Ето превода, като запазвам структурата, Markdown форматирането и техническите термини:

Data recovery from modern SSDs has very little in common with data recovery from older generations of flash storage devices.

Today, multiple complex technological layers exist between user data and the NAND flash memory itself – controller, FTL, ECC/LDPC, scrambling, wear leveling, garbage collection, internal NAND organization, and in many modern SSDs – hardware encryption.

This is one of the main reasons why professional SSD recovery requires specialized knowledge, equipment, and experience.

The data in NAND memory is no longer what the computer sees

When we save a file to an SSD, the operating system works with logical addresses – LBA.

However, this logical address does not directly correspond to a physical location in the NAND memory.

The SSD controller uses a special layer – Flash Translation Layer (FTL) – which manages the translation between logical addresses and the physical location of the data.

At the same time, the controller performs:

• wear leveling;
• bad block management;
• garbage collection;
• ECC/LDPC correction;
• NAND interleaving;
• scrambling;
• free space management;
• metadata management;
• logical-to-physical mapping.

As a result, a file that appears to the operating system as a sequential series of blocks may physically be distributed across many different locations in the NAND memory.

And then there is encryption

In many modern SSDs, the controller performs hardware encryption of the data before it is written to NAND.

Schematically, the process looks like this:

Computer → SSD controller → cryptographic engine → FTL/ECC → NAND

During reading:

NAND → ECC/FTL → cryptographic engine → SSD controller → computer

This means that the NAND memory may contain not the original information, but an encrypted version of that information.

With a Self-Encrypting Drive (SED), encryption is performed inside the device and is transparent to the operating system.

Where is the encryption key stored?

This is a critical point in data recovery.

In certain modern SSD architectures, the encryption key is tied to the original controller or to a secure hardware environment within it.

This means that the NAND chips themselves do not contain everything necessary to decrypt the information.

If the controller is damaged, it may be possible to have physically healthy NAND chips but lack the necessary cryptographic context to turn their contents back into the original data.

This is precisely why, with hardware-encrypted SSDs, recovery often begins with recovering the original controller, rather than removing the NAND chips.

Why is chip-off no longer a universal solution?

Chip-off recovery involves physically removing the NAND memory from the circuit board and reading it directly using specialized equipment.

For suitable older or unencrypted devices, this method can be very useful.

However, if a modern SSD encrypts the data before writing it to NAND, chip-off produces:

NAND → encrypted data

rather than:

NAND → original files

Simply reading the chips does not remove the encryption.

With a hardware-encrypted SSD, a raw NAND dump may contain only encrypted information which, without the necessary key, is practically useless for recovering the files.

Therefore, with such devices, chip-off does not solve the problem of a damaged controller.

But even without encryption, chip-off is not an easy task

This is another important point.

Even with an SSD that does not use hardware encryption, a raw NAND dump is not a ready-to-use image of the drive.

NAND memory has its own complex organization:

Package → Die → Plane → Block → Page

The controller additionally manages the physical distribution of pages and blocks. Structures such as the following must also be recovered and interpreted:

• FTL;
• logical-to-physical mapping;
• ECC;
• LDPC;
• scrambling;
• page structure;
• spare/OOB areas;
• interleaving;
• bad block information;
• metadata.

Therefore, a raw dump may appear to contain a huge amount of information, but that does not automatically mean that a usable file can be obtained from it.

FTL – the map of physical memory

One of the most important components of an SSD controller is the Flash Translation Layer. It maintains the relationship between:

LBA → physical NAND location

Without correctly reconstructing this translation, it is possible to have all the NAND chips but not know which physical pages correspond to specific logical blocks.

This is particularly complicated because of wear leveling.

A logical block may initially be written to one location and later moved by the controller to another.

The old physical location may temporarily remain in the NAND while the new location becomes the current version.

Therefore, the recovery process must determine which physical information is current and how it relates to the logical addresses.

ECC and LDPC – why raw NAND data is not ready to be read

NAND memory has physical limitations and is subject to errors.

For this reason, SSD controllers use sophisticated error-correction mechanisms.

Modern NAND technologies widely use LDPC-based mechanisms. The controller uses this information to reconstruct the correct data during reading.

When reading NAND directly without the original controller, it is necessary to understand how the specific controller organized the ECC information, spare areas, scrambling, and other service data.

This is one of the reasons why two SSD models using similar types of NAND memory may require completely different approaches for chip-off recovery.

Scrambling – another layer

SSD controllers also use data scrambling. This should not be confused with encryption.

Scrambling is primarily intended to ensure proper operation of the NAND memory and controller and changes the way bits are physically distributed.

When recovering data from raw NAND, the specific scrambling algorithm and the way it has been applied must be known.

This adds another layer between:

the physical NAND cells

and

the file the user wants to recover.

Encryption completely changes the situation

With scrambling and ECC, there is a possibility that a specialist can reconstruct the relevant algorithms and structures if they are known or can be analyzed.

With strong hardware encryption, the situation is fundamentally different.

In this case, there is cryptographic protection that cannot simply be “calculated backwards” by analyzing a NAND dump.

If the required key is inaccessible, having the physical NAND chips is not sufficient.

This is precisely why, with some modern SSDs, the primary task is to restore the functionality of the original controller and its cryptographic environment.

Why doesn’t a donor controller solve the problem?

At first glance, it seems logical:

“We will find the same SSD, remove its controller, and put it on the damaged one.”

But with modern hardware-encrypted SSDs, this often does not work.

The donor controller may be exactly the same model, but it is a different physical chip with a different hardware cryptographic context.

Therefore, replacing the controller does not automatically mean recovering the encryption key of the original SSD.

That is why, in such cases, the goal is to find a way to recover the original controller rather than simply replace it with another one.

The biggest mistake – “let’s try chip-off”

With important data, this can be a very bad approach.

If the SSD uses hardware encryption, chip-off may not produce any useful result.

Furthermore, removing the NAND chips is a physical intervention in the device and may complicate subsequent work.

With some SSDs, the most valuable part of the storage device is not just the NAND memory, but the original controller, its firmware, internal structures, and cryptographic environment.

Modern SSD recovery is reconstruction, not simply “reading the memory”

With a modern SSD, we can conceptually represent the process as follows:

File

↓

File system

↓

LBA

↓

FTL / Logical-to-Physical Mapping

↓

ECC / LDPC / Scrambling

↓

Encryption

↓

NAND

During recovery, these layers must essentially be traversed in reverse.

And if any one of them is inaccessible, the physical presence of the NAND chips alone does not solve the problem.

This is why knowledge and specialized equipment are required

Professional data recovery from modern SSDs requires knowledge of:

• NAND architecture;
• SSD controllers;
• firmware;
• FTL;
• logical-to-physical translation;
• ECC/LDPC;
• scrambling;
• garbage collection;
• wear leveling;
• hardware encryption;
• cryptographic key management;
• specific architectures used by different manufacturers.

Specialized equipment is also required for diagnostics and work at the circuit board, controller, and NAND levels.

And most importantly – the correct approach must be determined before any physical intervention is performed.

Chip-off is not dead – but it is no longer universal

One clarification is important.

It would be incorrect to claim that chip-off recovery is absolutely impossible on all modern SSDs.

There are devices and controllers where encryption is not active or where the specific architecture allows NAND data to be extracted and reconstructed.

However, with SSDs using active hardware encryption, chip-off cannot replace the original controller, because the extracted NAND information remains encrypted.

Therefore, the correct statement is:

Chip-off recovery is no longer a universal method for modern SSDs, and with hardware-encrypted devices it may be practically useless without the original controller and its cryptographic environment.

Data recovery now means understanding how the SSD understands its own memory

Today, it is not enough to physically access the NAND chips.

We must be able to reconstruct the logic that transforms physical NAND cells into the information the user sees as files.

And when hardware encryption is added to FTL, ECC, scrambling, and the complex internal organization, the task becomes even more complicated.

That is why, when a modern SSD fails, the most valuable resource is often not the NAND memory itself, but the ability to recover the original controller and the entire mechanism through which it converts the physical memory back into accessible data.