Samsung SSD Data Recovery: Process, Risks, and the Right Approach

TL;DR: The most common failures on Samsung SSDs (860/870 EVO SATA, 980/990 Pro NVMe) are controller death, NAND wear, and firmware corruption. On modern drives, the AES-256 self-encrypting architecture makes recovery harder because the key lives inside the controller. Vendor service mode cloning and chip-off NAND reads are the professional methods. Samsung Magician is useful for diagnosis, not for recovery. If TRIM is active, deleted data is genuinely gone, and software will not help with physical damage.

Samsung is one of the most widely used brands in both the consumer and enterprise SSD markets. In Turkey, a significant share of workstations, gaming PCs, NAS units, and laptops run on 860 EVO, 870 EVO, 980, 980 Pro, or 990 Pro models. Although the reliability statistics for these drives are good, the failure rate is not zero. The day you run into a 990 Pro that no longer appears in the BIOS, or an 870 EVO that has dropped to 0 bytes of capacity, what you need to do is very different from a classic magnetic disk.

This guide explains the Samsung SSD data recovery process in plain language, from diagnosis to lab steps, from KVKK requirements to the chip-off method. It is written for those looking for brand-specific detail within our pillar piece, the 2026 Data Recovery Guide.

The most common failures on Samsung SSDs

The failures we see across the Samsung SSD family depend largely on the controller architecture and the NAND type. The 860 EVO and 870 EVO models use MJX and Maru controllers, the 970 Pro uses Phoenix, the 980 Pro uses Elpis, and the 990 Pro uses the Pascal controller family. Each of these chips has its own particular weaknesses.

Controller failure is the most common cause of sudden death. The drive was working yesterday, and today the BIOS does not even see it. Typically, corruption occurs in the auxiliary power section of the controller or in the firmware control block. In this case, even if the NAND chips are intact, the data cannot be accessed by normal means, because the Flash Translation Layer (FTL) table is held on the controller.

NAND wear, meaning the exhaustion of write life, is significant especially on TLC and QLC models. According to JEDEC standards, the endurance metrics of consumer-class SSDs are defined by JEDEC JESD218, and TBW (Terabytes Written) values are explicitly declared by Samsung for each model. For the JEDEC standards documentation, the JEDEC official site can be used as a reference. There are limits such as 600 TBW for the 870 EVO 1TB and 1200 TBW for the 990 Pro 2TB. When this limit is exceeded, the controller may put the drive into full wear protection and switch it to read-only or completely disabled mode.

Firmware corruption occurs after an unexpected power loss or during a failed firmware update. The drive appears as "Unknown" in device manager, and its capacity is reported as 0 bytes.

Liquid, lightning, or static electricity damage hits the power components on the PCB, particularly the DC-DC converters and the PMIC. In this case the NAND chips usually remain intact, and the problem is on the PCB.

The way to anticipate deterioration is to monitor the SMART parameters. On Samsung drives, the following values are especially critical: Reallocated NAND Block Count, Used Reserve Block Count, Wear Leveling Count, Uncorrectable Error Count, and the POR (Power-On Recovery) counter. If any of these values has begun climbing rapidly, failure is near.

I am getting a "not found" error, what should I do?

The first diagnostic step is to understand at which layer the drive has been lost.

  1. Does the BIOS/UEFI recognize it? Enter Setup and check whether the drive model and serial number are listed under Storage Configuration. If it is listed but Windows does not see it, there is a logical problem and most likely no physical damage.

  2. What does Disk Management say? Use diskmgmt.msc on Windows, Disk Utility on macOS, and the lsblk and dmesg | tail output on Linux. If the drive appears but its capacity is 0 bytes, the partition is RAW, or it shows "Not Initialized", there is an FTL or partition table problem.

  3. What does Samsung Magician say? If Magician recognizes the drive and can read SMART, the controller is still talking. If it does not recognize it, either the controller has died or the USB adapter / motherboard SATA-NVMe port may be faulty. Trying a different port, and if possible a different computer, is worthwhile.

A critical warning here: if the BIOS does not see the drive, or sees it and then loses it, do not power up this drive again and again. Every power-on cycle can wear down an already dying controller or a damaged PMIC even further. Two or three attempts are enough, after which you should turn to an expert.

What is Samsung Magician for?

Samsung Magician is the official management tool Samsung offers for its consumer SSDs. It does not perform data recovery, but the information it provides is very valuable when deciding on a recovery approach.

The useful sides of Magician:

  • It reads SMART values with Samsung-specific interpretation, clearly showing data such as Total Bytes Written, drive temperature, and host writes.
  • The Drive health label: it summarizes the drive's overall condition as Good, Warning, or Bad. The moment you see Warning or Bad, you should start backing up.
  • It lists the firmware version and any available updates.
  • The Performance Benchmark runs an instant sequential/random performance test on the drive. If results come out far lower than expected, NAND wear or thermal throttling is suspected.

The sides of Magician you must absolutely not touch:

  • Secure Erase: If you run it, all NAND blocks are wiped with a cryptographic erase, and the data is gone irreversibly. Pressing this button on a drive whose data you want to recover is the worst possible mistake.
  • PSID Revert: On a self-encrypting drive, if the PSID is entered the encryption key is reset, the drive returns to factory settings, and the data becomes inaccessible.
  • Firmware Update: If the update process fails, the drive can be bricked. Updating firmware on a drive of questionable health typically increases the risk.

Magician is only a diagnostic tool. If your data is critical, open Magician to read SMART, then close it.

The recovery process, step by step

In a professional lab, Samsung SSD recovery proceeds as follows:

1. Remove the device safely. Shut the computer down completely, cut the power, and discharge any static electricity from yourself. When removing M.2 NVMe drives, be careful with the screw and do not bend the PCB.

2. ESD-protected transport. Place the drive in an anti-static bag and transport it that way. A plastic bag or a bare desk surface is not enough; a static discharge can hit the NAND and the controller.

3. Cloning in the lab. Professional hardware (such as PC-3000 SSD, MRT Lab, and DeepSpar) has vendor-specific service mode commands for Samsung drives. This mode bypasses the controller's "translator" layer and provides bulk access to the NAND. The clone is copied block by block to a working target, and the original drive is not touched in the subsequent steps.

4. Extraction from the clone. Flash Translation Layer reconstruction is performed on the cloned image. With knowledge of Samsung's FTL structure, JFS metadata, and XOR masking algorithms, the logical sector order is rebuilt. This step is referred to in the literature as "logical assembly" and requires the lab software to correctly recognize the NAND architecture.

5. Chip-off NAND. If the controller will no longer talk, the NAND chips are removed from the PCB with heat (BGA reflow) and read on a programmer. The raw data that is read again goes to the FTL reconstruction step. This method is complex for 3D V-NAND structures, because Samsung uses a combination of XOR mask, scrambling, and LDPC ECC in its layered structure.

Setting the technical side aside, in corporate cases where the data carries evidentiary value, the process is carried out to digital forensic examination standards, with a hash chain and chain-of-custody maintained.

TRIM and the hardware encryption risk

The overwhelming majority of modern Samsung SSDs follow the self-encrypting drive (SED) standard. AES-256 encryption is performed in hardware inside the controller, and even though the user does not see it, every block written is encrypted in the background. The key (DEK, Data Encryption Key) is stored in a secure area inside the controller.

The consequence of this architecture for data recovery is clear: if the controller dies, the key is gone, and the raw data read from the NAND is encrypted and cannot be decrypted. That is why recovering the controller, or at least being able to read the key block, is critical in Samsung SSD cases. Chip-off does not succeed in every case, because when the data read from the chips remains AES-256 encrypted, it is in practice impossible to recover.

TRIM is a separate matter. Modern operating systems (Windows 10/11, macOS, Linux) automatically send the TRIM command on SSDs. The blocks where your deleted file resided are reported to the controller as "empty" through TRIM, and are physically erased in the next garbage collection cycle. In other words, the "recover deleted files" operation that is possible on a magnetic disk is largely impossible on an SSD where TRIM has been actively running.

The exception: if the drive is shut down immediately the moment a file is deleted and is not reconnected to the system, garbage collection may not have run yet, and there is a limited recovery window. This window is measured in hours, not days.

Can do-it-yourself be attempted?

The short answer: yes for logical damage, never for physical damage.

What we call logical damage is: an accidentally deleted file, a formatted partition, or a corrupted file system (NTFS, exFAT, ext4). In these cases the drive is still working healthily, and there is only a problem in the addressing layer. Tools such as R-Studio, EaseUS Data Recovery, PhotoRec, and TestDisk can be tried.

Important note: do not write to the drive you are recovering. Save the recovered files to a different disk. If TRIM is active, accept from the outset that the odds are low.

For physical damage, the do-it-yourself approach is a disaster. Attaching an external USB-NVMe adapter to a drive the BIOS does not see and trying it, supplying power to a damaged PCB, or attempting the "frozen drive in freezer" method learned online typically leads to secondary damage. Dipping NAND in liquid, drying it with a hair dryer, or touching the chip directly are all additional damage.

When drives that arrive after a wrong intervention reach our lab, the success rate drops noticeably. If you have any doubt, turn to an expert without doing anything.

Samsung official service vs a forensic expert

Samsung's warranty service follows a device replacement policy under the consumer warranty. It receives the faulty drive, sends an intact equivalent, and runs the faulty one through a data-shredding process. Recovering data is not Samsung's business, and the warranty policy does not cover it.

If your data is more valuable to you than the device, there are two paths:

  • Use the warranty, give up the data. The drive is replaced with a new one, and the data on the old drive is destroyed by Samsung.
  • Sacrifice the warranty, get the data. Turn to a data recovery lab. Because the drive will be opened and cloned, and vendor service mode will be used, the warranty seal is broken. In return, your data will most likely come back.

This choice is up to the user. Typically corporate customers prefer the data, while individual users sometimes prefer the warranty. When deciding, you should factor in whether a backup of the data exists, the informational value it contains, and your KVKK obligation.

KVKK and privacy

Corporate Samsung SSDs hold personnel information, customer data, financial records, and trade secrets. When this drive is sent for recovery, under KVKK the data controller is still the organization, and the recovery firm acts in the capacity of a data processor.

What a proper process should include:

  • An NDA signed with the recovery firm, with the data scope clearly defined.
  • An air-gapped lab: the recovery stations are not connected to the internet, and external storage is controlled.
  • Access logs: who accessed the drive, when, and for what purpose is recorded.
  • Delivery and destruction: after the recovered data is delivered to the customer, all working copies are destroyed within the agreed period in accordance with the NIST SP 800-88 Rev. 1 Purge and Destroy methods. For SSDs, cryptographic erase + verification is appropriate for Purge, and for physical destruction shredding/incineration rather than a degausser is appropriate, because NAND is not magnetic.

If there is a suspected KVKK breach in the organization (for example, the drive was lost and was not encrypted), an obligation to notify the Board within 72 hours comes into play. The recovery process does not remove this obligation; even if the drive comes back, it is accepted that a breach occurred.

Frequently Asked Questions (FAQ)

My Samsung 980 Pro died suddenly, can it be recovered?

NVMe controller (Elpis) death is a known pattern in the 980 Pro family. The chance of recovery varies by case using vendor service mode cloning or the chip-off method, but if the AES-256 key cannot be recovered, reading the NAND may be meaningless. Early intervention improves the odds.

Does data come back after TRIM?

No, if TRIM is active and the garbage collection cycle has run. If the drive has not been powered up at all within hours of deletion, there may be a limited chance, but expectations should be kept low.

I ran Samsung Magician "Secure Erase", can it be recovered?

No. Secure Erase resets the encryption key with a cryptographic erase, and in practice all the data is null and void. From this point on, no lab can bring the data back.

Does Samsung warranty service recover data?

No, the Samsung warranty covers drive replacement, not data recovery. If you want the data, go to a data recovery firm without using the warranty.

How long does it take?

A logical case takes 1-3 business days, cloning at the controller level takes 5-10 business days, and a chip-off case takes 10-20 business days as typical ranges. Hardware preparation, the extent of the damage, and the number of NAND chips determine the duration.

Can a liquid-exposed SSD be recovered?

In most cases, yes. Liquid hits the PCB, and the NAND chips usually remain intact. Rather than trying to dry the drive, the right move is to place it in an anti-static bag and get it to the lab immediately. Never apply power.

Working with DSET

Samsung SSD cases are among the brands we encounter most often in Turkey. From the 870 EVO to the 990 Pro, we can clone the consumer line as well as enterprise products such as the PM series NVMe in our lab. Our vendor service mode, FTL reconstruction, and chip-off hardware are ready, and a KVKK-compliant process and NDA are standard.

For our general data recovery approach, you can take a look at our 2026 Data Recovery Guide. If a chain of custody is required in corporate cases, our digital forensic examination processes are available.

Address: Hacettepe Teknokent, Ankara Phone: +90 536 662 38 09 Email: [email protected] The first assessment is free. Before shipping the drive, get in touch with us by phone or email, let us hear your case, and let us discuss what should and should not be done. For urgent cases, same-day lab intake is possible.

Sources: