Samsung MU-PA500B (portable SSD) wiped clean by Windows 10

[bos]

Customer called us and said they were backing up their Windows 10-files (it's unclear how they backed up) and somehow the drive was wiped clean afterwards, without any of them allowing it to be formatted or similiar.

Since there are no physical damages to the drive we made a dd-copy and investigated it in DMDE by full-scanning the whole drive (Raw, NTFS, exFat, etc) but other than some files that looks like they're belonging to a Windows 10-installation, the drive is completely wiped clean of their own files. We also ran photorec on the image, just for the sake of testing, and while there were some differences the general problem was still there: clean drive.

We've never seen this situation before. Is this the outcome of a TRIM-operation on the flash chips, or something else? If trim, would it be completely pointless to pull the chips and run them through VNR?

Attachments

[Lardman]

It sounds very much like your standard Windows ERD mistake and them trim/ garbage collection. Not sure of the value of VNR in reconstructing anything someone who uses it might comment.

I just bounce these back to the client as unrecoverable - they're not worth the hassle.