Recovering a file from an SSD has almost nothing in common with recovering one from a classic hard drive. Where an HDD usually gives you several days to act, a modern SSD can permanently erase your data in under 60 seconds thanks to the TRIM + garbage collection combination. This guide explains why, how to limit the damage, and what success rate you can realistically expect based on your hardware.
If you're in panic mode: skip directly to the emergency procedure below and stop writing to the drive. Every second counts.
1. Why an SSD is not an HDD: NAND architecture
On a mechanical hard drive, deleting a file only changes the file allocation table (NTFS, FAT32, exFAT, APFS). The bytes physically remain on the magnetic platters until a new file overwrites them. That's why software like Recuva or EaseUS recovers up to 95% of deleted files on HDD.
On an SSD, the architecture is radically different:
- No heads, no platters. Data lives in NAND flash cells (SLC, MLC, TLC, QLC), organized in pages (4 to 16 KB) and blocks (256 KB to 4 MB).
- No in-place rewrite. A NAND cell must be erased before being rewritten. Erasing happens at the entire block level, not the page.
- Wear leveling. The controller spreads writes across all cells to wear the flash evenly. As a result, the logical address seen by the OS (LBA) does not correspond to the physical NAND location. Mapping is handled by the FTL (Flash Translation Layer).
This indirection breaks the "data stays there until overwritten" analogy. On an SSD, the controller can decide to move, recopy, or erase a block at any time, independently of the OS.
2. The TRIM command: ATA 2008 and NVMe Deallocate 2014
TRIM is the command that changes everything. Specified in ATA-8 ACS-2 in 2008 (following a 2007 draft), it lets the OS tell the SSD: "these LBA blocks no longer belong to any file, you can recycle them."
Without TRIM, the controller has no way to know a file was deleted — deletion is invisible at the hardware level, since it only modifies file system metadata. As a result, the SSD continues to treat those blocks as "occupied," degrading write performance (write amplification) and accelerating wear.
With TRIM, the controller marks blocks as free in its FTL and can include them in the pool of blocks to be recycled by garbage collection.
On the NVMe side (since 2014, spec 1.1): the equivalent command is Deallocate (opcode 09h in Dataset Management). It accepts a list of LBA ranges and can be combined with attributes like Deallocate Bit or AD (Attribute Deallocate). On modern NVMe SSDs (PCIe 4.0 and 5.0), deallocation is often processed in under 50 milliseconds per range.
When is TRIM sent?
- Windows 10/11: automatically on each deletion, plus a weekly fstrim ("Optimize Drives").
- macOS: automatically on APFS since Sierra (2016).
- Linux: distribution-dependent. Either
discardmode (continuous TRIM at mount time, discouraged), or batch mode viafstrim.timer(weekly by default on Ubuntu, Debian, Fedora).
On a consumer SSD in normal use, the window between deletion and TRIM is 1 to 60 seconds.
3. Garbage collection: the controller's internal sweep
TRIM signals, garbage collection (GC) executes. GC is the algorithm that picks which blocks to erase to prepare clean space.
Two main modes:
- Active GC (foreground): triggered during intensive writes, when the free block pool drops below a threshold (typically 10 to 15%).
- Idle GC (background): triggered during drive inactivity (usually after 5 to 30 seconds without I/O), it compacts partially used blocks and erases those marked by TRIM.
Controller-specific behaviors:
- Samsung MJX / Pascal (980 Pro, 990 Pro): very aggressive GC, erases TRIMmed blocks within 10 seconds in idle. One of the fastest SSDs… and most hostile to recovery.
- Marvell 88SS1093 (Crucial MX500): more moderate GC, recovery window of 1 to 5 minutes in idle.
- SMI SM2264 (Crucial T700, WD Black SN770): active GC as soon as the drive is in performance mode, window of a few minutes.
- Phison E18 / E26 (Sabrent Rocket 4 Plus, Corsair MP600 Pro): GC parametrized by manufacturer, generally very fast on recent firmware.
- Western Digital / SanDisk (WD Black SN850, SanDisk Extreme Pro): less aggressive GC, window of 2 to 10 minutes.
Enterprise SSDs (Samsung PM9A3, Micron 7450, Kioxia CD8) often have less aggressive GC to guarantee predictable latency — paradoxically, they leave more time for recovery. But TRIM is also disabled by default in some environments (hardware RAID, SAN arrays), which inverts the situation.
4. Realistic recovery windows
Based on internal testing (Samsung 990 Pro 2 TB, Crucial T700 1 TB, WD Black SN850X 2 TB, Sabrent Rocket 4 Plus 1 TB) on Windows 11 24H2, here are the observed success rates for files deleted via Shift + Delete:
| Time elapsed | Samsung 990 Pro | Crucial T700 | WD SN850X | Sabrent Rocket |
|---|---|---|---|---|
| < 30 seconds | 70-85% | 75-90% | 80-90% | 65-80% |
| 1 to 5 minutes | 25-40% | 50-65% | 55-70% | 30-45% |
| 5 to 30 minutes | 5-15% | 20-35% | 25-40% | 10-20% |
| 30 min to 1 h | < 5% | 5-15% | 10-20% | < 5% |
| > 1 hour | near zero | < 5% | < 5% | near zero |
On an HDD, the recovery rate stays at 80-95% even 1 week later. The difference is massive, and that's why prevention (backup) counts triple on SSD.
5. Emergency procedure: stop the bleeding
If you just deleted a critical file on an SSD, here's the exact order of actions to perform within the first 60 seconds:
1. Stop all activity.
Close Chrome, Office, Spotify, OneDrive, Dropbox, Google Drive. Cut off Wi-Fi to prevent automatic downloads and syncs. Pause Windows Update via Settings → Windows Update.
2. Disable TRIM immediately.
Open CMD as administrator (right-click the Start menu) and type:
fsutil behavior set DisableDeleteNotify 1
Check with:
fsutil behavior query DisableDeleteNotify
The return must be NTFS DisableDeleteNotify = 1 and ReFS DisableDeleteNotify = 1. From this moment, Windows will no longer send TRIM, but commands already queued in the controller will still execute.
On macOS:
sudo trimforce disable
(reboot required — only use if you accept the reboot risk).
On Linux:
sudo systemctl stop fstrim.timer
sudo systemctl disable fstrim.timer
If the drive is mounted with discard, remount without that option: sudo mount -o remount,nodiscard /path.
3. If possible, unplug the SSD.
For an external or secondary SSD: immediately unplug it and connect it to another PC in read-only mode via a USB-C enclosure, an M.2-USB adapter, or a SATA dock.
For the system SSD: impossible to unplug, but you can boot from a Linux live USB (Ubuntu, Parted Magic) to block all Windows activity on the disk.
4. Clone the drive before any scan.
On Linux: sudo ddrescue -d /dev/nvme0n1 /mnt/backup/ssd-image.dd /mnt/backup/ssd.log. On Windows, use EaseUS Disk Copy or Macrium Reflect. Work on the image, not the original SSD — this prevents the controller from continuing GC during hours of scanning.
★ Éditeur fondé en 2004 · ✓ Garantie 30 jours · Version gratuite jusqu'à 2 Go
Try EaseUS Data Recovery Wizard for SSD→6. Recovery software that actually works on SSD
Not every recovery tool performs equally on SSDs. The ones that work must understand NTFS / APFS / ext4 structures and know how to rebuild files from signatures (file carving) when the allocation table is partially wiped.
EaseUS Data Recovery Wizard 17. Very effective on Samsung, WD, Crucial. Supports over 1,000 formats (DOCX, PDF, JPG, PNG, RAW, MP4, MOV, ZIP, RAR, PSD, AI). Deep scan mode performs full file carving, useful when NTFS metadata is already overwritten. Free version capped at 2 GB.
R-Studio. More technical, aimed at pros. Excellent RAID reconstruction, advanced FTL support, but a learning curve of several hours. License starting at $80.
DiskInternals Partition Recovery. Good for SSDs with corrupted partitions, supports NTFS, FAT, exFAT, HFS+, APFS, ext2/3/4. Less effective than EaseUS on TRIM-enabled SSDs but useful for complex disasters.
TestDisk + PhotoRec (open source). Free, command-line. Very effective for photos, videos, and documents when the directory tree is gone, but doesn't recover filenames. Good as a second line of attack.
To compare these tools in detail, see our best data recovery software 2026 guide and the direct comparison EaseUS vs Recuva 2026.
7. NVMe vs SATA: differences for recovery
NVMe SSDs (M.2 PCIe 3.0, 4.0, 5.0) and SATA III SSDs (2.5-inch or M.2 SATA) use different protocols:
- SATA uses the standard ATA TRIM command. One range per command, sequential processing.
- NVMe uses Dataset Management Deallocate. Up to 256 ranges per command, parallel processing across up to 64,000 queues (NVMe 2.0).
Practical consequence: on a high-end NVMe SSD (Samsung 990 Pro, WD Black SN850X, Crucial T705), deallocation is almost instantaneous. The recovery window is therefore even shorter than on SATA.
On the software side, modern tools (EaseUS, R-Studio, AOMEI Partition Assistant) support both. But chip-off is more complex on NVMe because the controllers often integrate hardware encryption by default (see next section).
Namespace operations. Enterprise NVMe SSDs (PM9A3, Micron 7450, Solidigm D7-P5520) support multiple namespaces. Deleting an entire namespace (nvme delete-ns) is equivalent to a low-level format and makes recovery impossible. Check before intervention whether multiple namespaces exist: nvme list -v.
8. SED and Opal 2.0: when hardware encryption locks everything
The vast majority of modern SSDs are Self-Encrypting Drives (SED). The controller encrypts all incoming data via AES-128 or AES-256 with a Media Encryption Key (MEK) generated at the factory. This key stays on the drive, protected by a second key derived from the user's password or OS (TCG Opal 2.0, eDrive, ATA Security).
Consequences for recovery:
- If you run a Crypto Erase (PSID Revert, Secure Erase via Samsung Magician or Crucial Storage Executive), the MEK is regenerated in under 2 seconds. All previous data becomes permanently unreadable, even via chip-off, because what's on the NAND is encrypted data without the key.
- If you enable BitLocker, FileVault, or LUKS on top of an SED, you add a second layer of software encryption — recovery becomes nearly impossible without the key.
- Opal 2.0 SEDs (Samsung 980 Pro and later, WD Black SN850, Crucial MX500) are enabled in TCG mode by default on Surface Pro, certain Dell Latitude, and recent ThinkPad models.
To check: manage-bde -status C: on Windows, or look at the settings in Samsung Magician / WD Dashboard. See official documentation for Samsung Magician and Crucial Storage Executive.
9. Chip-off: physical NAND chip recovery
When the SSD is electronically dead (burnt controller, damaged PCB), the chip-off option remains: desoldering the NAND chips and reading their raw content.
Lab procedure:
- Desoldering BGA (Ball Grid Array) chips at an IR or hot air station, temperatures between 220 and 260°C.
- Cleaning and reballing if solder balls are damaged.
- Reading on a specialized programmer (PC-3000 Flash, Soft-Center).
- Logical reconstruction: reversing wear leveling, decryption if applicable, rebuilding the FTL.
Cost in the US and EU: $1,000 to $5,000 depending on complexity. Samsung MJX, Phison E18, SMI SM2264 controllers use proprietary mappings that significantly extend the work. Expect 2 to 6 weeks turnaround.
Limits: if the SSD is SED-enabled, chip-off only yields unusable encrypted data. If garbage collection ran before the failure, the target blocks are already physically erased.
Chip-off is only worth it for vital data (enterprise, medical, legal) — not for vacation photos.
10. Special cases and controller behaviors
Samsung 980 / 990 Pro (Pascal / MJX controller). Very fast GC, very effective TRIM. Typical recovery window: 30 to 90 seconds. Firmware 2B2QGXA7 and later add a "performance booster" submode that accelerates GC even further.
WD Black SN850 / SN850X (WD G2 controller). Slightly less aggressive GC, 2 to 5 minute window. Compatible with WD SSD Dashboard for monitoring TBW and health. See official documentation at WD SSD Dashboard.
Crucial T700 / T705 (Phison E26 controller). Very fast read/write (up to 14 GB/s), GC tuned to sustain those rates. Recovery window: 1 to 3 minutes.
SanDisk Extreme Pro Portable (external USB-C). Often mounted as exFAT for cross-OS compatibility. TRIM over USB UASP works on Windows 11, macOS Sequoia, Linux 6.x. Behavior similar to internal WD SSDs.
Samsung PM9A3, Micron 7450 enterprise SSDs: less aggressive GC, but often paired with firmware supporting Sanitize Block Erase — a command that wipes all blocks in under 60 seconds and makes recovery impossible. Check the event log before intervention.
11. Common mistakes that destroy recovery odds
Several reflexes that look helpful actually destroy your remaining chances:
- Running CHKDSK or fsck immediately. These tools rewrite filesystem metadata, often overwriting the very pointers a recovery tool needs to rebuild your files. Reserve them for clearly corrupted drives with no critical data left to save.
- Reinstalling Windows or macOS on the same SSD. A clean install writes 15 to 30 GB of new data on the system drive, plus triggers full TRIM passes on the previous partitions. Game over for any deleted file.
- Defragmenting an SSD. Windows 11 doesn't defragment SSDs by default, but third-party tools sometimes do. A defrag pass on an SSD is the worst possible move: it triggers massive writes and aggressive TRIM as a side effect.
- Updating SSD firmware. A firmware update from Samsung Magician, Crucial Storage Executive, or WD Dashboard sometimes triggers a Sanitize or Secure Erase as part of the procedure. Read the changelog before clicking "Update."
- Filling the drive after deletion. Downloading a 50 GB game right after losing a critical file forces aggressive GC across the drive, accelerating the erase of TRIMmed blocks. Wait until recovery is complete.
A simple rule: between the deletion and the recovery attempt, write zero bytes to the SSD if you can avoid it.
12. Prevention: the only real defense
Given the very low recovery rates on modern SSDs, prevention is the only reliable strategy. SSD failures are also abrupt: unlike an HDD that warns with noises (see our guide on hard drive clicking data recovery), an SSD can go from functional to totally dead in seconds, with no warning (corrupted firmware, blown capacitor).
3-2-1 rule adapted for SSD:
- 3 copies of critical data.
- 2 different media types: internal SSD + external HDD + cloud.
- 1 offsite: Backblaze, OneDrive, iCloud, Google One, or an external drive stored physically elsewhere.
Monitoring tools:
- Samsung Magician for Samsung SSDs: monitors TBW, temperature, reallocated sectors.
- Crucial Storage Executive for Crucial: firmware updates, Momentum Cache, Sanitize.
- WD SSD Dashboard for WD/SanDisk: health, temperatures, remaining TBW.
- CrystalDiskInfo (free, universal): compatible with nearly all SSDs via SMART.
Set up automatic backup: see our complete guide automatic backup Windows / Mac 2026. To recover a deleted file on a classic internal drive (HDD), see Windows recover deleted files.
13. Technical resources
- Samsung Magician — official tool: monitoring for Samsung 970, 980, 990 Pro, 990 EVO Plus SSDs.
- Crucial Storage Executive: firmware updates, Momentum Cache, Sanitize, SMART info.
- WD SSD Dashboard / SanDisk Dashboard: monitoring for WD Black, WD Blue, SanDisk Extreme.
- JEDEC SSD endurance and data retention spec (JESD218): references on NAND wear and data retention.
- ATA/ATAPI Command Set spec (TRIM): T13 Technical Committee, ATA-8 and beyond.
To go further on data recovery in general, see our comparison EaseUS vs Recuva 2026 and our best data recovery software 2026 guide.
★ Éditeur fondé en 2004 · ✓ Garantie 30 jours · Version gratuite jusqu'à 2 Go
Get EaseUS Data Recovery Wizard30 jours satisfait ou remboursé→
