whether or not encryption is being utilised is essential, since it will determine whether any recovery efforts should even proceed. Before proceeding, search for a BitLocker recovery key in your Microsoft account to establish some context.
In terms of SSD/NVMe recovery, our fees start at £300 +VAT following a complimentary 48 hour diagnostics period and a written quote. In most cases you only pay if we recover your data; however, due to the complexity of performing controller level repairs, a 50% deposit would need to be made prior to commencing any such work.
The purpose of the diagnostics process is to allow us to distinguish between the two scenarios outlined above. If you have simply deleted files from a functioning disk that has subsequently undergone TRIM, then we will inform you accordingly, and no fee will be incurred; that provides you with a much better service than an invoice indicating that we have confirmed that your files are gone.
Typically yes. Generally speaking, serious SSD failures result in a failure of either the controller or the firmware controlling it; therefore, the data contained on the flash remains intact and the drive can be accessed in vendor mode allowing it to be imaged in read-only fashion. Actual failure typically preserves data because a dead drive cannot execute TRIM.
Typically no, as long as the drive still functions. TRIM instructs an SSD to delete the sectors behind deleted files. That occurs within minutes and is physical. Exceptions include drives in USB enclosures where TRIM typically does not get passed-through, some old file systems, and dead drives.
Because TRIM won’t work on a dead drive. Dead means a failure froze the flash at whatever state it was at. A working drive will continue erasing its deleted blocks in the background. This is one of the biggest contradictions when dealing with SSD recoveries.
Yes it can. Many SSDs encrypt out-of-the-box, and you may have BitLocker added to the encryption. If you don’t know your password or recovery key there is no way to decrypt your data, whether the drive is physically damaged or good; thus this should be determined prior to doing anything else.
After the first free 48 hour diagnostic and a written quotation (from £300 plus VAT), in most cases you only pay if we recover your data. If our diagnostic finds that TRIM has removed what you are trying to recover then we will advise you accordingly and there will be no cost involved.