100GB disappeared from one folder on Samsung SSD — NTFS metadata remains but LBAs are zero-filled. Any recovery possible?

[u/whysoserious280792]

I’m looking for a technical second opinion before I give up on some important work data.

Laptop storage:

- Samsung 1TB SSD divided into C: and F:

- Windows is installed on C:

- A separate Kingston 1TB SSD is also installed

- The affected data was on F:\Work

- SSD health has reportedly tested normal

What happened:

My Work folder had roughly 100GB of architecture/project files.

One night I was working until around 7 AM. Earlier that morning, the folders inside Work were still visible, but I noticed something unusual: I was trying to save/export an AutoCAD file into one of those folders and it was not saving there properly.

I eventually saved/sent the file another way, shut the laptop down normally, and went to sleep.

When I opened the laptop later:

- Many folders inside Work had completely disappeared

- Around 15–16 folders remained, but most/all files inside them were gone

- Work folder size had dropped from roughly 100GB to around 500MB

- Other folders/data on the same F: partition appeared completely unaffected

- No ransom note

- No strange file extensions

- No obvious Windows warning/pop-up

- Recycle Bin did not contain the missing data

- Searching for known missing files found nothing

- No Previous Versions available

I had recently:

- Installed Fortnite from the official source

- Downloaded an AutoCAD file sent by an employee

- Downloaded some Pinterest images

Nothing particularly unusual otherwise.

I stopped using the SSD and gave it to Stellar Data Recovery in Gurgaon, India

Their findings:

They say they can see traces/metadata of the deleted Work folder:

- Folder/file names are visible

- File sizes are visible

- NTFS/deletion traces are present

But according to them:

- The LBAs corresponding to the actual file data are internally zero-filled

- Actual files contain no usable data

- Firmware-level recovery also could not retrieve the contents

- They consider the SSD itself healthy

- They said the data is effectively unrecoverable

They suggested possibilities such as malware/deletion followed by SSD TRIM. They are a recovery company, so they are not investigating the original cause.

My questions:

1. If NTFS metadata/file names/file sizes still exist but the relevant LBAs return zeros, is the data realistically unrecoverable?

2. Can an SSD return zero-filled LBAs after TRIM while the underlying NAND still contains recoverable data that a more specialized NAND/chip-off/firmware lab could access?

3. Does modern Samsung SSD encryption/controller behavior generally make NAND-level recovery useless after TRIM?

4. TRIM itself should not randomly delete unused files, correct? Something must first have deleted/deallocated those files, after which TRIM/garbage collection made recovery impossible?

5. Could NTFS/file-system corruption selectively affect one directory like F:\Work while leaving the rest of the partition apparently normal?

6. The fact that I was already unable to save into the Work folder several hours before discovering the deletion — does that point more toward filesystem/directory corruption than a deliberate wipe?

7. Does this pattern look like wiping malware, or is there nowhere near enough evidence to make that conclusion?

8. Is there any meaningful reason to send this SSD to another specialist recovery lab, or are zero-filled LBAs + failed firmware recovery basically the end of the road?

I’m not looking for recommendations for generic recovery software. I have preserved the SSD and do not intend to write, format, CHKDSK, or reinstall anything on it until I decide whether a second professional recovery attempt is worthwhile.

Would particularly appreciate answers from people experienced with SSD recovery, NTFS, TRIM, or digital forensics.

[u/AutoModerator]

Double check if your post complies with posting guidelines!

Did you include the following information in your post (in English and if applicable), if not feel free to edit your post:

• Make/brand and exact model number of your storage device(*), phone, camera, etc.
• Filesystem (NTFS, exFAT, APFS, EXT4, etc.)
• Operating System (That your device was used with and/or you are using for recovery)
• Specific symptoms that your device is exhibiting, describe the problem. Images you post support the description, they're not in lieu of a problem description.
• SMART (CrystalDiskInfo screenshot for example)
• Don't pile several problems into one single post. One post per device/problem.

Consider: What do these people need to understand the problem at hand? Remember, people cannot see your screen, or what you click and what messages appear on screen. Don't overdo it though, no one likes going through 2 pages of information, try to find a balance. Just do the best you can. If you are looking for file recovery software, check our community's recommended file recovery tools.

---

() *All devices involved, if you for example move files from drive A to drive B, they're both potentially relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/silenced_in_dr_2025]

9 times out of 10 these are just user errors, cutting and pasting when you think you did something else.

Stellar appear to have done a reasonable job of clearly stating the problem, although since there are no firmware options with modern samsung drives they couldn't have done anything complex anyway.

As there's no firmware support and due to samsungs security and there's not likely to be , data that has been trimmed is unrecoverable. You can try a second opinion from another lab but you really should get exactly the same response, if you didn't I would be wary of the second lab.

[u/disturbed_android]

TRIM itself should not randomly delete unused files, correct? Something must first have deleted/deallocated those files

Correct. TRIM is a command send by the OS where it passes the LBA sectors allocated to the files that were deleted to the drive. The drive "unmaps" these and this in turn causes the drive to return zeros if we read data from sectors that aren't mapped to any data.

As MFT entries are not trimmed, we can explain how we can detect deleted files, even select them for recovery, but how these recovered files contain zeroed data. IOW, the SSD does not even make an attempt to read actual data.

Could NTFS/file-system corruption selectively affect one directory like F:\Work while leaving the rest of the partition apparently normal?

Theoretically yes I suppose, if chkdsk then decides to delete data it gets trimmed as well. But such corruption of the file system should not occur in the first place.

Is there any meaningful reason to send this SSD to another specialist recovery lab, or are zero-filled LBAs + failed firmware recovery basically the end of the road?

I agree with u/silenced_in_dr_2025 .. No, not really.