Files vanished from an SSD, and the drive began quietly destroying them without being asked. What decided this job was not any technique — it was how many minutes passed before somebody pulled the power.
A user found files missing from their SSD without warning — documents, emails and project material simply no longer there. The machine had also become unstable, with programs crashing and general slowness. Consumer recovery software found essentially nothing, which prompted the call.
They did one thing right, and it turned out to be the only thing that mattered: they shut the laptop down and left it off rather than continuing to work while deciding what to do.
The file-system metadata had been damaged, which accounts for the instability and the crashing — the drive was struggling to describe its own contents, and every operation touching those structures stalled or failed.
And the missing files had been deleted, which on an SSD starts a clock.
When a file is deleted, the file system marks its space free and issues a TRIM command telling the drive those blocks are no longer needed. This is not housekeeping for its own sake — without it, the controller would keep faithfully preserving data nobody wants, and performance would collapse as the drive ran out of pre-erased blocks to write into.
The critical detail is that TRIM is not an erase instruction. It is a notification. The controller records that those blocks are dead and gets round to actually erasing them during background garbage collection — consolidating whatever is still valid in a block, then erasing the whole block so it can be written again.
That process runs whenever the drive has power and a moment to spare. It does not need the machine to be in use. It does not stop because you have closed the lid.
So the honest description is: TRIM is a queue, the queue drains while the drive is powered, and pulling the power is the only thing that stops it.
Worth explaining, because it leads people to conclude the data is gone when some of it is not.
Most SSDs implement deterministic read after TRIM: once a block has been trimmed, the controller returns zeros for those addresses immediately, whether or not the flash behind them has actually been erased yet. It is a consistency guarantee — the same address must return the same thing every time it is read.
Which means ordinary recovery software, which can only ask the drive through its normal interface, sees zeros and reports nothing to recover. The drive is telling the truth about what it will serve, not about what it still holds.
Reaching the flash beneath that requires vendor-specific access to the controller, below the layer that enforces the guarantee. That is the difference between finding nothing and finding four fifths of it.
The drive arrived with part of its erase queue unprocessed: some blocks belonging to the deleted files had already been physically cleared, others had not yet been reached.
It was reached at controller level and imaged read-only, with no more power given to it than the imaging itself required. Every additional minute running is another opportunity for garbage collection to work through more of the queue, so a drive in this condition is not left connected while somebody thinks about it.
From the image, the file system was rebuilt where its structures survived, and the remaining files carved by signature from blocks that still held their contents.
Recovered documents and archives were opened rather than counted, and the material that could not be found was reported specifically — so the user knew what was gone rather than discovering it later.
About 80%. The missing fifth was blocks the drive had already erased before it was switched off, and that portion was not recoverable by any means.
It is worth being exact, because this is widely misdescribed. Once erasure has completed on a block, the NAND cells have been returned to their blank state. Reading the flash directly — including by desoldering the packages and reading them on a programmer — returns erased cells. There is no residual copy underneath and no forensic technique that reaches beneath an erase. Any firm suggesting chip-off recovers trimmed data is describing something that does not exist.
What can be recovered is what the drive had not yet got round to. How much that is depends entirely on how quickly the power came out.
So on an SSD, the power switch is the recovery tool. Deleted files on a hard drive sit until something overwrites them and you often have weeks. On an SSD the drive is actively erasing them, and that only stops when it loses power. If files vanish from an SSD, shut it down immediately rather than investigating. SSD recovery is from £300 +VAT after a free 48-hour diagnostic.
Send the device over with a short account of what happened to it. The diagnostic costs nothing and commits you to nothing, and the figure that follows is fixed in writing before anything is opened.
Nothing can begin until the device is on the bench, which makes this the only step that needs anything from you. Pack it properly, put your details in with it, and send it over. What follows is a free diagnostic and a written figure, in that order.
Posting it? Use something tracked and insured — whatever is on the drive is worth considerably more than the postage. Bringing it in? Weekdays, 9am to 5:30pm, and it still wants packing as above for the journey.
Tell us what the device is, what it is doing, and anything already tried — an engineer will come back with a realistic view of the odds and a price band, before you commit to posting anything.
We’ll be in touch shortly. For anything urgent, call 0161 871 0788.
Sometimes, and the variable is minutes rather than technique. TRIM does not erase anything itself — it tells the drive which blocks are dead, and the controller works through that queue during background garbage collection. The queue drains only while the drive has power, so what survives is whatever it had not yet reached when the plug came out. TRIM tells the drive to erase the blocks, but the drive queues that work and processes it during background garbage collection — which continues while it has power. What survives is whatever it had not yet reached when the drive was switched off.
No, and it is worth being exact because it gets sold. Once the erase has run, those cells have been returned to their blank state — desoldering the packages and reading them on a programmer returns blank cells, because there is nothing underneath. What chip-off genuinely helps with is unencrypted flash whose controller has died, which is a different problem.
Power it off at once and leave it off. Not sleep, not hibernate. Resist investigating, running recovery software or browsing to see what else has gone — the queue of blocks waiting to be erased drains only while the drive has power, so every minute of looking costs you some of what you are looking for.
Because a hard drive is passive about it. The data sits on the platters until something physically writes over that location, which can take weeks. An SSD is not passive: it has been told those blocks are dead and it clears them in the background on its own schedule, whether or not anybody is using the machine.
From £300 plus VAT after a free 48-hour diagnostic and a written quote. Where the diagnostic shows the material was already erased, we tell you before you commit rather than after.
Start with an instant online quote, or call and talk it through with us first. You'll have a clear, fixed price before any work begins.