It is counterintuitive, but it makes sense based on how TRIM operates and its relationship with failure. A completely non-responsive drive will never remove any of your data. In other words, failure preserves data that continued health would have destroyed. What really fails and what can be recovered is outlined below.
Although TRIM deletes the actual blocks of data that are behind deleted files very efficiently, a failing controller will simply prevent it from operating. So, while normal usage for file deletions is to delete files and immediately lose access to the blocks that they occupied in the past, failure prevents you from ever losing access to the blocks that were previously occupied by deleted files. This means that a failed controller is preserving your data at a much higher rate than normal usage.
There is one major distinction between how you handle an SSD versus how you handle a traditional hard drive.
A hard drive tells you it is dying. Reallocated sector counts continue to rise, and transfers slow down. Eventually, something begins to click within the drive. While it may take weeks for a drive to reach the point at which it ceases to function entirely, there is generally a window during which the drive continues to deteriorate and is still readable. The time frame that exists between deterioration and total failure represents the majority of the value associated with continuous monitoring.
SSDs give you almost none of that. SMART tracks how much an SSD has been written to. It doesn't track very much about controllers – so if your SSD controller goes bad, SMART won't tell you anything, even though the failure could potentially be catastrophic.
A drive can have 96% of its rated life left, have four percent wear, and then not exist on Tuesday. There is simply no "playing-up" to wait for on an SSD.
While they are often difficult to diagnose separately due to similar symptoms (i.e., the drive disappears), the diagnostic separates them.
Most serious SSD failures occur as a result of either the controller or the firmware. A typical symptom of both would include disappearance from the BIOS, an empty model number, or an unrealistic capacity (e.g., 1 MB, 8 MB) while all data remains intact.
In order to maintain consistency within its mapping table(s), the controller will continuously update the mapping tables as long as power is being provided. The moment that power is interrupted while writing to the disk results in inconsistencies with the mapping tables. The result is the device refusing to mount or serve the data contained on the storage device because it cannot guarantee the integrity of said data.
Most consumer NVMe devices produce significant amounts of heat. A number of factors contribute to excessive heat generation from NVMe drives. Thin laptop enclosures, M.2 slots under video cards, and sealed cases create an environment conducive to high temperatures. Most often the symptoms appear intermittently; i.e., the system may function normally when operating in cooler conditions but fails to function properly once the temperature has increased. In some cases, systems will cease functioning altogether due to thermal damage.
Physical wear-out of actual NAND memory. Fewer cases exist of genuine physical NAND failure compared to what many people believe. This is the case where prospects are weakest.
Either can close a job before it starts. That's why both are checked immediately after taking the initial free diagnostic.
TRIM. When you delete a file from an SSD, your operating system tells the SSD's controller that those specific blocks of memory are no longer required, and it then physically deletes those areas as well. This deletion is real. No software or device (not even a laboratory or equipment costing six figures) recovers deleted data — from a functioning, powered SSD — which is usually gone within minutes.
This leads to an opposite conclusion: a dead SSD is often a better prospect than a working one. A drive that has stopped responding can no longer perform TRIM operations; therefore, failure provides protection for data that a functioning SSD would destroy due to ongoing operation.
Encryption. Many SSDs come with some form of encryption enabled by default, including Class 0, TCG Opal, Portable Samsung T-Series drives, etc., frequently with BitLocker layered on top. Healthy NAND does not provide anything usable without a valid password/recovery key. In cases where keys are truly lost/destroyed, we may be able to recover a password if there were weak/ partially remembered passwords used previously; we fail completely when faced with randomly generated, very long passphrases. We will indicate whether either case applies.
Why chip-off is typically the least preferred method of obtaining data, not the most preferred.
In order to create a "diagnostic mode" manufacturers place a special mode on their controllers which allows access to the service area normally locked down from direct readout. By using such methods one has full access to all elements of the service area — including those that provide a table-based mapping of logical address to physical location within the flash memory. These tables represent the entire effort required to extract usable data from the NAND, since as part of the wear levelling process, there is little or no correlation between the logical address assigned by the controller and the physical location of data on the NAND.
If a controller cannot be recovered at all, then one may have the ability to directly read the flash memory. However, in doing so, you will have to de-interleave data from each plane, correct errors based on error correction coding (ECC), and arrange data according to how your controller arranged it. This method of reading is typically much slower and riskier than attempting to revive the controller, and on many modern drives it returns data the controller had encrypted. As such, if one were able to take out chips of an SSD or NVMe device and create an exact copy of the original data, they would essentially have obtained a perfect copy of something nobody can read.
This is why one attempts to restore the controller prior to extracting data via chip off methods. Therefore, when a company suggests performing chip-off extraction on a drive where there is still potential for recovering the controller, it is reasonable to request an explanation. SSD and NVMe recovery services in Manchester start at £300 + VAT after a 48-hour free diagnostic period. A 50% deposit is also required for all controller level recovery efforts.
Often yes. The most common serious failure is usually the controller instead of the flash memory itself. So while your data remains in the NAND there will also be a layer preventing it from being accessed. Most commonly the layer can be accessed through the manufacturer's diagnostic mode as well as being able to image it for read purposes.
SMART reporting on flash memory wear and controller health are two different things. SMART reporting shows how much wear and tear has been put on the flash memory and controller health is reported very poorly if at all. Therefore, when a controller fails, it will fail badly. An example of this would be an SSD showing 96% of its life remaining and then failing the next day with no middle ground.
In most cases, you won't be getting data back from a working drive. When TRIM runs it sends instructions to the controller telling it to wipe out the blocks that have become empty. In many cases, the controller completes wiping out these blocks within a matter of minutes. There is little to no way to retrieve wiped blocks. This is why a dead SSD is often a better prospect than a working one because a failed SSD will never run TRIM again.
Yes. Once you lose access to encrypted information on your SSD, that is usually the end of it. Since many SSDs come with encryption enabled by default (in addition to having BitLocker applied), losing access to the password or recovery key means that even healthy flash memory will yield no useable information. If the password has been lost we may be able to recover it; however, recovering a password that was chosen randomly and is long will not typically work.
The controller is in a recovery mode; the flash hasn't failed. There isn't an SSD made to this exact capacity. It is a generic representation displayed by the controller as it is unable to locate/extract the firmware or table mappings. The data behind it is usually intact.
It is the last resort. Recovering the controller is recommended as it decrypts the data and maps the sectors internally. The chip-off process takes longer, is more risky and provides many devices' encrypted data — essentially an unreadable duplicate of the original data.