Data recovery of overwritten SSD possible?

Internal SSD Ultra® 3D SSD
1

Greetings!

tl;dr:
I accidentally used macOS to format an SSD that was encrypted with VeraCrypt. Is it possible to recover the VeraCrypt headers?

Long version:
I used VeraCrypt to encrypt a complete SSD. Well, not totally. It was initialized as a GPT drive under Windows 7. Hence, there is a 128MB EFI partition at the beginning of the SSD. The remainder ist filled with one partition that was encrypted.

I deleted the SSD when I accidentally initialized it as a GPT drive in macOS.

VeraCrypt stores the header with the master key at the beginning of the encrypted partition. A copy of the header is stored at the end of the partition as a backup.

Problem 1: GPT drives store a copy of the GPT at the end of the drive as backup. The backup VeraCrypt header is, therefore, gone.

When initializing a GPT drive, macOS creates a 200MB EFI partition followed by a standard partition using the rest of the drive. Since my header was stored at 128MB, it should be fine. The GPT ist stored at the beginning of the drive (and a backup copy at the end) and no further data is written.

Problem 2: macOS decided to overwrite the beginning and the end of the drive with zeros. So many, in fact, that my header at 128MB is also gone. I had hoped that the area of the partition would just be marked as empty but the actual data would still be there. Alas, a dd clone of the whole SSD revealed just zeros at 128MB.

Which brings me to the initial question: If an area on an SSD is overwritten, is there any way to recover the overwritten data? I know that simple overwriting is permanent as the cells will get different charges and the previous charges are gone (in contrast to magnetic hard drives where traces of the previous magnetization remain).

But: May it be possible that the concerned cells were not overwritten at all and marked as not to be used by the SSD’s wear leveling? Is it possible to read those cells and retrieve the previous data? And if so, to reconstruct the overwritten data blocks that were comprised of these cells?

Any help or insight is greatly appreciated. Half of my life is stored on that SSD.

2

Hi @aksd,

Have you opened a Support Case? If not opened, for more information, please contact the SD Technical Support team for best assistance and troubleshooting:
https://kb.sandisk.com/app/ask

3

I am not sure if my case is covered by support. The overwriting of the SSD was completely my own fault and had nothing to do with a technical problem. I am simply trying to figure out if there is any way to retrieve the overwritten data.

5

Is it really possible to recover overwritten data? i don’t know much as per my knowledge i think that deleted data can sometimes be recovered because it’s not immediately erased from the storage device. it’s just marked as available for overwriting. However, once new data is written to the same space (overwritten) the chances of recovery is low. Overwritten data is generally considered permanently lost because the original data is replaced by new information. So How can someone recover thier old data !!!

6

You’re right! Recovering deleted data is possible because it’s usually just marked for overwriting, but once new data has overwritten the old, recovering it becomes much harder. Overwritten data is generally considered lost since the new data replaces the old.

In rare cases, advanced techniques such as forensic recovery can extract remnants of overwritten data, but this is expensive and not guaranteed. Most common recovery methods focus on retrieving data that hasn’t been overwritten yet. Prevention is key—minimizing new data writes after deletion can improve the chances of recovery.

7

Overwritten a file means that you replace the data on this particular place on the drive by another series of bytes. So, what is overwritten is gone forever. No way to recover it . This is the reason why, when you delete files and want to recover them, you absolutely had to stop using the drive!

8

Overwritten a file means that you replace the data on this particular place on the drive by another series of bytes. So, what is overwritten is gone forever. No way to recover it . This is the reason why, when you delete files and want to recover them, you absolutely had to stop using the drive! :blush:

12

Once data is overwritten, it’s usually gone, unlike with HDDs. If your VeraCrypt header is overwritten, recovery is unlikely. It’s best to stop using the SSD to avoid losing more data.