The essential guide to hard drive and SSD data recovery

Whether installed as an internal boot drive or used as a high-capacity storage or backup device, hard disk drives (HDDs) and solid-state drives (SSDs) form the backbone of modern data storage. Although both serve the same basic purpose, their underlying architectures – spinning magnetic platters in HDDs versus non-volatile NAND flash memory in SSDs – have a profound impact on how data loss occurs and what recovery options may be available.

Data loss on HDDs and SSDs can result from two main types of failure: logical corruption, which may be addressed through software, and physical faults affecting the storage hardware. Choosing the right recovery approach requires considering the nature of the failure alongside the drive's mechanics, filesystem structures, encryption layers and the way it should be connected to the host system.

This guide examines the mechanisms behind HDD and SSD failures, explains which types of data loss may be recoverable through software, covers the structural and hardware characteristics that can affect the recovery process, and outlines essential precautions to minimize the risk of further damage.

Primary drive types: Internal vs. portable storage

Before addressing data loss, it is useful to distinguish between internal storage and portable external drives, as their connection methods and operating environments can directly influence how the storage should be handled during recovery:

• Internal drives: Installed inside desktop computers, laptops or servers, internal HDDs and SSDs connect directly to the motherboard via SATA or PCIe/NVMe interfaces. They commonly host operating systems, applications and active user data and may therefore be subject to frequent background read/write activity.

  Direct connection to the system bus generally provides a stable power and data path, which can be beneficial during data recovery. However, when an internal drive is used as an active system volume, ongoing OS activity, including logging, caching, updates and TRIM/Deallocate operations on SSDs and some SMR HDDs, can quickly deallocate or overwrite deleted data, making it unrecoverable.

• External drives: External HDDs and portable SSDs typically consist of a storage device housed in a separate enclosure and connected to the host computer through an interface such as USB, Thunderbolt or eSATA. They are commonly used for backups, archives and transferring data between computers.

  Used as secondary storage, external drives are generally less exposed to background writes from the host operating system. However, their portability introduces other risks, including physical drops, damaged cables or connectors, unstable power and accidental disconnection during active read/write operations. External enclosures and interface bridges can also affect how the underlying drive is detected and accessed during data recovery.

Core drive technologies: Mechanical HDDs vs. solid-state drives

The physical storage medium and the way data is stored and managed internally affect how the drive behaves during data loss and what recovery methods may be viable:

• Magnetic platters vs. NAND flash cells: HDDs rely on high-precision mechanical components – spinning platters, spindle motors and voice-coil actuator arms positioning read/write heads above magnetic surfaces. These components make HDDs highly vulnerable to drops, physical shocks, vibration and head crashes. SSDs, by contrast, have no moving parts and store data electronically in NAND flash cells, making them considerably more resistant to physical impact, although their electronic components and flash memory remain susceptible to electrical damage, wear and controller failure.

• TRIM/Deallocate commands: On modern internal SSDs and certain SMR HDDs, operating systems may issue TRIM or Deallocate commands when storage blocks are no longer needed, for example, after file deletion or formatting. The storage controller can then remove the corresponding logical-to-physical mappings and reclaim the underlying storage during garbage collection. Depending on the device and its implementation, subsequent reads of deallocated areas may return zeros, making conventional software-based recovery virtually impossible. Whether TRIM/Deallocate is supported and processed depends on the drive, interface, bridge controller, operating system and filesystem. However, traditional mechanical HDDs and most basic external USB-attached SSDs generally do not process automatic TRIM/Deallocate commands, so unlinked blocks usually remain intact on the media until they are overwritten.

• Wear leveling and Flash Translation Layer (FTL): SSDs use an abstraction layer called the FTL to map logical block addresses (LBAs) to physical locations in NAND flash while managing wear leveling, bad blocks and other characteristics of flash memory. If the FTL becomes corrupted or inaccessible, the underlying data may still be present on the NAND chips, but the controller may no longer be able to locate or translate the corresponding blocks. This can cause symptoms such as system freezes, device disconnection or an abnormal reported capacity, including 0 MB. HDDs do not use an SSD-style FTL, so their logical sector addressing and physical storage organization are handled differently, although modern HDDs also employ internal translation, defect management and sector remapping.

Drive failure categories: Logical vs. physical damage

Data loss on hard drives and solid-state drives generally falls into two main categories, although some incidents may involve both logical and physical problems. Distinguishing between them helps determine the appropriate recovery approach, potential risks and likelihood of successful recovery:

• Logical failures: When the physical storage components function normally, the stored data may remain intact even if the logical structures used to organize and locate it have been damaged or lost. Common causes include accidental deletion, partition table corruption (GPT/MBR damage), filesystem corruption (RAW status) or interrupted OS updates.

  Recovery prospects are generally high when the storage device is stable and the affected data has not been overwritten or deallocated. Data recovery software can analyze damaged filesystem metadata, reconstruct directory structures where sufficient information remains or locate file content using signature-based methods. However, on SSDs where TRIM/Deallocate has already made the relevant blocks unavailable or allowed them to be reclaimed, recovery prospects may drop close to zero regardless of the drive's physical condition.

  Read more: To learn how to pick the right software for different logical data loss scenarios, see our article on how to choose data recovery software.

• Physical, mechanical and firmware failures: When the storage hardware itself is damaged or malfunctioning, data recovery software cannot resolve the underlying issue, and continued operation may increase the risk of further data loss.

  • Mechanical HDD degradation: Drives with damaged heads, spindle problems or rapidly increasing bad sectors can become progressively less stable during read operations. Continued scanning of a mechanically failing HDD can place additional stress on the damaged components and may reduce the chances of successful recovery. Such cases are better handled by professionals using specialized hardware-level imaging and corresponding mechanical repairs where necessary.

  • SSD controller and firmware failures: When an SSD controller fails, suffers electrical damage or enters a firmware-defined safe or diagnostic state, the operating system may report an abnormal capacity, such as 0 MB, or identify the device by a generic controller name. Conventional recovery software may then be unable to access the NAND storage. Depending on the device architecture, laboratory recovery may involve specialized controller-level access, firmware work or direct NAND extraction and reconstruction.

  • Unstable media (bad sectors/worn NAND): Drives that repeatedly produce read errors, freeze during access or disconnect from the system require careful handling. Specialized imaging tools can use controlled read strategies, configurable error handling and multiple passes to extract as much readable data as possible before logical recovery is attempted.

Recoverable vs. irreversible logical data loss

In cases of logical faults, the boundary between recoverable and permanent data loss depends largely on whether the physical storage cells or sectors still contain the original data, or if destructive operations have overwritten, deallocated or erased it.

• Recoverable scenarios: When files are accidentally deleted on mechanical HDDs or untrimmed SSD media, the operating system typically updates filesystem metadata and marks the corresponding storage space as available for reuse. Until that space is overwritten or otherwise reclaimed, the original file content may remain recoverable. Similarly, a typical quick format primarily replaces a part of filesystem metadata and marks existing storage space as available, leaving much of the previous user data physically present. Even severe structural failures, such as corrupted partition tables, damaged volume headers or partitions displayed as RAW, can often be addressed with data recovery software capable of analyzing surviving metadata, reconstructing directory structures or locating file content through signature-based methods.

  Read more: For practical guidance on recovering data from common logical failures, see our articles on recovering data from a RAW partition and restoring deleted files.

• Unrecoverable scenarios (destructive operations): Logical data loss becomes permanent and irreversible when the original data has been physically overwritten or otherwise made inaccessible through destructive operations. On modern internal SSDs running over NVMe or SATA, as well as some SMR mechanical hard drives, the operating system may issue TRIM or Deallocate commands after file deletion or formatting. The drive controller can then unlink the corresponding logical block addresses, potentially return zeroes or otherwise deny access to the deallocated areas, and later reclaim the underlying physical storage through background garbage collection or other internal processes. In a similar manner, a full format may overwrite existing data, depending on the operating system and formatting method. Finally, deliberate data sanitization routines, such as multi-pass file shredding, ATA/NVMe Secure Erase or Crypto Erase operations that destroy onboard encryption keys, are specifically designed to make the original data permanently inaccessible and beyond the reach of data recovery software.

  Read more: To learn more about the factors that determine whether lost data can be recovered, see our article on the chances for data recovery.

Logical and security layers on hard drives and SSDs

Hard drives and solid-state drives can use a broad range of file systems, partition structures and security layers, from simple cross-platform formats on portable drives to complex enterprise storage configurations, each of which can influence the way data is recovered:

• Cross-platform file systems (exFAT, FAT32): Frequently used on external HDDs and portable SSDs for broad compatibility across Windows, macOS and Linux. These non-journaled file systems do not maintain transaction logs, and their metadata structures differ from those of journaling file systems. Logical data recovery can often be highly successful when the filesystem metadata and underlying file content remain intact and have not been overwritten. However, corruption of directory entries or allocation information, particularly after an unsafe disconnection, can make file reconstruction more difficult. Fragmentation can further complicate recovery when the original allocation information is no longer available, increasing reliance on signature-based methods.

• Desktop file systems (NTFS, APFS, Ext4, HFS+): Commonly used on internal system drives and dedicated external storage. Some of these file systems use journaling to record filesystem metadata or pending changes, helping maintain consistency after unexpected interruptions. However, journal records are not complete backups of the filesystem and do not necessarily preserve deleted files, original directory structures or all metadata after corruption or formatting. Recovery can often be highly successful when the filesystem's primary metadata remains intact, while severe damage to critical structures can significantly reduce recovery prospects. Their usefulness for recovery therefore depends on the specific file system and the nature and extent of the damage.

  Read more: To learn how file systems affect data recoverability, read our article explaining the chances of data recovery depending on the file system.

• File system compression and data deduplication: Advanced storage technologies, such as native NTFS compression and Microsoft Data Deduplication, can store file content in compressed or chunked forms and use metadata structures such as reparse points to map logical files to their underlying data. These mechanisms can complicate conventional signature-based recovery because the physical representation may no longer correspond to a complete, contiguous file stream. Successful reconstruction therefore requires recovery software to support the relevant compression, deduplication and filesystem structures, where applicable.

• Software encryption (BitLocker, FileVault, LUKS): Operating systems can use volume-level encryption on internal system drives as well as portable external media, such as BitLocker To Go. When a volume is encrypted, recovery software generally needs valid authentication material, such as a recovery key, password or passphrase, together with access to the necessary encryption metadata, before it can interpret the underlying filesystem structures. File carving and other analysis of encrypted data are generally ineffective until the relevant data has been decrypted.

  Read more: To learn how encryption affects the data recovery process, see our practical guide to data recovery from encrypted storage.

• Hardware encryption: Some external storage devices use hardware-based encryption implemented by the drive controller or an enclosure/bridge board. In certain designs, the encryption is tied to the original bridge or controller, so removing the drive from its enclosure and connecting it through another interface may expose only encrypted data. In such cases, recovery may require preserving the original encryption path or using specialized techniques appropriate to the device architecture.

• Logical volume management technologies: Operating systems can abstract physical storage into logical volumes using technologies such as Linux LVM, Windows Dynamic Disks (LDM) and Storage Spaces, which can span, stripe or pool storage across physical devices. Because filesystem structures reside above these abstraction layers rather than directly on conventional partitions, recovery software may first need to interpret the volume manager's metadata, such as LVM physical volume and volume group information or Storage Spaces pool metadata, to reconstruct the logical storage layout before analyzing the filesystem.

  Read more: To learn how different storage layouts can be reconstructed during recovery, see our practical guides on recovering data from Microsoft Storage Spaces, Linux LVM with Thin Provisioning and Apple Fusion Drive.

• Complex multi-disk arrays and NAS setups: Multi-drive configurations, such as hardware or software RAID (RAID 0, 1, 5, 6, 10) and multi-bay Network Attached Storage (NAS) units, represent a distinct and more complex recovery scenario. Rather than relying on the original controller or NAS hardware, all member drives must be safely extracted from the NAS and connected independently to a host machine (or imaged individually), then virtually reassembled using recovery software to determine stripe unit sizes, drive order, parity rotations and partition offsets.

  Read more: Learn more about recovering data from RAID arrays and NAS devices in our dedicated recovery guides.

Hardware interfaces and connection considerations

How drives communicate with the host operating system can directly affect data recovery safety, read stability and data preservation:

• Operating system drive isolation: Data recovery should generally not be performed on a drive while booted into the operating system installed on that same drive. An active operating system can continuously write temporary files, logs, browser caches, virtual memory data and indexing metadata, potentially overwriting deleted data. Affected system drives should preferably be removed and attached to an independent host machine as a secondary, non-boot drive, or the host system should be booted from a dedicated live recovery environment.

• Direct motherboard bus vs. USB bridge interfaces: Direct motherboard connections, such as internal SATA, SAS or M.2 PCIe connections, can be preferable for unstable drives when supported by the recovery workflow. USB adapters, docking stations and external enclosures introduce bridge controllers that may translate commands, limit access to low-level device functions or behave differently when encountering persistent read errors. Direct connections can therefore provide more control over device resets, error handling and imaging parameters, depending on the drive and host controller.

• Power supply requirements: Adequate and stable power is important to prevent unexpected disconnections and interruptions during imaging or prolonged read operations. Power requirements vary by drive form factor and interface:

  • 3.5-inch desktop HDDs: Typically require both 12V and 5V power rails and cannot operate from standard USB bus power alone. They generally require an external AC adapter or a suitable internal power supply.

  • 2.5-inch SATA HDDs and SSDs: SATA models generally operate from 5V power. When used in an external enclosure or adapter, the actual available power depends on the USB interface and enclosure design.

  • M.2 NVMe/SATA SSDs: M.2 drives typically use 3.3V supplied through the M.2 slot or converted by the external enclosure from its input power source.

• Reliable external drive connections: External hard drives and portable SSDs should be connected directly to a reliable USB port or a properly powered enclosure rather than through unpowered hubs, keyboard passthroughs or unreliable connections. Stable power and data connectivity help prevent unexpected disconnections during prolonged sector-level scans. For mechanical HDDs, insufficient or unstable power can also cause spin-up failures or repeated resets.

• Sector size translation (512e vs. 4Kn emulation): Some storage devices and bridge controllers can present sectors differently from the drive's native logical or physical sector format. In particular, certain USB bridges may perform sector-size translation or expose a different logical sector size from a direct connection. Removing a drive from an enclosure and attaching it directly can therefore change how its sectors are presented to the host, potentially causing partitions or filesystem structures to appear invalid or inaccessible. Such translation must be taken into account by recovery software when interpreting the drive or reconstructing its original layout.

• S.M.A.R.T. telemetry monitoring: Self-Monitoring, Analysis and Reporting Technology (S.M.A.R.T.) provides diagnostic information that can help identify signs of drive degradation. On HDDs, attributes such as Reallocated Sector Count and Current Pending Sector Count can be useful indicators of physical problems. SSDs expose different vendor-specific health metrics, such as percentage used, available spare capacity and media-related error indicators. These values should be considered alongside actual read behavior rather than treated as a definitive measure of recoverability.

• Preventing system intrusion: Modern operating systems may automatically mount recognized partitions, create system folders such as System Volume Information or .Trashes, and update filesystem metadata or file-access timestamps. To minimize inadvertent changes to vulnerable source media, hardware write-blockers or strict software-level read-only policies should be used where appropriate before accessing the source drive.

  Read more: For guidance on identifying a drive’s interface type and choosing an appropriate way to connect it to a computer, see our article on drive interfaces and connection methods.

DIY recovery vs. professional laboratory intervention

Distinguishing between recoverable logical corruption and hardware-level failure is critical, as continued software recovery attempts on physically compromised media can worsen the condition of the device and reduce the chances of successful recovery:

• DIY recovery can usually be attempted when the underlying hardware remains operational and stable. This applies to drives that initialize correctly, are properly identified by the system BIOS/UEFI with their expected model and capacity and remain stable during read operations. In these circumstances, software tools can address logical issues such as accidental deletion on magnetic media, quick-formatted volumes, lost partition tables or corrupted file-system structures. The same applies to intact disk images, where recovery operations are performed on the image rather than the physical source.

• Professional laboratory intervention is recommended in cases of physical, electrical or firmware malfunction. Mechanical hard drives exhibiting persistent clicking, ticking, grinding or abnormal mechanical noises may indicate problems with the heads, spindle motor or other internal components. Continued operation can place additional stress on failing components and, in severe cases, cause further damage to the magnetic surfaces and reduce recovery prospects.

  Similarly, drives that fail to spin up or are not detected on the SATA/PCIe bus may have problems involving the PCB, power circuitry, controller or other hardware components and require further diagnosis.

  On solid-state media, controller or firmware failures may cause symptoms such as a 0 MB reported capacity, generic controller identification, repeated resets or complete loss of communication with the host. In such cases, standard recovery software may be unable to access the NAND storage.

  Resolving hardware-level failures may require specialized laboratory equipment and techniques, which can include PCB or component repair, mechanical repairs and head-stack replacement for HDDs, or controller-level access and NAND extraction and reconstruction for certain SSDs.

Safety precautions for hard drive and SSD recovery

Regardless of whether the device is an HDD or SSD, careful handling is essential when recovering data from affected storage media, as inappropriate actions or repair procedures can turn a recoverable logical problem into permanent data loss:

• Halt all operations immediately: The moment data loss is suspected, stop using the affected drive. Close running applications, halt unnecessary background tasks and avoid web browsing, file transfers or installing software on that volume. Ongoing operating system activity, auto-save operations and background writes can overwrite storage space containing deleted data.

• Avoid in-place OS repair utilities: Automated operating system repair tools, such as Windows CHKDSK, macOS fsck_apfs/First Aid or Linux fsck, are designed primarily to restore filesystem consistency and make volumes usable by the operating system, not to preserve deleted or otherwise recoverable data. Depending on the filesystem and the nature of the corruption, such tools may modify metadata, remove orphaned records or alter allocation information, potentially reducing the chances of successful recovery.

• Power down at the first sign of hardware distress: If a mechanical hard drive produces persistent clicking, ticking, scraping or other abnormal mechanical noises, stop using it and disconnect power. Such symptoms can indicate problems with the heads, spindle motor or other internal components. Continued operation can place additional stress on failing hardware and, in severe cases, cause further damage to the platters and reduce recovery prospects.

• Secure encryption keys and recovery credentials early: If the volume is protected by BitLocker, FileVault, LUKS or APFS encryption, locate and preserve the corresponding recovery keys, passwords, passphrases or other supported key material before beginning recovery procedures. Recovery software generally requires valid cryptographic credentials together with access to the necessary encryption metadata to interpret the protected data. Without them, recovering meaningful file content from an encrypted image is generally not possible.

• Never save recovered data back to the source drive: Writing restored files, installing recovery utilities or directing temporary files onto the affected volume can overwrite storage space and metadata needed for recovery. Always use a separate storage device with sufficient free capacity as the recovery destination.

• Handle power and bus connections safely: Ensure external drives are securely connected to a stable power source and avoid unreliable connections, including unsuitable unpowered USB hubs or loose connectors. If a drive repeatedly disconnects or produces persistent read errors during imaging, avoid unnecessary repeated access attempts and consider specialized imaging or professional laboratory intervention.

• Create a disk image before logical recovery: For aging, weak or unstable media, avoid performing extensive scanning directly on the original drive. Instead, create a sector-by-sector disk image or clone using an imaging tool configured for controlled error handling and appropriate read-timeout and retry parameters. Once a usable image has been created, perform subsequent filesystem analysis and data extraction on the image rather than repeatedly accessing the original drive.

  Read more: For step-by-step imaging instructions, see our guide on how to create a disk image.

• Maintain adequate thermal conditions during imaging: Prolonged imaging operations can generate substantial heat, particularly in compact high-performance SSDs. Ensure adequate ventilation and, where appropriate, use the cooling solution recommended for the specific drive or enclosure. Excessive temperatures can cause SSD thermal throttling and may contribute to unstable operation, while sustained elevated temperatures can also adversely affect other storage hardware.

  Read more: For a detailed overview of a safe recovery procedure, see our practical guides on how to recover data from an external drive or an internal drive of a desktop or laptop PC.

Last update: August 28, 2026

If you liked this article, you can share it on social media: