SSD recoverability matrix
Solid-state recovery is governed by the controller, not by mechanics. The matrix below states, scenario by scenario, what determines whether data still physically exists on the NAND and whether it can be decoded.
Scenario matrix
| Scenario | Does the data still exist on NAND? | Can it be decoded? | Determining factor |
|---|---|---|---|
| File deleted, TRIM enabled, drive left powered | Usually no | n/a | TRIM marks the blocks and garbage collection erases them, often within seconds |
| File deleted, TRIM unsupported (older USB/RAID path) | Often yes | Yes | Without TRIM the blocks are not proactively erased |
| Quick format, TRIM enabled | Usually no | n/a | Most operating systems issue a full-device TRIM on quick format |
| Partition table damaged, no deletion | Yes | Yes | The data blocks were never released to the controller |
| Controller failure, drive not detected | Yes | Only by rebuilding the translation layer | Controller family, and whether encryption keys are recoverable |
| Self-encrypting drive, key purged (secure erase / PSID revert) | Yes, as ciphertext | No | The encryption key is destroyed, so ciphertext is unusable |
| OS-level encryption (BitLocker/FileVault), key available | Yes | Yes, with the key | Availability of the recovery key or password |
| OS-level encryption, key lost | Yes, as ciphertext | No | Recovery returns encrypted blocks only |
| Firmware corruption, drive reports 0 MB | Yes | Often, in a laboratory | Vendor-specific service mode access |
| Physical damage to the board, NAND intact | Yes | Often, via chip-level acquisition | Whether the translation layer can be reconstructed |
| NAND wear-out, blocks beyond ECC correction | Partially | Partially | How many pages exceed the error-correction budget |
| Drive stored unpowered for years | Degrading | Partially | Charge leakage in NAND cells increases uncorrectable errors over time |
What changes SSD outcomes
| Factor | Effect |
|---|---|
| TRIM | Converts deletion from reversible to effectively permanent |
| Garbage collection | Runs autonomously while powered — leaving a drive on after data loss shortens the window |
| Wear levelling | Scatters logical data across physical blocks; raw NAND dumps are meaningless without the translation layer |
| Over-provisioning | Holds retired and spare blocks that are invisible to the operating system but visible at chip level |
| Encryption (hardware or OS) | Determines whether recovered blocks are readable at all |
| Controller family | Determines whether the translation layer can be reconstructed outside the original controller |
Notes
- The single most useful action after SSD data loss is to remove power. Garbage collection only runs while the drive is powered.
- “Recovered” and “readable” are separate questions on an SSD. Ciphertext can be recovered in full and still be of no use without the key.
- Chip-off and translation-layer reconstruction are controller-specific. Feasibility varies by make, model, and firmware revision, and is determined during evaluation.