0

It would be really appreciated if someone could teach me how to recover/fix damaged data from a SSD.

The wife uses a Samsung 850EVO 500G SSD with a SATA to USB 3.0 cable as a daily working drive. Last week, she used FreeFileSync to backup her data to a Seagate hard drive, which is her backup drive. We do not know what happened, but FreeFileSync deleted all her new data on Samsung SSD and replaced them with the old data from the Seagate drive. The wife only backs up data twice a year(not wise and stubborn), so she lost half year hard work. Most of them are SAS code/data and Excel files.

I tried to recovered these deleted data from the SSD and looks I got almost all the data back. However, only like 5% of them could be opened, although all of them show the real size. I tried different software, including R-Studio/DMDE/EasyRecovery/Getdataback, but all of them have the same results.

I do not know how FreeFileSync worked and what caused the recovered data damaged. I had recovered deleted data from HDDs several times before, and every time it was easy and successful. I check the SSD that the TRIM support is enabled. Maybe that is the reason why I cannot get the data back.

All these happened on Win7 system and half of the SSD was empty.

Please help us! Thank you in advance!

2
  • 2
    Sounds like the drives synched from B to A instead of from A to B. Probably wrong setting or confused drive numbers.
    – jiggunjer
    Nov 5, 2015 at 3:40
  • 4
    I'm not up to date on forensics any more but there's a paper from my school days that suggests garbage collection makes recovery really really hard. web.archive.org/web/20140216143752/http://www.jdfsl.org/… if you're interested.
    – Journeyman Geek
    Nov 5, 2015 at 4:55

1 Answer 1

1

Unfortunately, recovering the file data is impossible. If the files show the correct file size, then this means that the file records have shown the old location of the data correctly. It is this step that usually makes the difference between a successful recovery and an unsuccessful one. Since this step is done, there is nothing else you can improve for the recovery (short of secret government methods using classified hardware).

The fact that the files cannot be opened indicate that the location where the old information was stored has been overwritten with new information. In cases where the filenames match, this happens 95-100% of the time, even without TRIM support. But yeah, with TRIM support, the chances of a successful recovery are even lower.

I had this happen three times to me, and I also lost quite significant information all 3 times; so I am so-to-say an expert on this now. There is one thing that remains, that you can do. A file opens if it is intact; the fact that 5% of the files do open is a good hint that a lot of data can still be salvaged.

Take the recovered files, and open them with notepad. Even though only 5% of the files can be recovered completely, depending on their format, you might be able to recover a good amount of data from each individual file.

-- If the format is Microsoft Office or .ZIP, you can forget it: it won't work.

-- If the format is Wordpad or .BMP, you can recover 99% of the data that is not lost. For Wordpad, this has to be done manually; for .BMP there is third-party software to help recovering them.

-- XP format of e-mails allows 99% recovery rate; Vista format of e-mails brings it to 0% recovery rate.

-- If the format is .JPG, you can recover roughly 84% of the data that is not lost, using third-party software.

-- If the format is a video format, the amount of data you can recover strongly depends on how sparsely it has been overwritten, and in practice tends to be either 0-10% or over 70%.

3
  • Thank you so much for your time! The files the wife wants most are SAS codes. I am trying to open some corrupted SAS code by Notepad. The results are the same as they opened in SAS. Some code files even are half in gibberish and half in right code.
    – Sambing
    Nov 6, 2015 at 0:45
  • I did not know we can use notepad to recover corrupted files. Do I just open the files in notepad to see the text? Or I can further use some third-party software to re-edit the gibberish? Thank you!
    – Sambing
    Nov 6, 2015 at 0:54
  • For SAS files, you would only open it to see the text; the gibberish is where the data has been overwritten. For most other formats, third-party software can be used to read the part of the gibberish that has NOT been overwritten.
    – Alex
    Nov 11, 2015 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .