Data Recovery Case File · Solid State & Flash · Not the Same as Formatting a Disk

On Flash a Format Can Tell the Controller to Erase, Not Merely to Forget

His enquiry describes a mistake that would usually be recoverable. A solid-state drive "accidentally formatted, with loads of photos on it", where consumer software including a deep scan has returned nothing. On a spinning drive a format leaves the content in place — on a solid-state drive it can do considerably more than that, which is why the scan came back empty rather than because the scan was inadequate.

The decode: why a format means something different here

What a format does on a spinning drive: writes a fresh empty index and marks the space as available. The content stays exactly where it was written until something is written over it, which is why accidental formats are usually among the more recoverable losses.

Why flash cannot work that way: NAND memory has to be erased before it can be rewritten, and erasing happens in large blocks spanning whole regions of a memory package rather than in the small units files occupy. To stay fast, a drive prepares blocks in advance rather than erasing them at the moment of writing.

What that requires the system to do: tell the drive which blocks are no longer needed. When a file is deleted or a volume formatted, the operating system issues a notice releasing those blocks — and the controller, which maintains the translation layer mapping content to physical NAND locations, is then free to erase them at its leisure.

Why that changes the outcome so completely: the release is acted on in the background, often within minutes. NAND blocks marked as free are erased whether or not anything new is written, so content can be genuinely gone while the drive sits idle.

Why his deep scan finding nothing is consistent with that rather than a failure of the tool: the software searched and there was nothing to find. An empty result after a thorough scan on NAND media usually means erasure rather than an inadequate search, which is worth saying plainly.

Why it is not always hopeless: the behaviour depends on the connection, the operating system and the drive. Some configurations do not pass the release notice at all — external connections frequently do not — and where it never arrived, the content remains as it would on a spinning drive.

What therefore has to be established first: whether the notice was issued and acted on. That is determined by reading the drive rather than by reasoning about it, and it is what decides whether this is straightforward or over.

Why time is the critical variable: a drive left powered continues processing releases in the background. The interval between the format and disconnecting the drive matters more than anything else, and every hour it stayed connected reduced what remained.

What should have happened immediately, and is worth stating for anyone reading: disconnect the drive the moment the mistake is realised. Not run software, not scan — remove power, because a powered drive is erasing and an unpowered one is not.

What the honest position is: assessment will establish whether content survives, and a nil result is a real possibility. That answer costs nothing to obtain and should come before any commitment.

On the bench

Block-release behaviour was assessed before prospects were stated — NAND memory requiring erasure before rewriting, in blocks larger than the units files occupy, so drives prepare blocks in advance and rely on the operating system issuing a notice releasing blocks no longer needed, the controller's translation layer recording which physical packages hold what. That release is acted on in the background irrespective of new writing, so content may be erased while a drive sits idle, whereas configurations that do not pass the notice leave content in place. Imaging ran write-blocked at the block level.

The outcome

Block-release behaviour assessed before prospects were stated, the drive removed from service, and unallocated regions examined for retained content. Free assessment, one fixed written figure including VAT; where a chip has to be removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: your scan finding nothing may not be the scan's fault. On NAND media a format can tell the controller those blocks are free — and it erases the memory packages in the background whether or not anything is written.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.