DZAT and NAND Physics: Why TRIM Makes SSD Recovery Impossible

DZAT stands for Deterministic Read Zero After TRIM. It's a firmware behavior where the SSD controller intercepts read requests for deleted blocks and returns all zeroes. This happens instantly after TRIM processing, before the physical NAND cells are erased. Recovery software like Disk Drill, EaseUS, or R-Studio reads through the controller's standard interface, receives zeroes, and concludes the data is gone.

DZAT (SATA SSDs)

Defined by SATA specification Word 69 bit 5 in the device IDENTIFY data. The controller returns all zeroes for any read to a TRIMmed logical block address. Implemented on most SATA SSDs manufactured after 2015.

DRAT (Older SATA SSDs)

Defined by SATA Word 69 bit 14. Returns a consistent but not necessarily zero value for TRIMmed addresses. Common on drives before 2018. Slightly more favorable for software-based recovery since the returned pattern differs from genuine zeroes.

DLFEAT=001b (NVMe SSDs)

The NVMe equivalent of DZAT. Set in the namespace metadata, it forces reads to deallocated blocks to return all zeroes. Every major NVMe controller (Samsung Elpis, Phison PS5018-E18, Silicon Motion SM2262EN) enforces this behavior.

The result for you: any recovery tool you run from Windows, macOS, or Linux will see zeroes where your data used to be. The data may still physically exist on the NAND memory chips, but the controller blocks access through the normal read path. Getting past DZAT requires bypassing the controller entirely, which is what PC-3000 SSD does in our lab.

Recovery software works when the SSD is physically healthy and the problem is logical: an accidentally deleted partition, a corrupted file system, or formatted volume where TRIM hasn't executed on the target blocks. Tools like Disk Drill, EaseUS, PhotoRec, and R-Studio scan the drive through the controller's standard interface and reconstruct file structures from whatever the controller returns.

That stops working the moment DZAT activates. Once the controller processes TRIM, software sees zeroes. If the controller is dead (the drive doesn't appear in BIOS), software can't communicate with the drive at all. And if the firmware is corrupted (the drive reports 0MB capacity or the wrong model name), software has no valid file system to scan.

Lab recovery picks up where software fails. PC-3000 SSD communicates with the controller at the vendor command level, below the SATA or NVMe protocol. For dead controllers, we diagnose the failure using FLIR thermal imaging and repair the original PCB with Hakko FM-2032 microsoldering. The distinction matters because many SSDs encrypt data using hardware AES-256, with the encryption key bound to the controller. A dead controller on an encrypted drive means chip-off yields only ciphertext. Board-level repair to revive the original controller is the only path to readable data on encrypted SSDs.

Older planar NAND used floating gate transistors: a conductive polysilicon gate isolated between oxide layers stores electrons that set the cell's threshold voltage. Modern 3D NAND (Samsung V-NAND, Micron 3D, Kioxia BiCS) uses Charge Trap Flash (CTF), where electrons are trapped in a non-conductive silicon nitride layer instead. The underlying principle is the same: trapped charge determines threshold voltage, and the controller reads that voltage as a binary value. The difference matters for endurance and data retention, but both architectures follow the same erase and programming physics described below.

Programming: Fowler-Nordheim Tunneling

Writing data to a NAND cell pushes electrons through the tunnel oxide into the charge storage layer (floating gate or nitride trap) using Fowler-Nordheim (F-N) tunneling. A high voltage (+15V to +20V) applied to the control gate creates an electric field strong enough for electrons to quantum-tunnel through the oxide barrier. The accumulated charge raises the cell's threshold voltage. SLC cells store one bit across two voltage states; TLC cells store 3 bits across 8 voltage levels; QLC stores 4 bits across 16 levels.

Each program/erase (P/E) cycle degrades the tunnel oxide. The oxide traps electrons that don't fully clear during erase, gradually narrowing the voltage windows between states. Consumer TLC NAND is rated for roughly 1,000-3,000 P/E cycles; QLC for 500-1,000. This physical degradation is why SSDs have a write endurance limit and why older, heavily-used drives develop read errors that PC-3000 SSD must work around during recovery.

Erasure: Block-Level Constraint

NAND can write individual pages (4KB-16KB) but can only erase entire blocks (typically 256KB-4MB containing 64-256 pages). This is a physical limitation, not a firmware choice. Transistors in a NAND string share a common P-well substrate. The erase voltage is applied to the P-well, which drains the charge storage layer in every cell in the block simultaneously through reverse F-N tunneling. There is no way to erase a single page within a block without erasing every page in that block.

This page-write/block-erase asymmetry is the reason garbage collection exists. When you delete 3 files spread across a block that also contains 5 active files, the controller can't just erase the deleted pages. It reads the 5 valid pages, copies them to a clean block, then applies the erase voltage to the entire old block. The valid pages survive in their new location. The deleted data is electrically destroyed.

PC-3000 SSD reads past DZAT and DLFEAT by forcing the controller into a diagnostic state where all standard processing halts. The entry method varies by controller family: shorting diagnostic test points on the PCB, issuing vendor-specific command sequences, or triggering a controlled firmware exception. Once in diagnostic mode, the controller stops processing TRIM, garbage collection, wear leveling, and standard read/write operations.

Safe Mode (Phison, Silicon Motion, Marvell)

For Phison and Silicon Motion controllers, PC-3000 SSD enters Safe Mode by shorting specific test points on the SSD's PCB during power-on. This forces the controller to boot with minimal firmware, halting all background processes. The PC-3000 Phison utility or SM utility then uploads a custom microcode loader to the controller's SRAM. This loader reads Physical Block Addresses (PBAs) directly from the NAND array, bypassing the FTL's logical-to-physical translation and the DZAT zero-return mask.

Techno Mode (Samsung)

Samsung controllers enter Techno Mode through vendor-specific command sequences rather than test point shorting. PC-3000 SSD's Samsung utility issues these commands to halt GC, wear leveling, and DLFEAT enforcement. In Techno Mode, the utility reads the FTL mapping tables from the controller's DRAM or NAND-backed metadata area, maps logical addresses to physical NAND coordinates, and reads raw pages at those locations. If the cells still hold charge, the data is recoverable regardless of what the standard NVMe interface reports.

Modern Samsung NVMe controllers (Elpis in the 980 Pro, Pascal in the 990 Pro) have limited PC-3000 firmware support compared to older Samsung controllers. When PC-3000 can't extract data through Techno Mode alone, recovery may require board-level hardware repair: reviving a failed PMIC or voltage regulator using FLIR thermal fault localization and Hakko FM-2032 component replacement, then reading the drive through the revived original controller.

FTL Reconstruction

When the FTL mapping table itself is corrupted (common after sudden power loss or firmware crashes), PC-3000 SSD rebuilds the logical-to-physical map from NAND metadata pages. The utility scans every physical block, reads the page headers and ECC data, and reconstructs which logical address each page belongs to. This is the firmware recovery tier (SATA: $600–$900, NVMe: $900–$1,200) and represents a software-level lab procedure that consumer tools can't perform because they have no access to the controller's vendor command interface.

Wear leveling distributes writes across all NAND blocks to prevent any single block from wearing out prematurely. The controller tracks P/E cycle counts per block and periodically relocates data from low-wear blocks to high-wear blocks. This relocation creates stale copies of data in the old block locations, which persist until garbage collection erases them.

These stale copies are a secondary recovery target. When the primary copy of a file has been TRIMmed and GC-erased, an older version may still exist in a block that wear leveling has not yet reclaimed. PC-3000 SSD's Techno Mode reads every physical block on the drive, including blocks not mapped in the current FTL. Finding these remnant copies requires scanning the entire NAND array (a 1TB SSD contains roughly 8,192 to 16,384 erase blocks) and correlating page metadata with file system structures.

Over-provisioned space works similarly. A 1TB SSD with 7% over-provisioning reserves roughly 70GB of NAND for controller-managed operations. This space isn't visible to the OS and isn't targeted by TRIM. Stale data pages relocated during GC and wear leveling may persist in OP blocks. Retired bad blocks also contain unmapped remnant data accessible only through PC-3000 SSD's physical-level read functions.

No. A forensic write blocker prevents the host computer from sending write commands to the SSD, but garbage collection is an internal controller process. The controller runs GC, wear leveling, and read refresh operations autonomously whenever the drive is powered on, regardless of whether any host commands are issued. Powering on an SSD behind a write blocker still allows the controller to erase TRIMmed blocks.

This is a common misunderstanding in digital forensics. Write blockers were designed for magnetic hard drives where the storage medium (the platter) is passive. On an HDD, if you block writes, the data stays static. On an SSD, the storage controller is an active processor that modifies the NAND independently. The only way to freeze all controller operations is to force the controller into a diagnostic state using PC-3000 SSD, where TRIM processing, GC, and wear leveling all halt.

The safest approach: don't power the SSD at all after data loss. Keep it unpowered and ship it to a lab. We apply power for the first time inside PC-3000 SSD's controlled environment, entering Safe Mode or Techno Mode before the controller can resume background operations. This preserves the NAND state as of the moment you powered off the drive.