SSD Data Recovery - NVMe, M.2, and SATA Drive Recovery

When you delete a file on an SSD, the operating system sends a TRIM command telling the controller which data blocks are no longer needed. The controller then zeroes those blocks in the background so they are ready for new writes. Once TRIM executes, the original data is gone. No tool, no lab, and no technique reverses this. The cells have been electrically reset to a blank state.

This is the opposite of how hard drives work. On a spinning disk, deleted files sit untouched until new data overwrites them. On a TRIMmed SSD, the data is destroyed within seconds of deletion.

Write Amplification, Garbage Collection, and Over-Provisioning

TRIM tells the controller which blocks are free. Garbage collection is what the controller does with that information: it consolidates valid pages from partially-empty blocks into new blocks, then erases the old ones to create clean write targets. This runs continuously in the background whenever the drive is powered on and idle. Every consolidation cycle means extra writes to the NAND that the host never requested. That ratio of actual NAND writes to host writes is called write amplification. A drive with a write amplification factor of 3x wears its cells three times faster than the host workload alone would suggest. Heavy random writes, a nearly full drive, and aggressive garbage collection all push the factor higher, accelerating the path toward ECC failure and controller lockup.

Manufacturers counteract this with over-provisioning (OP): a percentage of the total NAND capacity reserved from the user and dedicated to the controller for wear leveling, garbage collection, and bad block replacement. Consumer drives typically reserve 7-10% of raw capacity; enterprise drives reserve 25-30%. From a recovery standpoint, higher over-provisioning directly improves our odds. The reserved space holds redundant copies of the flash translation layer metadata that maps logical addresses to physical NAND pages. When the primary FTL copy is corrupted, PC-3000 scans the over-provisioned area for backup translator tables. A drive with 28% OP gives us significantly more metadata to reconstruct from than a consumer drive with 7%. This is one reason enterprise SSD recoveries tend to have higher success rates than consumer ones, even at the same level of NAND degradation.

The practical takeaway: if your SSD died from a hardware failure and never had the chance to run garbage collection after the crash, the over-provisioned area is intact and the FTL backups are likely recoverable. If the drive was running for days in a degraded state with the controller grinding through garbage collection cycles before it finally locked up, write amplification may have consumed spare blocks and overwritten older FTL snapshots. The sooner a failing drive is powered off and sent to a lab, the more metadata survives.

NAND Cell Architecture and Degradation

Each NAND flash cell stores data as a voltage level. SLC (single-level cell) stores 1 bit with two voltage states. MLC stores 2 bits with four states. TLC stores 3 bits across eight states, and QLC packs 4 bits into sixteen. More states per cell means tighter voltage margins and faster wear.

As cells degrade through program/erase cycles, their voltage windows narrow. The controller compensates using error correction (LDPC or BCH), but once bit errors exceed the ECC threshold, the controller cannot resolve the page. If the corrupted pages sit in the service area where the firmware and flash translation layer (FTL) live, the controller loses its map of where data is stored. The drive drops offline and reports 0 bytes or fails to enumerate entirely. The NAND still holds the data; the controller has lost the ability to find it.

At that point, PC-3000 bypasses the failed controller, injects a working firmware loader, and rebuilds the translator from NAND metadata. For drives with physical NAND damage, we apply controlled heat to shift voltage thresholds back into readable range; a technique demonstrated in our NVMe recovery walkthrough.

Most modern SSDs encrypt data at the hardware level. The controller generates an encryption key on first use, stores it internally, and encrypts every write transparently. When the drive functions normally, you never notice. When the drive fails, encryption determines whether chip-off recovery is even possible.

Self-Encrypting Drives and TCG Opal

Drives that comply with the TCG Opal specification (Samsung, Micron, SK Hynix enterprise lines) store the media encryption key (MEK) inside the controller IC. If the controller dies, the MEK dies with it. Desoldering the NAND yields only ciphertext. The fix is to repair or replace the controller so the drive can decrypt its own storage through normal operation. We do this by swapping the controller IC and restoring the original firmware ROM that contains the key material.

BitLocker and FileVault

BitLocker (Windows) and FileVault (macOS) add a software encryption layer on top of the drive. Recovery requires the original password, recovery key, or TPM chip. If you have the recovery key, we image the drive and decrypt offline. If the key is lost and the TPM chip is on a dead motherboard, the motherboard itself needs repair to release the key. We handle both the drive-side and board-side work.

Apple T2 and M-series

Apple solders NAND directly to the logic board and ties the encryption key to the Secure Enclave inside the T2 chip (2018-2020 Macs) or the M-series SoC (2020 onward). The NAND cannot be read without the Secure Enclave on the same board. If the logic board dies, the encryption key is inaccessible unless the board is repaired at the component level. Chip-off is useless here; the raw NAND is AES-256 encrypted with a key that exists nowhere else. The only recovery path is logic board microsoldering to get the board powered on so the Secure Enclave can decrypt in place.

Most data recovery labs hide their pricing behind a phone call because their business model depends on quoting based on how desperate you sound. We publish ours because we are confident in what we charge. A firmware rebuild is a firmware rebuild whether you found us through Google or through a referral. The price does not change based on who is asking.

Every recovery listed on this page is performed in-house at our Austin lab. We do not outsource to a third-party clean room. We do not broker your drive to another company. The same technicians who diagnose your SSD are the ones who repair it, image it, and verify the files. You can watch the actual work on Louis's YouTube channel, where we record live recoveries, including the failures. That level of visibility is the opposite of what large labs offer.

Rossmann Repair Group is also one of the most visible advocates for the Right to Repair movement. Louis has testified before the FTC and state legislatures to fight manufacturer restrictions that block independent repair shops from accessing the parts, tools, and documentation needed to fix your devices. That fight is not separate from what we do here. When a manufacturer designs an SSD so that only their authorized service center can access the encryption keys, that is a repair restriction. We work around it with engineering, not permission.

Software recovery tools (Recuva, R-Studio, Disk Drill) work by scanning the file system through the operating system. They require the OS to see the drive. If the SSD controller is dead, the drive does not enumerate, and no software on earth can reach the NAND. There are no spinning platters to image with a sector reader; the controller is the only gateway to the flash memory. A dead controller means zero access at the software level.