Files disappeared from SSD, and recovery is recovering zero-filled files

Question

My father has this SSD drive working fine for 4 years. I've moved that drive to a new Desktop PC, reinstalled Windows 10, and everything was working fine. A few days later, all his documents and emails disappeared.

First partition (with Windows) is still working perfectly, without any errors. The second partition, with all his data, lost almost all folders - they just disappeared. But some other folders are still there, and working fine.

I've tried recovery tools like EASEUS and Ontrack, and they all find the full structure of all files which disappeared, but when I recover those files, they all are recovered in corrupt state. documents/images don't open (invalid chars), and the most important files (huge PST files with 1 to 5GB) are completely zero-filled (original size preserved, but full contents are byte zero), which I assume is related to the TRIM option for the SSD.

I don't know if my father accidentally did something wrong (like deleting all folders), but I suspect that this may be related to power cycling (sleeping/awaking).

I already changed cables, changed drive to another computer, but the files are still being recovered totally corrupted.

Other than professional services, what are my options to recover the files?

Is SpinRite a good option? Or should I use forensic software (which one?) for recovering the PST files?

UPDATE: As far as I checked, it's really about TRIM. Not sure if the SSD deleted those files already or if it's garbage-collected, but anyway, SSD returns zeroes for contents. Looks like I don't have any option here. SpinRite didn't help.

Answer 1

I checked the SSD deeply, and it's very healthy, I also didn't find any virus, so it looks like my father really deleted (shift-del) those files by mistake. Since TRIM was on, the SSD does zero-fill over that unallocated space, which explains why recovery tools could find a preserved directory structure (NTFS master file table), but the contents were fully (or mostly) zeroes.

In the end I just restored an old backup (from a few months ago), which should be fine since he has not been very active in the past few years (77 years old), and all his emails are still in Gmail.

A friend told me that if I just had disabled TRIM right after the problem I could have recovered those files, but I was only informed about the problem in the next day. Yet, I'm not sure if this is true, I think it depends a lot on the implementation of the SSD garbage-collector, which may still honor the blocks-to-be-erased even after TRIM is disabled.

Learned a few lessons here:

1. If you move the documents folder to a non standard folder, be sure to HIDE that folder as a system folder, to avoid accidental deletion. (I was keeping his documents under D:\HisName\Documents, and I left that D:\HisName open, probably he didn't recognize and decided to delete it.
2. Do not rely on recovery software for SSD drives
3. Don't be sloppy with your backups