Blog — Data Recovery and Cybersecurity
Technical analyses, prevention tips and data recovery news from the experts at SOS Data Recovery, Swiss laboratory since 2006.
SSD: Why Data Recovery Has Nothing to Do With a Hard Drive
Recovering data from an SSD has almost nothing in common with a hard drive. There are no platters and no read/write heads here, but memory chips driven by a controller, a bit like a USB stick, only far more complex. This difference in nature changes everything: the data is not stored where the system thinks it is, TRIM genuinely erases whatever you delete, and hardware encryption can lock it away if the controller dies. If your SSD stops responding, stop using it, do not overwrite anything, and above all do not run a secure erase.
What follows explains how an SSD is built, why recovering one is a trade of its own, and how far a lab can go to get your data back.
What an SSD is
An SSD (Solid State Drive) is a storage device with no moving parts: the data is held in NAND memory chips driven by a controller, instead of being written onto magnetic platters as in a hard drive. It relies on the same building blocks as a USB stick or a memory card: one or more NAND chips that actually store the data, a controller that orchestrates everything, and a clock that paces the exchanges. As with those devices, the connector never talks directly to the memory: it goes through the controller.
What differs is the interface through which the SSD communicates with the computer. On a classic SSD, the exchange takes place between the SATA connector and the controller. On the recent models in the elongated format known as M.2, found in most laptops, the exchange takes place between the M.2 connector and the controller. The principle stays the same, only the front door differs.
So much for the surface resemblance to a USB stick. But under the hood, the SSD plays in an altogether different class of complexity, and this is where recovery becomes a trade of its own.
Why an SSD is harder to recover
Three mechanisms, absent from the hard drive, make the task seriously more complicated.
The controller's algorithms. An SSD controller does not merely file the data away. It constantly spreads it across the chips, manages cell wear and moves blocks around to preserve performance and longevity. The result: the data is not stored in a direct, readable way. What the system believes to be a file in a given place has in reality been scattered and transformed by the controller. Without understanding these algorithms, reading the memory yields only an unusable mush.
TRIM. TRIM is a command that lets the SSD genuinely erase the blocks marked as free, so as to stay fast at writing. On a hard drive, a deleted file remains physically present as long as nothing is written over it. On an SSD, TRIM can purge those blocks within a few minutes. Deletion there is therefore often permanent, and this is one of the major differences to be aware of.
Hardware encryption. Many SSDs encrypt the data at the controller level, automatically. As long as the controller works, everything is transparent. But should it fail, reading the memory chips separately is no longer enough: without the key held by the controller, the extracted content remains unreadable. This is precisely what sets an SSD apart from a simple USB stick, where reading the chip directly often gives a usable result.
The failure modes of an SSD
When an SSD gives out, it is rarely trivial. The cases we see fall into a few families.
| Failure | What happens |
|---|---|
| Faulty controller | The SSD no longer responds or responds poorly, wrong capacity, gone from the BIOS |
| Corrupted firmware | The controller no longer knows how the data is structured |
| Electrical failure / power surge | Damaged components, no more proper power supply |
| Cold solder joint, broken connections | Interrupted electrical contact (see below) |
The controller is the most frequent weak point: it breaks, stops responding correctly, and the SSD becomes inaccessible. Next comes firmware corruption, that piece of microcode the controller reads to know how the data is organised and how to handle the problematic areas, the dead, shifted or relocated tracks. When this firmware is corrupted, there are ways to modify it, but they remain more minimalist than on a mechanical SATA hard drive. Finally, electrical failures and power surges can damage components and cut the SSD dead.
Formats, cold solder joints and the BGA puzzle
The most widespread format today is the M.2, that elongated stick fitted in the majority of laptops. Apple, on older MacBook Air and Pro models, also used elongated SSDs, but with a proprietary connector of its own.
These formats bring their share of physical failures. The first is the cold solder joint. A cold solder joint is a solder that has not properly melted or bonded: it looks like a normal solder, but it does not make a genuine electrical contact. Current or information no longer passes correctly, sometimes intermittently. The remedy is to cleanly redo all the solder joints of the SSD to eliminate these faulty points. One also comes across slightly bent M.2 sticks, some of whose connection points have broken and must be redone.
One detail makes this work increasingly delicate. Today, almost all M.2 SSDs use a technology called BGA (Ball Grid Array): the contact points are no longer laid out on the visible sides of the chips, but underneath the chips themselves, in a grid of invisible balls. You no longer see the legs as in the past, which makes reworking the solder joints markedly harder and requires specialised equipment.
What a lab really does
Faced with a failed SSD, several avenues open up, in order from the least invasive to the most demanding.
We first work with specialised tools such as the PC-3000, which allows us to analyse the SSD and attempt repairs to the firmware or to the translator, the element that translates the organisation of the data. We also carry out cleaning, reballing of the contact balls, and reworking of cold solder joints when it is these that are blocking things.
When these repairs are not enough and the case allows it, we move on to desoldering all the memory chips. We read them separately, then reconstruct the data as we would for a USB stick: by identifying the controller and reapplying on the fly, to the dumps obtained, the algorithms it was using. It is patient work, dependent on any encryption and on the complexity of the data distribution.
One case illustrates this complexity well. We received a 2.5-inch SATA SSD whose controller was causing trouble. We desoldered all of its memory chips. The board showed eight apparent positions, but a particular construction: the chips were stacked two by two on a single position, which brought the real total to sixteen memory chips. We recovered and read them all, then reconstructed the entire body of data. Without identifying this stacked architecture, one would have missed half the content.
The right moves
An SSD that fails poses a serious problem from the outset: controller, firmware, electronics, one is rarely dealing with a simple, benign logical glitch. Hence a few simple rules.
| ✅ To do | ❌ To avoid |
|---|---|
| Stop using the SSD immediately | Keep writing to it |
| Set it aside and have it analysed | Run a secure erase |
| Note the exact model and the symptoms | Update the firmware "to fix it" |
| Entrust the device to a lab | Pile on connections and software |
The most important rule: never run a secure erase on an SSD whose data you want to recover. This command genuinely and permanently erases the content. More broadly, if your SSD already shows a real sign of weakness, do not attempt the impossible: every additional handling, every improvised software repair attempt can complicate, or even doom, the lab's work.
Frequently asked questions
Can data be recovered from a failed SSD?
Often yes, but by routes specific to the SSD: repairing the controller or the firmware with specialised tools, reworking the solder joints, or desoldering the memory chips to read them and reconstruct the data. Success depends on the type of failure and on any hardware encryption.
Why is recovering an SSD harder than recovering a hard drive?
Because the controller constantly shuffles the data through algorithms, because TRIM genuinely erases whatever is deleted, and because hardware encryption can make the memory unreadable without the controller. On a hard drive, by contrast, the data stays readably in place as long as nothing is written over it.
Can a deleted file be recovered on an SSD?
It is highly uncertain. The TRIM command purges the blocks marked as free, often within a few minutes, which makes the deletion permanent. You must stop using the SSD immediately; past that window, a deleted file is generally unrecoverable.
Does chip-off work on an SSD the way it does on a USB stick?
Not always. The chips can be desoldered and read, but if the controller was encrypting the data, the extracted content remains unreadable without its key. The complex distribution across several chips, sometimes stacked, adds further to the difficulty compared with a simple USB stick.
Should you run a secure erase to repair an SSD?
No, never if you want to recover your data. A secure erase genuinely and permanently erases all of the content. Faced with a failed SSD, you write nothing, you do not update the firmware at random, and you entrust the device to a lab.
What is a cold solder joint on an SSD?
It is a solder that has not properly melted or bonded: it looks normal, but it does not make a genuine electrical contact, which interrupts the flow of current or information, sometimes intermittently. The repair consists of cleanly redoing the solder joints concerned.