SSD Format Issue

105 views
Skip to first unread message

Philip Shaw

unread,
Jun 10, 2026, 1:31:13 PMJun 10
to DataRecoveryCertification
Good afternoon. I received a 1TB SanDisk Extreme Portable SSD with a lot of important data on it from a customer who mistakenly formatted it in exFAT. He wasn't sure how it was formatted originally but he said it was for Windows so I am guessing it was either NTFS or exFAT. A raw recovery in R-Studio, PC3K, and Disk Drill gives nothing but a few useless files. He doesn't think it was encrypted before. He said the format took only a few seconds. 

Could TRIM cause something like this? If not, the only other thing I can think of is encryption. Am I missing something?

Thanks.

Luke Coughey

unread,
Jun 10, 2026, 1:36:23 PMJun 10
to datarecovery...@googlegroups.com
Are you not able to see the sectors and determine if they are returning zeroes vs garbled data?

Luke Coughey
CEO
Recovery Force Inc

This e-mail is intended solely for the person or entity it is sent to and may contain confidential and/or privileged information.  Any review, dissemination, reproduction or other use of this e-mail by persons or entities other than the intended addressee is prohibited.  If you have received this e-mail in error, please contact the sender immediately and delete and destroy this message, all attached material and all electronic reference from all computing based devices.


--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2Qkby%2BRY21dPR03N4mAoQC7JUn%2BQ97aWYGCMdO0RkajhErA%40mail.gmail.com.

Philip Shaw

unread,
Jun 10, 2026, 2:25:51 PMJun 10
to datarecovery...@googlegroups.com
It does appear that it is almost all 0s on the drive. Is the only explanation that the entire drive got formatted?

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAM_TZbHnMXLJ3Jf%3DXFTPk2gze6GQwKpOSvrFhUpvsbuOTJ4X8A%40mail.gmail.com.

RecuperoDati299

unread,
Jun 10, 2026, 2:32:41 PMJun 10
to DataRecoveryCertification
TRIM process runs in background when  the drive is IDLE

as explained it in many places 

after an n inizialization or delete command , the longer the drive remain Active , the bigger it becomes the Real erasure of cells 

and anyway the unique possibility is the creation of a virtual translator from a previous copy of the translator 

this mean that it the drive is not supported by PC 3000 you anyway won't find anything more that what you have already found


--

Data Recovery Guru

unread,
Jun 10, 2026, 2:35:09 PMJun 10
to datarecovery...@googlegroups.com
How are you testing? 
Disassembled with the internal NVMe alone?

Or through the SanDisk controller board that the NVMe SSD is connected to internally?

DATARECOVERYGURU TEAM
Offices are open Mon-Fri 9AM to 4:30PM. 
Available by appointment outside business hours.
Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026
Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803
Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701
Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903
New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkYcu0XMeoPFH7p0XRRCz1OtJB6fOVzoLz9gyGe94UtqZw%40mail.gmail.com.

Desert Data Recovery

unread,
Jun 10, 2026, 2:38:12 PMJun 10
to datarecovery...@googlegroups.com
IMHO It's not TRIM. TRIM leaves all/most of the MFT records in place. So a scan will find files via the MFT, but the files show all zeros. A full format wipes the drive, so shows all zeros.


RecuperoDati299

unread,
Jun 10, 2026, 2:38:55 PMJun 10
to datarecovery...@googlegroups.com
SanDisk Extreme USB in addition require di USB adapter 

because such adapter is transparently encripting the drive, like it happen with WD USB drives


RecuperoDati299

unread,
Jun 11, 2026, 2:37:53 AMJun 11
to datarecovery...@googlegroups.com
"IMHO It's not TRIM. TRIM leaves all/most of the MFT records in place. So a scan will find files via the MFT, but the files show all zeros. A full format wipes the drive, so shows all zeros" 

never seen before, meant if they did a quick format and created a new partition 

when the customer calls and begins telling "I have tried (list of these, several) data recovery tools" 

we already know it has only the MFT/catalog of the new partition and nothing else except blank sectors



DiskTuna

unread,
Jun 11, 2026, 3:33:23 AMJun 11
to DataRecoveryCertification
Yes, typical TRIM behavior. If you see nothing + only new file system structures in R-Studio, it was TRIM (check in hex viewer or check entropy).
TRIM commands can be sent to entire LBA space if you're going to quick format the entire drive. So entire LBA space is un-mapped, then new file system is created. 
It's immediate, what runs in background is GC, but you will see zeros for entire LBA space (assuming DZAT).

George Yakobic

unread,
Jun 13, 2026, 5:00:38 PMJun 13
to datarecovery...@googlegroups.com

  • TRIM is probably not what’s going on here, especially with a USB SanDisk portable SSD. In setups like this, TRIM either doesn’t get passed through at all or doesn’t behave in a way that would instantly wipe everything after a format.

    When you see a “quick format” that results in basically zero recoverable data, it usually points somewhere else entirely. The two big suspects are either some kind of hardware-level encryption or a firmware-level sanitize/secure erase behavior, not a normal file system operation.

    With SanDisk Extreme Portable SSDs in particular, hardware encryption is actually pretty common. Depending on the model and how it was set up, the drive may be doing encryption at the controller level using AES, completely transparent to the user. That means the data is always encrypted on the NAND, even if the user never explicitly thinks of it that way.

    The important part is what controls the encryption state:

    • If the drive was ever set up with a password using SanDisk’s security tools

    • If it went through a secure erase or some kind of reinitialization

    • Or if the internal encryption key was regenerated for any reason

    …then what looks like a simple format from the outside can effectively make all previous data unrecoverable. The data blocks may still physically exist, but without the correct encryption key, they’re just unreadable noise.

    So in cases like this, the failure isn’t really “deleted data” in the classic sense—it’s more like the lock on the data was changed or reset.

On Wed, Jun 10, 2026 at 1:31 PM Philip Shaw <shawcomput...@gmail.com> wrote:
--

jpv...@gmail.com

unread,
Jun 13, 2026, 5:40:39 PMJun 13
to datarecovery...@googlegroups.com
I have USB portable SSDs and they all support TRIM and do TRIM.

jpv...@gmail.com

unread,
Jun 13, 2026, 6:23:57 PMJun 13
to datarecovery...@googlegroups.com
"
When you see a “quick format” that results in basically zero recoverable data, it usually points somewhere else entirely"

No, the simplest explanation is TRIM if dealing with a TRIM capable drive. Don't know why everyone is trying to come up with more complex explanations. Occam's razor. 

------ Original Message ------
From: "George Yakobic" <g.7189...@gmail.com>
Sent: 6/13/2026 10:59:56 PM
Subject: Re: SSD Format Issue

RecuperoDati299

unread,
Jun 14, 2026, 5:05:07 AMJun 14
to datarecovery...@googlegroups.com
Agree

and about USB/NVMe bridge inside those SanDisk USB 

you can do your own tests. We did.

If you have such an healthy SanDisk USB , copy data in it
then remove the NVMe drive from the USB SanDisk original adapter

finally plug the SSD in a NVMe port and try to access it

You will find that the content is encoded, exactly as with WD USB drives. 

At the very least, the decoding algorithm would be required (I am not sure whether ACELab has researched and implemented it as they did for many WD hard drives) and we have not yet run the counter-test of sourcing two SanDisk USB adapters of the exact same model to interchange them and to verify whether it is a fixed encoding scheme or an encryption with a per-device key.



RecuperoDati299

unread,
Jun 14, 2026, 5:08:03 AMJun 14
to datarecovery...@googlegroups.com
P.S.

again about the USB SanDisk adapter

for the simple reason of its encoding feature, if you wanna try any raw recovery hoping so much to find some residual (not yet trimmed) data,

you then must run the scan through the adapter and not removing the SSDD from it


Il giorno 14 giugno 2026, alle ore 00:23, datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> ha scritto:


Desert Data Recovery

unread,
Jun 14, 2026, 5:23:51 AMJun 14
to datarecovery...@googlegroups.com
This could just be the difference between countries, or perhaps product types, but we have done 100's of these and none have been encrypted via the USB PCB.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/d81240219d0028.151f73f138d91f%40gmail.com.

Data Recovery Guru

unread,
Jun 14, 2026, 7:57:30 AMJun 14
to datarecovery...@googlegroups.com
The internal USB controllers are interchangeable, just like WD My Book controllers are for example. 

If the files are encrypted with SanDisk Secure software, working directly with the NVMe SSD won't allow access.

DATARECOVERYGURU TEAM
Offices are open Mon-Fri 9AM to 4:30PM. 
Available by appointment outside business hours.
Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026
Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803
Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701
Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903
New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/fb7978d4323338.34f17ffd0a28b2%40gmail.com.

Desert Data Recovery

unread,
Jun 14, 2026, 8:37:30 AMJun 14
to datarecovery...@googlegroups.com
Yes but the client said it wasnt encrypted. But we all know than clients lie......

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAHoXmqmbS%3D5nayBL0L_HCScbmWfX_zW1vp2p6LxC8apJyAqvcQ%40mail.gmail.com.

Heena Vora

unread,
Jun 26, 2026, 3:50:37 AM (2 days ago) Jun 26
to DataRecoveryCertification
I have done just yesterday data has been deleted from 4tb extreme and i got all data with name .Also one more drive which is formatted accidently with hfs we got data in raw .So sandisk external drives are safe .We do as it is not remove from enclosure.

Heena Vora

unread,
Jun 26, 2026, 3:51:36 AM (2 days ago) Jun 26
to DataRecoveryCertification
you can see data at the lower part of sdd in hex .you need to full scan .raw.
Reply all
Reply to author
Forward
0 new messages