Phison SSD Controller Architecture and Recovery

1. Entering Technological Mode

A SATAFIRM S11 drive refuses normal ATA initialization because its firmware boot sequence fails partway through. Technological mode bypasses that boot sequence through one of the following entry paths:

• ROM/Safe Mode pin short: On the PS3111-S11 PCB, a pair of test points adjacent to the controller routes the ROM_SEL line to ground. Shorting those points with tweezers while cycling power forces the controller to boot from internal mask ROM rather than from the corrupted firmware in NAND. PC-3000 SSD then detects the ROM-mode identity and offers the Phison active utility.
• Vendor-specific ATA command entry: If the drive enumerates far enough to accept ATA commands, PC-3000 can push the controller into technological mode by issuing a sequence of Phison vendor commands through the SATA host adapter. This avoids handling the PCB when the drive is still partially responsive.
• UART diagnostic access: Some Phison reference designs expose serial TX/RX pads on the PCB. When available, UART provides a boot log that identifies the firmware family before the loader is uploaded. UART is diagnostic only; the loader itself travels over SATA or PCIe, not over the serial link.

2. Loading the Correct Family Profile

Ace Laboratory ships loader profiles indexed by controller revision, NAND die manufacturer, die ID, and firmware version. A PS3110-S10 drive uses a different loader than a PS3111-S11 drive on SBFM-series firmware, even if both drives carry the same Kingston consumer identity. PC-3000 SSD reads the controller ID register and the NAND ONFI parameter page, matches both against the loader database, and offers the candidate loaders ordered by match confidence. Picking the wrong loader produces read errors or garbled metadata; it does not damage the NAND, because the loader itself writes nothing.

3. Reading Raw NAND Through the Controller

Once the loader is resident in the controller's SRAM, PC-3000 issues raw read commands that traverse the controller's native NAND interface. This is preferred over chip-off because the controller already knows the channel geometry, plane interleaving, and ECC configuration. For the PS3111-S11, that means reading 2 channels with the controller's original ECC engine applied; for the PS3110-S10, 4 channels. Raw pages include out-of-band (OOB) areas containing LBA stamps, sequence numbers, and wear-leveling metadata that the translator rebuild depends on.

4. Dumping the Service Area

The Service Area is the reserved region of NAND where Phison controllers store firmware modules, translator snapshots, bad-block tables, and wear-leveling journals. On a panicked drive the SA is usually readable even when the operational FTL is not, because the panic is triggered by a single corrupted module rather than total SA destruction. PC-3000 dumps the SA to disk, parses each module header, and isolates the translator snapshot and bad-block list. These modules are the seed data for FTL reconstruction.

5. Rebuilding the Translator and Exposing User LBAs

The translator rebuild runs entirely in workstation RAM. PC-3000 consumes the SA snapshot, reconciles it against the OOB metadata read from user-data blocks, and resolves conflicts by sequence number. XOR scrambling is reversed using the page-level seed derived from the loader profile. The output is a virtual LBA range that matches what the drive would have presented to the host before the panic. PC-3000 then images that virtual range sector by sector into a target container; the original NAND is never written.

Why Consumer Software Cannot Reach This State

Recuva, EaseUS, R-Studio, and DMDE all operate above the ATA or NVMe block layer. A SATAFIRM S11 drive never presents a block layer, so these tools see no device to scan. MPTool and PhisonToolBox can talk to the controller in production mode, but their intent is to initialize blank NAND for manufacturing; running either on a drive that holds user data reinitializes the FTL and destroys everything. The technological mode workflow exists specifically because no consumer tool exposes the SA or the raw NAND read path.

When We Decline a SATAFIRM S11 Job

Technological mode requires a controller that can still boot to ROM and a NAND service area that retains at least one readable translator snapshot. When either fails, the loader has nothing to attach to and FTL rebuild is not possible. We decline or refund these cases rather than spend bench time on a recovery that cannot finish.

• Dead controller silicon: The PS3111-S11 die fails to draw expected current on the core rail under FLIR, or shows a dead short across a decoupling capacitor that traces back to the controller package. A controller that does not power up cannot accept a loader. We do not perform BGA controller swaps on the PS3111-S11 platform: the electrical faults that kill these controllers routinely propagate damage to the NAND power rails, and a controlled BGA reflow on a budget drive is not economically viable for the customer.
• Total service area destruction: Every translator snapshot in the SA reads as uncorrectable. This usually appears on drives that were powered repeatedly through brownouts or that ran for years past the NAND endurance rating. Without at least one valid snapshot, there is no seed to reconcile against the OOB metadata on user-data blocks and no way to recover the logical-to-physical map.
• NAND wear past the read-retry ceiling: Even with a valid SA snapshot, user-data blocks may have drifted past the voltage threshold range that PC-3000 read retries can recover. When the uncorrectable-page count crosses a threshold that would corrupt the file system being recovered, we report what was salvageable and stop rather than deliver an unusable image.
• Prior MPTool or PhisonToolBox run: If the customer or a previous shop ran a factory production tool against the drive, the FTL has been reinitialized and the user-data blocks are no longer addressable. There is no surviving translator to rebuild. We do not accept these drives for SATAFIRM S11 recovery; the data is gone before the drive reaches our bench.
• Drive arrived after a DIY chip-off attempt: Desoldered NAND chips on a PS3111-S11 can sometimes be read on a programmer, but pairing the raw NAND dump back to a virtual controller without the original SA context is research-grade work that we do not currently offer. For an undamaged PCB, technological mode through the original controller is the supported path; once the chips are off the board, that path is closed.

In each declined case the free evaluation finding is documented and the drive is returned at no charge. A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.

PS3110-S10 (SATA, DRAM-equipped, 8-channel)

Typical signatures: Drive reports a generic Phison factory string or the controller model name instead of the consumer brand, with a placeholder capacity of 2MB or 20MB. Some units enter a persistent BSY state & fail ATA enumeration entirely.

Safe Mode entry: Locate the ROM test points adjacent to the controller die on the PCB. Short the pads with precision tweezers while PC-3000 Express applies power; the controller boots from its immutable Mask ROM & bypasses the corrupted NAND firmware. Because the S10 uses a standard SATA interface, UART terminal access is not required for FTL recovery.

SRAM loader & translator rebuild: PC-3000 uploads a loader matched to the exact firmware version (e.g., SBFK71E0 mapping to loader SBFM 71.2). Once the loader is resident in SRAM, PC-3000 reads the NAND pages, reverses the XOR scrambling, & parses the out-of-band spare area to reconstruct block sequence numbers and wear-leveling counters into a virtual translator.

Outcome: Full FTL reconstruction & data extraction is available through PC-3000 SSD as long as the S10 silicon is electrically alive. If the controller itself is dead, chip-off is a last-resort fallback because the S10 uses reversible XOR scrambling rather than AES. Firmware recovery tier: $600–$900.

PS3111-S11 (SATA, DRAM-less, 2-channel)

Typical signatures: Drive enumerates as "SATAFIRM S11" with 0GB, 2MB, or occasionally full capacity, but rejects every standard ATA read/write. Root cause is the in-NAND FTL degrading past the ECC threshold, usually after sudden power loss during a background garbage collection cycle on a drive that has been written hard on budget TLC.

Safe Mode entry: Identify the two ROM vias near the controller or NAND package. Short them briefly during power-up & release as soon as the drive enters a minimal ready state. The S11 does not require a sustained short; a momentary contact is enough to divert the boot flow from the panicked firmware into the Mask ROM.

SRAM loader & translator rebuild: PC-3000's Phison active utility pushes a small volatile loader into the S11's limited SRAM. The loader exposes raw physical block addresses. PC-3000 then applies the Phison-specific XOR polynomial, parses the OOB spare area for LBA markers & block pairing metadata, & compiles the virtual translator in workstation RAM. One S11 quirk: if the SMART log is itself corrupt, parsing it during FTL compile triggers a controller reboot loop. The workflow clears or bypasses SMART entries before finalizing the translator.

Outcome: Firmware-corrupt S11 drives are the highest-yield target in the Phison family; PC-3000 recovery succeeds on the majority of SATAFIRM S11 cases where the PCB is intact. If the controller silicon is dead, chip-off remains viable because the S11 only applies reversible XOR scrambling. Firmware recovery tier: $600–$900. NAND swap fallback: $1,200–$1,500.

PS5012-E12 (NVMe Gen3, DRAM-equipped, 8-channel)

Typical signatures: Drive drops off the PCIe bus or enumerates with a 2MB/1GB placeholder capacity & ignores NVMe admin commands. The root cause is almost always FTL journal corruption after an unexpected power loss during SLC-to-TLC cache folding, when the controller is mid-way through promoting fast SLC writes into dense TLC storage.

Safe Mode entry: Connect the M.2 drive to PC-3000 Portable III's M.2 adapter. A firmware-panicked E12 completes PCIe link training but stalls before NVMe initialization. Short the Safe Mode diagnostic pads near the controller or along the edge of the board during power-up; PC-3000 then forces PCIe link establishment at a reduced speed & loads the Phison NVMe utility.

SRAM loader & translator rebuild: PC-3000 sends vendor-specific NVMe commands over the PCIe bus to inject a controller-specific loader. The E12 loader is larger than the SATA family because it has to carry NVMe queue management & LDPC error tracking. Translator rebuild requires resolving SLC cache vs TLC main-array conflicts by reading the SLC block allocation table & picking the most recent valid version of each logical block.

Outcome: Full PC-3000 support. If the E12 silicon is alive, firmware recovery is reliable. If the controller is dead, chip-off is off the table: the E12 fuses its AES-256 Media Encryption Key to the controller silicon, so desoldered NAND yields ciphertext. Recovery then shifts to board-level repair to revive the original controller. NVMe firmware recovery tier: $900–$1,200.

Windows 11 KB5063878 / KB5062660 interaction: Following the August 2025 Windows 11 cumulative updates, NVMe command-timing changes pushed a wave of Phison-controller drives into mid-write lock-ups during sustained sequential transfers above roughly 55 GB. The reported population skewed toward DRAM-less designs but E12-based drives (Sabrent Rocket, Corsair MP510, PNY CS3030) were also reported. The drive vanishes from Device Manager mid-operation and returns unreadable SMART telemetry until a cold reboot. This is a firmware-level interaction fault triggered by sustained large-file operations, not a dead controller. On the bench these drives respond to the standard E12 ROM-mode entry and SRAM loader injection described above; the recovery path is unchanged, but the population of failing E12 drives expanded after the update.

PS5018-E18 (NVMe Gen4, triple-core, DRAM-equipped)

Typical signatures: Drive disappears from BIOS after thermal stress under sustained Gen4 writes, or goes electrically dead after a PMIC short triggered by a voltage spike or PSU instability. Some failures present as boot loops where the drive enumerates briefly then falls off the bus.

PC-3000 support boundary: ACE Lab classifies the E18 as limited to firmware repair operations. Full virtual FTL reconstruction through SRAM loader injection is not available for this controller because of the combination of AES-256 encryption, TCG Opal 2.0 implementation, & 4th-generation LDPC with RAID ECC parity striping. There is no Safe Mode entry that yields a usable translator rebuild path.

Recovery path: Board-level repair is the primary route. Locate the failed component (typically the PMIC or a voltage regulator) with FLIR thermal imaging under limited power. Replace the component with a Hakko FM-2032 microsoldering iron or a Zhuo Mao BGA rework station for denser packages. Once the original E18 controller boots, the AES-256 keys are intact & the drive decrypts the NAND in real time across the standard NVMe path.

Outcome: If the E18 silicon is cracked, burned, or internally shorted, the data is unrecoverable; the encryption key dies with the controller. If the failure is in the power delivery circuitry or a supporting component, the controller can be revived & the data extracted. NVMe board repair tier: $600–$900. A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.

Thermal-throttle bench symptom: Before the controller dies, the E18 typically passes through a degraded read window that is easy to misread as a software problem. Once junction temperature crosses roughly 70°C, the controller engages aggressive throttle, dropping sustained sequential write throughput from roughly 7,000 MB/s down to approximately 1,800 MB/s. Elevated NAND temperature increases charge leakage, which raises the raw bit error rate; when that rate exceeds the 4th-generation LDPC plus RAID-ECC correction budget during an in-flight FTL metadata write, the commit lands with uncorrectable errors. The user-visible signature is file-system stalls, long boot times, and the drive intermittently dropping off the PCIe bus. Drives in this state are still imageable through PC-3000 if the controller silicon is alive; delay accelerates further charge-leakage damage and lengthens imaging time.

PS3112-S12 (SATA, DRAM-equipped, 8-channel)

Typical signatures: Drive enters a persistent BSY state during ATA identify or drops off the SATA bus entirely. Unlike the PS3111-S11, the S12 does not exhibit a documented "SATAFIRM" fallback identity string; the dominant failure mode is a non-responsive controller after service-area corruption or LDPC exhaustion on degraded 3D TLC or 3D QLC NAND. Built on a 28nm dual-CPU architecture with DDR3L or DDR4 cache, the S12 is a higher-tier SATA part deployed in drives like the Seagate FireCuda 120, GoodRam IRDM PRO Gen 2, and Kingston DC500R, not in entry-level Kingston A400-class hardware.

Safe Mode entry: PC-3000 SSD reaches the S12 through the Phison Active Utility using vendor-specific ATA commands. When the drive is fully unresponsive, technicians short the ROM test points adjacent to the controller during power-on to force the controller into Mask ROM and then upload the loader over SATA. Because the S12 has onboard DRAM, the boot sequence does not depend on reading the FTL from NAND first; the loader can rebuild the translator without the FTL panic loop seen on DRAM-less S11 silicon.

SRAM loader & translator rebuild: PC-3000 injects a volatile S12 loader matched to controller revision and NAND ONFI ID. The loader exposes raw NAND pages and reverses the controller's scrambling. Translator rebuild consumes the surviving service-area modules plus OOB metadata and resolves conflicts by sequence number, the same pattern used on the S10 but with the S12's 8-channel page geometry.

Encryption boundary: The S12 implements hardware AES-256 with TCG Opal/Pyrite plus a XEX (XOR-Encrypt-XOR) tweakable block cipher across the data path. This is the encryption discontinuity inside the Phison SATA family: the S11 and S10 use reversible XOR scrambling and remain chip-off candidates as a last resort, while the S12 binds its Media Encryption Key to the controller silicon. Chip-off on a dead S12 yields ciphertext. Recovery on electrically dead S12 boards follows the same path as encrypted Phison NVMe parts: revive the original controller through board-level repair so the hardware engine can decrypt the NAND in real time. SATA firmware recovery tier: $600–$900. Board repair tier: $450–$600.

PS5008-E8 (NVMe Gen3 x2, 4-channel)

Typical signatures: Drive drops off the PCIe bus, reports 0MB capacity, or fails NVMe identify. The E8 is Phison's first-generation consumer NVMe controller, released in 2017 on a constrained PCIe 3.0 x2 lane budget to keep cost and thermal envelope down. It shipped in two variants: the baseline E8 with onboard DDR3L DRAM, and the E8T DRAM-less variant that uses Host Memory Buffer to cache the FTL in host RAM. Common drives include the MyDigitalSSD SBX, Patriot Scorch, and Corsair MP300. (The MyDigitalSSD BPX and Corsair MP500 use the older PS5007-E7 controller, not the E8; do not assume Phison generation from drive name alone.)

Safe Mode entry: Connect the M.2 drive to PC-3000 Portable III's M.2 adapter. A firmware-panicked E8 completes PCIe link training but stalls during NVMe initialization. Short the Safe Mode pads adjacent to the controller during power-on; PC-3000 then loads the Phison NVMe Active Utility and drives further interaction over vendor-specific NVMe commands.

SRAM loader & translator rebuild: PC-3000 injects a controller-specific microcode loader into the E8's SRAM. On the DRAM-equipped E8, the working FTL was held in onboard cache and flushed periodically to the service area; the loader rebuilds the translator from the most recent SA snapshot reconciled against OOB metadata. On the E8T variant, HMB content in host RAM is lost the moment the drive falls off the bus, so the rebuild is limited to whatever FTL state was committed to NAND before the panic. Either way, the loader writes nothing to NAND; the original data is preserved.

Encryption boundary: The E8 implements hardware AES-256 with the Media Encryption Key fused to the controller silicon, plus TCG Opal and Pyrite support. Chip-off is non-viable; desoldered NAND yields ciphertext. If the E8 board has a dead PMIC or shorted regulator, recovery requires board-level repair before the controller can decrypt the NAND. NVMe firmware recovery tier: $900–$1,200. NVMe board repair tier: $600–$900.

PS5013-E13T (NVMe Gen3 x4, DRAM-less, HMB, 4-channel)

Typical signatures: Drive disappears from BIOS or enumerates with 0MB capacity after a power loss event. Built on a 28nm process with a single Cortex-R5 core paired with a CoXProcessor for NAND management, the E13T is one of the most prevalent Gen3 budget NVMe controllers in the field. It ships in the Crucial P2, Patriot P300, and Sabrent Rocket Nano Rugged among many other budget M.2 2230/2242/2280 drives. Because it is DRAM-less and depends on Host Memory Buffer, the Flash Translation Layer is cached in the host computer's RAM through the PCIe bus; a sudden power cut or PCIe link drop leaves the in-flight FTL update unflushed, and the controller fails to re-read the service area on the next boot.

Safe Mode entry: Connect to PC-3000 Portable III via the M.2 adapter. Short the Safe Mode pads while powering on to bypass the panicked firmware boot. PC-3000 Phison NVMe Active Utility recognizes the E13T and drives the recovery via vendor-specific NVMe commands.

SRAM loader & translator rebuild: PC-3000 uploads an E13T loader to the controller's SRAM. Because HMB content is gone the moment the drive fell off the bus, the rebuild starts from whatever FTL fragments survived in the service area, then scans NAND page headers across all four channels to virtually reconstruct the logical-to-physical map in workstation RAM. This is the same technique used on the E12 but on a smaller channel count and without the safety net of an onboard DRAM cache, which is why E13T cases skew toward longer rebuild times when the SA itself is partially corrupt.

Encryption boundary: The E13T implements hardware AES-256 with the MEK fused to the controller silicon and supports TCG Opal/Pyrite. Chip-off is non-viable; desoldered NAND yields ciphertext. If the E13T silicon is dead, board repair is the only path to preserve the encryption chain so PC-3000 can extract through the native NVMe path once the controller boots. NVMe firmware recovery tier: $900–$1,200. NVMe board repair tier: $600–$900.

PS5021-E21T (NVMe Gen4, DRAM-less, HMB, 4-channel)

Typical signatures: Drive enumerates with 0MB capacity or silent data corruption. Two distinct failure modes: Host Memory Buffer FTL loss after a PCIe link drop during an in-flight mapping update, & the confirmed PCIe 4.0 data loss bug on 1TB M.2 2230 drives (Sabrent Rocket 2230 among others) where sustained Gen4 writes overwhelm HMB management & corrupt the FTL. Drives operating at Gen3 speeds (e.g., in a Steam Deck) are insulated from the Gen4-specific bug.

PC-3000 support boundary: Support for the E21T is under development. There is no mature SRAM loader profile for virtual FTL reconstruction at this time. The controller combines the structural fragility of a DRAM-less design with the strict AES-256 hardware encryption of a flagship NVMe part, so both firmware-level & chip-off paths are closed.

Recovery path: Board-level repair to keep the original controller electrically sound is the working approach while PC-3000 E21T utility modules mature. When the PCB is intact, native firmware-healing routines can sometimes reconcile the HMB-derived FTL against the last committed journal on NAND after several supervised power cycles in the recovery rig. Data lost to the Gen4 bug itself (blocks where the controller wrote garbage) is unrecoverable; unaffected blocks can be imaged once the drive enumerates.

Outcome: Prognosis depends on whether the controller silicon is alive. If it is, recovery yield is high for HMB-only FTL loss & partial for Gen4-bug corruption. If the controller is dead, chip-off yields ciphertext & the data is unrecoverable. NVMe board repair tier: $600–$900.

PS5026-E26 (NVMe Gen5, dual ARM Cortex-R5, 8-channel)

Support disclosure: Rossmann does not currently offer in-lab recovery for PS5026-E26. The E26 is absent from the ACELab PC-3000 SSD v3.8.10 supported-controllers list (02/12/2026), and the silicon-bound AES-256 Media Encryption Key forecloses chip-off as a fallback. The information below describes the bench reality of how this controller fails so that the engineering tradeoff is visible; it is not an offer of service.

Typical signatures: The E26 is the first consumer Phison part on PCIe 5.0 x4, built on a TSMC 12nm process with a dual ARM Cortex-R5 architecture, CoXProcessors, and 8 NAND channels with 32 chip-enable lines. It powers the Corsair MP700, Crucial T700, and Seagate FireCuda 540. The dominant failure pattern is uncontrolled thermal shutdown: the controller can draw up to 10W under sustained sequential workloads and pushes junction temperatures past 100°C without a heatsink. Original Phison firmware on the MP700 reached file-system corruption or hard thermal cutoff within minutes of bench testing without active cooling; Phison subsequently released firmware 22.1, which introduces link-state thermal throttling that drops the PHY from PCIe 5.0 to PCIe 4.0 or 3.0 instead of crashing the drive outright. Other failures present as a shorted PMIC or low-dropout regulator, BGA solder fatigue from rapid thermal cycling on the controller die, or collapse of the NAND I/O (VCCQ), controller core, or NAND VCC rails after a power surge.

Why support is not offered today: The E26 combines a 5th-generation 4KB-frame LDPC ECC engine, AES-256 with TCG Opal 2.0, and a Media Encryption Key fused into the controller's one-time-programmable silicon. A raw chip-off of the Micron 232-layer B58R NAND yields ciphertext that cannot be decrypted off-controller. A working recovery path therefore requires both an ACELab PC-3000 SSD loader profile for the E26 and the ability to keep the original controller silicon electrically alive long enough to decrypt during NVMe imaging. The loader profile is not yet in ACELab's shipping support matrix. Once it is, this section will be updated and the disclaimer above removed.

XOR Scrambling (PS3111-S11, PS3110-S10)

Older Phison SATA controllers apply XOR data scrambling at the page level. This isn't encryption; it's a data integrity technique that randomizes bit patterns to improve NAND programming reliability and reduce read disturb. The XOR pattern is deterministic and derived from the controller model, NAND chip ID, & firmware version. PC-3000's Phison utility reverses the scrambling automatically during extraction.

Because XOR scrambling is reversible without a secret key, chip-off is technically viable on PS3111-S11 drives as a last resort. An engineer desolders the NAND chips, reads them on a separate programmer, applies the correct XOR pattern, & reconstructs the logical volume. This is slower and riskier than controller-level recovery through PC-3000, but it provides an alternative path when the controller PCB is too damaged for repair. NAND swap: $1,200–$1,500. 50% deposit required; donor drive cost additional.

AES-256 Encryption (PS5012-E12, PS5016-E16, PS5018-E18, PS5026-E26)

Most NVMe Phison controllers implement hardware AES-256 encryption with the Media Encryption Key (MEK) fused to the controller's silicon. All Phison controllers also apply proprietary XOR data scrambling regardless of AES status. On drives with AES-256 enabled, every byte written to NAND is encrypted; every byte read from NAND is decrypted in real time by the controller's hardware engine. Some E16-based drives ship without AES-256 (Sabrent Rocket Q4, Seagate FireCuda 520), but the XOR scrambling and proprietary FTL still make chip-off impractical.

If the controller dies, the encryption key dies with it. Desoldering the NAND chips from a dead PS5018-E18 & reading them on a programmer yields ciphertext; the AES-256 key that could decrypt the data is embedded in the now-dead controller IC. Chip-off is not a recovery option on encrypted NVMe Phison SSDs. The only path is board-level repair: identify the failed component (typically a PMIC or voltage regulator) using FLIR thermal imaging, replace it with a Hakko FM-2032, & bring the original controller back to life. When the controller boots, the encryption keys are intact and the data is accessible. NVMe board repair: $600–$900.

PS5021-E21T: NVMe with AES-256 and HMB

The E21T combines the worst of both risk profiles. It's DRAM-less (using HMB for FTL caching, like the budget SATA controllers) but uses hardware AES-256 encryption (like the high-end NVMe controllers). A power cut corrupts the FTL through HMB failure, and if the controller dies from the resulting electrical stress, the encryption key is lost. Board-level repair is the only option; chip-off yields encrypted data without a key. The E21T also has a confirmed PCIe 4.0 data loss bug affecting 1TB M.2 2230 models, where data corruption occurs at sustained Gen4 transfer speeds.