I'm looking for a technical second opinion about roughly 100GB of important architecture and project files that disappeared from F:Work on a Samsung 1TB SSD. Windows is installed on C:, while the affected files were on a separate F: partition. Another Kingston SSD is also installed, and the Samsung drive reportedly passes health tests.
Before the loss, the folders inside Work were visible, but an AutoCAD file would not save or export properly into one of them. I eventually saved the file another way and shut the laptop down normally. Later, many Work subfolders were gone, most files in the remaining folders had disappeared, and the folder size had fallen from about 100GB to 500MB. Other data on F: appeared normal. There was no ransom note, unusual extension, warning, Recycle Bin copy, search result, or Previous Version.
A professional recovery company found NTFS metadata, file names, sizes, and deletion traces, but said the LBAs containing the file contents return zeroes. They also attempted firmware-level recovery and concluded that the actual data is not recoverable. The SSD has been preserved and I have not run CHKDSK, reformatted it, reinstalled anything, or continued using it.
Could TRIM and garbage collection have made the data permanently unrecoverable even though the NTFS metadata remains? Is NAND-level or chip-off recovery likely to help on a modern Samsung SSD with controller mapping and possible encryption? Does TRIM require something to delete or deallocate the files first, or can it cause this on its own? Could filesystem corruption selectively damage one directory, and does the earlier AutoCAD save problem point more toward corruption than malware? Finally, is a second specialist opinion worthwhile, or do zero-filled LBAs plus failed firmware recovery effectively end the recovery options?
3 Answers
The pattern could fit a filesystem or directory-level failure: one directory was behaving abnormally, then its entries became unavailable while unrelated data remained intact. It could also be an application or user-level deletion followed by normal TRIM processing. A targeted malware wipe is possible, but there is nowhere near enough evidence to conclude that, especially without logs, forensic artifacts, or a known malicious program.
Do not continue using the affected SSD or run repair tools if recovery is still being considered. Have the computer examined from a trusted environment, preserve relevant logs if investigating the cause, and replace or isolate the drive if its reliability is in doubt. For future project data, use backups with at least one copy disconnected or versioned; SSD health indicators generally cannot reveal that files were logically deleted and later trimmed.
NTFS metadata surviving does not mean the file contents survived. File names, sizes, and directory records can remain after the clusters containing the actual data have been deallocated. The failed AutoCAD save is significant, but it does not prove a particular cause; localized NTFS corruption, a controller or filesystem problem, software behavior, and deletion are all possibilities. The available evidence is not enough to identify wiping malware.
On an SSD, TRIM is different from simply marking a file as deleted. Windows first has to deallocate the file's clusters, after which TRIM informs the controller that those areas are no longer needed. Garbage collection may then erase or recycle the corresponding NAND pages. A healthy SSD can therefore return zeroes for the old LBAs while metadata remains elsewhere on the volume.
NAND recovery is much harder than hard-drive recovery because of wear leveling, translation layers, garbage collection, controller-specific reconstruction, and sometimes encryption. Raw chip contents may not map cleanly back to files, and if the controller has already discarded the relevant pages, chip-off work will not recreate them. If the lab accurately verified zero-filled reads and already attempted appropriate firmware-level work, the odds of another lab obtaining useful data are unfortunately low.
Would it still be worth having another specialist determine what caused the deletion, or should I focus on replacing the drive and checking the computer for problems? I am keeping the SSD untouched for now.