PC-3000 SSD Recovery Workflows
Phison SSD Controller Recovery Procedures
Phison controller recovery starts with Technological Mode: shorting the R/B* pin on the PCB to force the controller out of its firmware panic loop, then injecting a volatile microcode loader into SRAM through PC-3000 SSD. The loader bypasses the corrupted firmware stored in NAND, disables TRIM & garbage collection, and provides raw read access to reconstruct the Flash Translation Layer. This page covers the specific PC-3000 workflows for the PS3111-S11, PS5012-E12, PS5013-E13T, & PS5019-E19 controller families. SATA firmware recovery starts at $600–$900. NVMe firmware recovery starts at $900–$1,200. No diagnostic fee.
Which Phison Controllers Does PC-3000 SSD Support?
PC-3000 SSD's Phison utility covers eight controller families across SATA & NVMe. Support depth varies: some controllers get full FTL reconstruction while others are limited to firmware repair. The hardware platform matters too; NVMe controllers require the PC-3000 Portable III with its PCIe M.2 adapter. UDMA-E & Express boards handle SATA only.
| Controller | Interface | PC-3000 Hardware | Encryption | Support Level |
|---|---|---|---|---|
| PS3111-S11 | SATA | Express, Portable III | XOR scrambling | Full: loader injection, FTL rebuild, data extraction |
| PS3110-S10 | SATA | Express, Portable III | XOR scrambling | Full: loader injection, FTL rebuild, data extraction |
| PS5012-E12 | NVMe Gen3 | Portable III only | Optional AES-256 + XOR scrambling + LDPC | Full: loader injection, FTL rebuild, data extraction |
| PS5013-E13T | NVMe Gen3 | Portable III only | Optional AES-256 + XOR scrambling + LDPC | Full: loader injection, FTL rebuild, data extraction |
| PS5016-E16 | NVMe Gen4 | Portable III only | Optional AES-256 + XOR scrambling + LDPC | Full: loader injection, FTL rebuild, data extraction |
| PS5018-E18 | NVMe Gen4 | Portable III only | Optional AES-256 + XOR scrambling + LDPC | Firmware repair only; full FTL extraction limited |
| PS5019-E19 | NVMe Gen4 | Portable III only | Optional AES-256 / TCG Opal + XOR scrambling + LDPC | Full: loader injection, FTL rebuild, data extraction |
| PS5021-E21T | NVMe Gen4 | Portable III only | Optional AES-256 + XOR scrambling + LDPC | Full: loader injection, FTL rebuild, data extraction |
PS5018-E18 support is limited to firmware repair operations. Full virtual translator data extraction is not available through PC-3000 for the E18. Board-level repair to revive the original controller, then standard NVMe imaging, is the primary recovery path for dead E18 drives.
What Are SATAFIRM S11 and SATABURN S11?
SATAFIRM S11 and SATABURN S11 are firmware panic states, not model names. Both indicate that the Phison PS3111-S11 controller lost its Flash Translation Layer and dropped to its factory BootROM. The drive reports "SATAFIRM S11" or "SATABURN S11" as its identity string, shows 0GB or 2MB capacity, and rejects all read commands. Your data is still on the NAND chips; the controller just can't find it.
- SATAFIRM S11
- The default firmware panic alias on standard PS3111-S11 silicon. Appears in BIOS/Disk Management when the controller detects unrecoverable FTL corruption during boot. Most common on Kingston A400, PNY CS900, Patriot Burst, & Silicon Power S55 drives. PC-3000 SATA firmware recovery: $600–$900.
- SATABURN S11
- A variant firmware panic alias produced by the PS3111-S11T silicon revision or alternate firmware branch. The failure mechanism is identical to SATAFIRM S11: corrupted FTL pages in NAND prevent the controller from completing its boot sequence. The PC-3000 recovery workflow is the same. There is no difference in data recoverability between the two states.
Why These Drives Fail After Power Loss
The PS3111-S11 is a 2-channel, DRAM-less controller. It stores the working FTL directly in TLC NAND rather than in dedicated cache memory. A power cut during a write can corrupt the in-flight FTL update, and there's no safe copy to fall back to. Budget drives pair this controller with lower-binned NAND that hits the ECC correction threshold sooner than enterprise-grade flash, compounding the failure rate.
Do Not Run MPTool or PhisonToolBox
MPTool and PhisonToolBox are factory mass-production tools. They reinitialize the NAND layout, create a new empty FTL, and destroy all user data. Reflashing will remove the SATAFIRM S11 string and make the drive appear functional, but the data is gone. The only non-destructive recovery method is PC-3000 SSD's volatile microcode injection.
How Much Does Phison SSD Recovery Cost?
Recovery cost depends on the failure type, not the controller model. A SATAFIRM S11 firmware panic on a Kingston A400 falls into the same pricing tier as firmware corruption on a PNY CS900 or Patriot Burst. No diagnostic fee. No data, no recovery fee. +$100 rush fee to move to the front of the queue.
SATA Phison Recovery (PS3111-S11, PS3110-S10)
Simple Copy
Low complexityYour drive works, you just need the data moved off it
$200
3-5 business days
Functional drive; data transfer to new media
Rush available: +$100
File System Recovery
Low complexityYour drive isn't showing up, but it's not physically damaged
From $250
2-4 weeks
File system corruption. Visible to recovery software but not to OS
Starting price; final depends on complexity
Circuit Board Repair
Medium complexityYour drive won't power on or has shorted components
$450–$600
3-6 weeks
PCB issues: failed voltage regulators, dead PMICs, shorted capacitors
May require a donor drive (additional cost)
Firmware Recovery
Medium complexityMost CommonYour drive is detected but shows the wrong name, wrong size, or no data
$600–$900
3-6 weeks
Firmware corruption: ROM, modules, or system files corrupted
Price depends on extent of bad areas in NAND
PCB / NAND Swap
High complexityYour drive's circuit board is severely damaged and requires NAND chip transplant to a donor PCB
$1,200–$1,500
4-8 weeks
NAND swap onto donor PCB. Precision microsoldering and BGA rework required
50% deposit required; donor drive cost additional
50% deposit required
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. NAND swap requires a 50% deposit because donor parts are consumed in the attempt.
Rush fee: +$100 rush fee to move to the front of the queue.
Donor drives: A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
Target drive: The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. All prices are plus applicable tax.
A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
NVMe Phison Recovery (PS5012-E12, PS5013-E13T, PS5019-E19)
Simple Copy
Low complexityYour NVMe drive works, you just need the data moved off it
$200
3-5 business days
Functional drive; data transfer to new media
Rush available: +$100
File System Recovery
Low complexityYour NVMe drive isn't showing up, but it's not physically damaged
From $250
2-4 weeks
File system corruption. Visible to recovery software but not to OS
Starting price; final depends on complexity
Circuit Board Repair
Medium complexityYour NVMe drive won't power on or has shorted components
$600–$900
3-6 weeks
PCB issues: failed voltage regulators, dead PMICs, shorted capacitors
May require a donor drive (additional cost)
Firmware Recovery
Medium complexityMost CommonYour NVMe drive is detected but shows the wrong name, wrong size, or no data
$900–$1,200
3-6 weeks
Firmware corruption: ROM, modules, or system files corrupted
Price depends on extent of bad areas in NAND
PCB / NAND Swap
High complexityYour NVMe drive's circuit board is severely damaged and requires NAND chip transplant to a donor PCB
$1,200–$2,500
4-8 weeks
NAND swap onto donor PCB. Precision microsoldering and BGA rework required
50% deposit required; donor drive cost additional
50% deposit required
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. NAND swap requires a 50% deposit because donor parts are consumed in the attempt.
Rush fee: +$100 rush fee to move to the front of the queue.
Donor drives: A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
Target drive: The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. All prices are plus applicable tax.
A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
PC-3000 SATA Workflow: PS3111-S11 & PS3110-S10
SATA Phison recovery connects through PC-3000 Express or Portable III. The PS3111-S11 has a specific hardware requirement: on PC-3000 UDMA-E & Express, Technological Mode commands must route through a PATA port with a 40cm IDE cable and ACE Lab PATA-to-SATA adapter. The Portable III handles Technological Mode natively over SATA, eliminating the adapter.
Technological Mode Entry & Loader Injection
- Connect the drive. On PC-3000 Express: use PATA0 or PATA1 via a short (40cm max) IDE cable with the PATA-to-SATA adapter. On Portable III: connect via standard SATA to any port. Long IDE cables introduce signal degradation.
- Force Technological Mode. Locate the R/B* (Ready/Busy) test points on the PCB, typically marked near the R29 pad. Short this pin to ground using precision tweezers while cycling the power supply. Grounding the R/B* pin is an open-drain operation that halts the normal firmware load from NAND and forces the controller into its factory BootROM state.
- Confirm ROM mode in PC-3000. The drive should report its ROM-mode identity string (SATAFIRM S11 or SATABURN S11) in the ATA Identify response. Verify 0GB or 2MB capacity in the passport before proceeding.
- Launch the Phison Active Utility. Select the correct utility variant in PC-3000 SSD. Match the loader (LDR) to the controller silicon, NAND chip ID, & firmware version. The LDR is uploaded directly into the controller's volatile SRAM.
- Remove tweezers. PC-3000 prompts the engineer to release the short after the loader is injected. The controller now runs from the temporary SRAM loader instead of the corrupted NAND firmware.
- Reverse XOR scrambling. The loader reads raw NAND pages and reverses the XOR data scrambling applied at the page level. The XOR polynomial is deterministic, derived from the controller model & NAND chip ID. PC-3000 handles this automatically with the correct loader profile.
- Build the virtual translator. PC-3000 scans surviving NAND metadata: block sequence numbers, wear-level counters, & ECC checksums. It reconstructs the LBA-to-PBA mapping table entirely in the host PC's RAM. The translator is never written back to the SSD.
- Extract data via Data Extractor. With the virtual translator active, PC-3000 presents the file system (NTFS, exFAT, ext4) and extracts user data to a target drive. Check "Ignore ECC errors" to handle degraded NAND blocks that fall below the correction threshold.
PC-3000 NVMe Workflow: PS5012-E12, PS5013-E13T, PS5019-E19
NVMe Phison recovery requires the PC-3000 Portable III with its M.2 PCIe NVMe adapter. UDMA-E & Express boards don't have PCIe interfaces and can't communicate with NVMe drives. The core workflow follows the same injection-and-rebuild pattern as SATA, but with PCIe-specific link training, LDPC decoding through the original controller, and thermal management during extraction. On drives where the OEM enabled AES-256, the loader also re-activates the hardware decryption engine.
NVMe Loader Injection & FTL Reconstruction
- Connect via PC-3000 Portable III. Seat the M.2 NVMe drive on the dedicated adapter connected to Port 0. Verify PCIe link training status; a firmware-panicked drive will complete link training but fail NVMe initialization.
- Force safe mode. If the drive doesn't enumerate on the PCIe bus, short the controller's safe mode pins on the PCB while powering on. Pin locations are controller-specific; the PS5012-E12, PS5013-E13T, & PS5019-E19 each have different pad layouts.
- Launch the PC-3000 NVMe Phison utility. Confirm the firmware panic state, then select the controller-specific recovery profile. Match the LDR to the controller & NAND chip ID (Toshiba/Kioxia BiCS, Micron 3D TLC, SK hynix).
- Inject the SRAM loader. PC-3000 uploads the loader into the controller's volatile SRAM. The loader disables background TRIM & garbage collection to freeze the NAND state. On drives where the OEM enabled AES-256, the loader also re-activates the hardware cryptographic engine so data is decrypted in real time during extraction.
- Rebuild the FTL from NAND metadata. The PS5012-E12's 8-channel interleaving requires correct channel stride & plane geometry. The DRAM-less PS5013-E13T & PS5019-E19 use Host Memory Buffer to cache the FTL during normal operation. After a crash, PC-3000 bypasses the lost HMB cache entirely, scanning the physical NAND spare area for surviving block sequence numbers to reconstruct the logical address space.
- Manage thermals. Gen4 controllers (PS5016-E16, PS5019-E19) generate high thermal loads during sustained extraction. Active cooling is required to prevent the controller from entering thermal shutdown mid-recovery. If the controller throttles, extraction pauses and the read state may need to be re-established.
- Extract via Data Extractor. Image the drive sector-by-sector. On degraded NAND blocks, use multi-pass reading with voltage threshold shifts to maximize data yield from cells that the controller's ECC engine has abandoned.
PS5013-E13T & PS5019-E19: DRAM-less NVMe Recovery
The PS5013-E13T (Gen3x4, found in some batches of the Patriot P300 & Kingston NV1; both models swap controllers between production runs) and PS5019-E19 (Gen4x4, found in WD_BLACK SN750 SE) are both DRAM-less controllers that cache the FTL in the host PC's RAM through Host Memory Buffer. A power cut or system crash severs the PCIe link, and the in-flight FTL update in host RAM never commits to NAND.
Recovery on these controllers follows the standard NVMe injection workflow above. The PS5019-E19 adds Phison's 4th Gen LDPC ECC engine and optional TCG Opal support. When the OEM enables AES-256 media encryption, the controller handles both encryption and self-encrypting drive authentication. Even without AES, the proprietary LDPC soft-decision decoding binds the data to the controller silicon. If the controller dies, chip-off is not viable. Board-level repair to revive the original controller is the only recovery path. NVMe board repair: $600–$900.
PS5018-E18: Limited PC-3000 Support
The PS5018-E18 (Gen4x4, found in Corsair MP600 Pro, Seagate FireCuda 530, Kingston KC3000) has limited PC-3000 SSD support. ACE Lab lists the E18 as "Only Repairing," meaning diagnostic mode entry and firmware repair are available, but full virtual translator data extraction is not supported for all NAND configurations.
When E18 drives fail from PMIC or component-level damage, board-level repair is the primary recovery path. Identify the failed component using FLIR thermal imaging, replace it with a Hakko FM-2032 microsoldering iron, and bring the original controller back to life. Once the controller boots with functioning AES-256 keys, standard NVMe imaging extracts the data. NVMe board repair: $600–$900.
How Does PC-3000 Rebuild the Flash Translation Layer?
The Flash Translation Layer maps logical block addresses (what your operating system requests) to physical NAND page locations (where the data is stored on the flash chips). When this map corrupts, PC-3000 reconstructs it from surviving NAND metadata without modifying the drive. The entire rebuilt map lives in the host PC's RAM.
Physical Dump & Metadata Scanning
After the SRAM loader injection, PC-3000 gains low-level read access to the physical NAND chips without relying on the drive's dead firmware. The software scans every physical block for page headers, block sequence numbers, & wear-level counters. These are fragments of metadata that survived the crash.
Algorithmic Sorting & Map Reconstruction
PC-3000 uses heuristics specifically tailored for Phison's proprietary wear-leveling algorithms to sort the scattered blocks. The software matches block sequence numbers across NAND channels to determine which physical pages correspond to which logical addresses. On 8-channel controllers (PS3110-S10, PS5012-E12, PS5016-E16), the interleaving pattern and plane geometry must be correctly decoded for the logical image to be valid.
SATA (XOR) vs NVMe (AES-256) Translation Differences
On SATA controllers (PS3111-S11, PS3110-S10), the raw NAND data is XOR-scrambled but not encrypted. PC-3000 reverses the scrambling using the deterministic XOR polynomial matched to the controller model & NAND chip ID. The virtual translator maps descrambled pages to logical addresses.
On NVMe controllers (PS5012-E12, PS5013-E13T, PS5019-E19), the raw NAND data is bound by proprietary LDPC soft-decision error correction and XOR scrambling. When AES-256 is enabled by the OEM, the SRAM loader also re-activates the controller's hardware AES engine, which decrypts each page as PC-3000 reads it. Whether or not AES is active, the LDPC DSP and XOR scrambling make chip-off unviable: a standard programmer cannot reproduce the controller's soft-decision decoding, so the raw dump is mathematically undecodable.
Recovering TRIMmed Data on Phison Drives
PC-3000 SSD includes a physical reading mode for Phison drives that can access historical versions of the translation map. If a file was deleted & the OS issued a TRIM command, the controller unmapped the logical addresses. But if garbage collection hasn't yet physically erased the underlying NAND pages, the data still exists on the flash cells. The physical reading mode parses older translation entries to locate these orphaned pages. The data is recoverable only if the NAND cells haven't been erased by the controller's background garbage collection.
Equipment for Phison SSD Recovery
Every Phison recovery at our Austin lab uses the same equipment set. SATA controllers connect through PC-3000 Express or Portable III. NVMe controllers go through Portable III's M.2 adapter. Board-level repairs use Hakko microsoldering and FLIR thermal imaging for fault localization.
Firmware Recovery
- PC-3000 SSD (Phison Active Utility)
- PC-3000 Express (SATA interface)
- PC-3000 Portable III (NVMe M.2 adapter)
- ACE Lab PATA-to-SATA adapter (PS3111 on Express)
Board-Level Repair
- Hakko FM-2032 microsoldering iron (FM-203 base)
- FLIR thermal camera (fault localization)
- Atten 862 hot air rework station
- Zhuo Mao precision BGA rework station
Phison Controller Reference Pages
Each Phison controller family has a dedicated page covering its specific failure modes, affected SSD models, & pricing. The Phison Architecture overview covers XOR vs AES-256 encryption and the board repair bridge for encrypted NVMe drives.
Phison PC-3000 Recovery FAQ
What is Technological Mode on a Phison SSD?
What is the difference between SATAFIRM S11 and SATABURN S11?
Why does the PS3111-S11 require a PATA-to-SATA adapter on PC-3000 Express?
How much does PC-3000 Phison SSD recovery cost?
Will MPTool or PhisonToolBox recover data from a SATAFIRM S11 drive?
Can chip-off recovery work on Phison NVMe SSDs?
What is a virtual translator in PC-3000 SSD recovery?
Does PC-3000 SSD support the PS5013-E13T and PS5019-E19?
Need Recovery for Other Devices?
M.2, U.2, PCIe NVMe drives
Mechanical HDD recovery
Soldered SSD recovery
SSD array recovery
Similar NAND flash
View complete catalog
Controller family overview & encryption guide
Phison SSD not detected, stuck in firmware panic, or showing SATAFIRM S11?
Free evaluation. SATA firmware recovery from $600–$900. NVMe recovery from $900–$1,200. No data, no fee.