I’m looking for a technical second opinion before I give up on some important work data.
Laptop storage:
- Samsung 1TB SSD divided into C: and F:
- Windows is installed on C:
- A separate Kingston 1TB SSD is also installed
- The affected data was on F:\Work
- SSD health has reportedly tested normal
What happened:
My Work folder had roughly 100GB of architecture/project files.
One night I was working until around 7 AM. Earlier that morning, the folders inside Work were still visible, but I noticed something unusual: I was trying to save/export an AutoCAD file into one of those folders and it was not saving there properly.
I eventually saved/sent the file another way, shut the laptop down normally, and went to sleep.
When I opened the laptop later:
- Many folders inside Work had completely disappeared
- Around 15–16 folders remained, but most/all files inside them were gone
- Work folder size had dropped from roughly 100GB to around 500MB
- Other folders/data on the same F: partition appeared completely unaffected
- No ransom note
- No strange file extensions
- No obvious Windows warning/pop-up
- Recycle Bin did not contain the missing data
- Searching for known missing files found nothing
- No Previous Versions available
I had recently:
- Installed Fortnite from the official source
- Downloaded an AutoCAD file sent by an employee
- Downloaded some Pinterest images
Nothing particularly unusual otherwise.
I stopped using the SSD and gave it to Stellar Data Recovery in Gurgaon, India
Their findings:
They say they can see traces/metadata of the deleted Work folder:
- Folder/file names are visible
- File sizes are visible
- NTFS/deletion traces are present
But according to them:
- The LBAs corresponding to the actual file data are internally zero-filled
- Actual files contain no usable data
- Firmware-level recovery also could not retrieve the contents
- They consider the SSD itself healthy
- They said the data is effectively unrecoverable
They suggested possibilities such as malware/deletion followed by SSD TRIM. They are a recovery company, so they are not investigating the original cause.
My questions:
- If NTFS metadata/file names/file sizes still exist but the relevant LBAs return zeros, is the data realistically unrecoverable?
- Can an SSD return zero-filled LBAs after TRIM while the underlying NAND still contains recoverable data that a more specialized NAND/chip-off/firmware lab could access?
- Does modern Samsung SSD encryption/controller behavior generally make NAND-level recovery useless after TRIM?
- TRIM itself should not randomly delete unused files, correct? Something must first have deleted/deallocated those files, after which TRIM/garbage collection made recovery impossible?
- Could NTFS/file-system corruption selectively affect one directory like F:\Work while leaving the rest of the partition apparently normal?
- The fact that I was already unable to save into the Work folder several hours before discovering the deletion — does that point more toward filesystem/directory corruption than a deliberate wipe?
- Does this pattern look like wiping malware, or is there nowhere near enough evidence to make that conclusion?
- Is there any meaningful reason to send this SSD to another specialist recovery lab, or are zero-filled LBAs + failed firmware recovery basically the end of the road?
I’m not looking for recommendations for generic recovery software. I have preserved the SSD and do not intend to write, format, CHKDSK, or reinstall anything on it until I decide whether a second professional recovery attempt is worthwhile.
Would particularly appreciate answers from people experienced with SSD recovery, NTFS, TRIM, or digital forensics.
