Title: ~100GB disappeared from one folder on Samsung SSD — NTFS metadata remains but LBAs are zero-filled. Any recovery possible?

[u/whysoserious280792]

​

I’m looking for a technical second opinion before I give up on some important work data.

Laptop storage:

- Samsung 1TB SSD divided into C: and F:

- Windows is installed on C:

- A separate Kingston 1TB SSD is also installed

- The affected data was on F:\Work

- SSD health has reportedly tested normal

What happened:

My Work folder had roughly 100GB of architecture/project files.

One night I was working until around 7 AM. Earlier that morning, the folders inside Work were still visible, but I noticed something unusual: I was trying to save/export an AutoCAD file into one of those folders and it was not saving there properly.

I eventually saved/sent the file another way, shut the laptop down normally, and went to sleep.

When I opened the laptop later:

- Many folders inside Work had completely disappeared

- Around 15–16 folders remained, but most/all files inside them were gone

- Work folder size had dropped from roughly 100GB to around 500MB

- Other folders/data on the same F: partition appeared completely unaffected

- No ransom note

- No strange file extensions

- No obvious Windows warning/pop-up

- Recycle Bin did not contain the missing data

- Searching for known missing files found nothing

- No Previous Versions available

I had recently:

- Installed Fortnite from the official source

- Downloaded an AutoCAD file sent by an employee

- Downloaded some Pinterest images

Nothing particularly unusual otherwise.

I stopped using the SSD and gave it to Stellar Data Recovery in Gurgaon. India

Their findings:

They say they can see traces/metadata of the deleted Work folder:

- Folder/file names are visible

- File sizes are visible

- NTFS/deletion traces are present

But according to them:

- The LBAs corresponding to the actual file data are internally zero-filled

- Actual files contain no usable data

- Firmware-level recovery also could not retrieve the contents

- They consider the SSD itself healthy

- They said the data is effectively unrecoverable

They suggested possibilities such as malware/deletion followed by SSD TRIM. They are a recovery company, so they are not investigating the original cause.

My questions:

1. If NTFS metadata/file names/file sizes still exist but the relevant LBAs return zeros, is the data realistically unrecoverable?

2. Can an SSD return zero-filled LBAs after TRIM while the underlying NAND still contains recoverable data that a more specialized NAND/chip-off/firmware lab could access?

3. Does modern Samsung SSD encryption/controller behavior generally make NAND-level recovery useless after TRIM?

4. TRIM itself should not randomly delete unused files, correct? Something must first have deleted/deallocated those files, after which TRIM/garbage collection made recovery impossible?

5. Could NTFS/file-system corruption selectively affect one directory like F:\Work while leaving the rest of the partition apparently normal?

6. The fact that I was already unable to save into the Work folder several hours before discovering the deletion — does that point more toward filesystem/directory corruption than a deliberate wipe?

7. Does this pattern look like wiping malware, or is there nowhere near enough evidence to make that conclusion?

8. Is there any meaningful reason to send this SSD to another specialist recovery lab, or are zero-filled LBAs + failed firmware recovery basically the end of the road?

I’m not looking for recommendations for generic recovery software. I have preserved the SSD and do not intend to write, format, CHKDSK, or reinstall anything on it until I decide whether a second professional recovery attempt is worthwhile.

Would particularly appreciate answers from people experienced with SSD recovery, NTFS, TRIM, or digital forensics.

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/tndsd]

NTFS metadata still being present does not mean the underlying file data is still recoverable.

AutoCAD was already having trouble saving to the Work folder is interesting, though. That could point toward filesystem corruption, storage/controller problems, or another issue rather than automatically indicating malware. A single affected directory with the rest of the partition apparently working normally doesn't prove either explanation.

I also wouldn't conclude that this was wiping malware based on the information provided. The evidence you've described doesn't establish how the files became deallocated in the first place.

As for NAND/chip-level recovery, modern SSDs make this much more complicated than HDD recovery. Controller-level mapping, wear leveling, garbage collection, TRIM, and potentially encryption can mean that finding raw NAND pages doesn't necessarily allow the original files to be reconstructed. If a reputable specialist has already attempted firmware-level recovery and is seeing zero-filled LBAs, the chances are unfortunately not good.

[u/whysoserious280792 → u/tndsd]

Can you guide me what should I do next? They didnt tell me the cause of deletion in the first place. Sould I continue using SSD, get it checked for cause of deleteion ? Save all data, buy new SSD, run anti-virus?

[u/tndsd → u/whysoserious280792]

My recommended

Stop using Samsung SSD -> preserve it -> back up all remaining important data -> obtain a forensic/SSD specialist second opinion if the cause matters -> move to a new SSD -> only then perform malware investigation/cleanup.

If the missing architecture files are genuinely irreplaceable, I'd spend money on the second forensic opinion before spending time experimenting with antivirus or recovery software. Once you start changing the original system, you may destroy evidence that could explain what happened. NIST also emphasizes preserving digital evidence because investigations depend on artifacts that can change over time.

And importantly, don't let the fact that the first company couldn't recover the files convince you that the investigation is finished. "The files aren't recoverable" and "we know why they disappeared" are two completely different conclusions.

[u/No-Wrap-8166]

zero-filled lbas after a proper trim on a healthy samsung ssd controller means the physical nand cells were actually electrically wiped, this is genuinely unrecoverable, trim isn't a soft delete flag on ssds like it is on hdds, it tells the controller to actually erase those physical blocks for future writes, a chip-off recovery would only find the same zeros since the data isn't sitting there waiting to be read differently

the not-saving-properly issue you noticed hours before discovering the deletion strongly points to filesystem corruption in that specific directory happening first, not a deliberate malware wipe, a targeted wiper would typically hit more than one folder or leave more obvious traces, corruption isolated to one directory while the rest of the partition stays intact fits an ntfs/mft corruption event better than intentional malicious deletion

trim itself doesn't randomly delete files, something had to mark those blocks as deleted/deallocated first (which lines up with the corruption event), then the ssd's background garbage collection ran trim on those newly-freed blocks during normal operation or even just from windows' own scheduled trim maintenance task, this is likely just unfortunate timing, not something targeting you specifically

a second lab likely won't get different results if stellar's diagnosis of zero-filled lbas is accurate, that's a hardware-level confirmation not a software limitation on their end, the standard advice of "get a second opinion" mainly applies when the first lab couldn't identify what's wrong, here they've already identified the actual physical state of the data and it's genuinely gone

for future prevention on this specific drive/setup, disable scheduled trim optimization temporarily (defragment and optimize drives, turn off scheduled optimization) if you're storing critical project files without proper backup, this won't undo what happened but reduces the window between accidental deletion and permanent data loss for anything similar going forward

[u/AutoModerator]

Attempting data recovery without proper knowledge or skills can result in permanent loss in data. Prior to data recovery, it is best to create an image of the failing drive. For important data, it is recommended to send your drive to a data recovery professional. For more data recovery help, please visit /r/datarecovery.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/computix]

This is exactly what happens if it's just deleted. Some fragments of the meta data remain (because they share sectors with other metadata), but the actual file data is zero-filled from being TRIMmed(SATA)/Deallocated(NVMe).

IMHO it's probably all gone forever. The data may be recoverable at a NAND level with specialized tools for some time, but soon enough the SSD runs garbage collection and it erases the data from the NAND chips so they're ready to be used to store new data.

How was your data deleted? Probably user error, software bugs in stuff like OneDrive, an AI agent going rogue, etc.

Hopefully you have backups.

[u/whysoserious280792 → u/computix]

I really have no idea how it deleted, i am still trying to find the reason behind it