Encrypted SSD: When Data Can and Cannot Be Recovered
Most modern SSDs are encrypted – maybe even yours, without you knowing. Hardware encryption runs automatically in the background on many Samsung, Crucial, or Intel models.
Encryption protects your data from unauthorized access. But it has a dark side: If the drive fails and you don't have a recovery key, your data may be lost forever.
Types of SSD encryption
Hardware encryption (SED – Self-Encrypting Drive)
What it is: SSD drive encrypts all data automatically directly in the controller using AES-256. It works always, even if you didn't enable encryption.
How it works:
- Data is encrypted on write, decrypted on read
- Encryption key is stored in controller
- It's transparent for the user (doesn't see it)
Common in:
- Samsung (EVO, PRO series)
- Crucial (MX series)
- Intel enterprise SSDs
- Most NVMe drives
Consequence for recovery: If controller fails, encryption key may be lost. Even if data physically exists on NAND chips, without the key it's unreadable.
Software encryption
BitLocker (Windows 10/11 Pro, Enterprise)
- Operating system level encryption
- Key bound to TPM (Trusted Platform Module) or password
- Recovery key can be saved to Microsoft account
FileVault (macOS)
- Default encryption on Mac computers
- Key bound to Apple ID or local recovery key
- Automatically enabled on newer Macs
VeraCrypt (cross-platform)
- Open source, TrueCrypt successor
- Full user control
- Rescue disk for emergencies
LUKS (Linux)
- Standard for Linux systems
- Full disk or partition encryption
Combination hardware + software
Some systems use both:
- SSD has hardware encryption
- BitLocker or FileVault added on top
Consequence: Double encryption = double problems during recovery. You need both keys.
Don't know if you have encryption?
Many users don't realize their disk is encrypted. Here's how to check.
Windows – BitLocker
- Open Control Panel → System and Security → BitLocker Drive Encryption
- Or type "BitLocker" in search
- You'll see status for each drive
Alternatively via command:
manage-bde -status
macOS – FileVault
- System Preferences → Security & Privacy → FileVault
- You'll see if FileVault is enabled
Alternatively in Terminal:
fdesetup status
Hardware encryption
Detecting hardware encryption is more difficult:
- Check specifications of your SSD model
- Most modern SSDs have it automatically
Practical test: If your SSD doesn't have visible encryption (BitLocker/FileVault off), but manufacturer states "hardware encryption" or "SED" – you have it enabled.
When data recovery IS possible
Scenario 1: Controller works, you have password
Situation: SSD works, you can enter password or PIN.
Solution: Standard recovery as with unencrypted drive. Encryption is not an obstacle.
Success rate: High (depends on other factors)
Scenario 2: Firmware problem + you have recovery key
Situation: Drive not visible due to firmware problem. You have saved recovery key.
Procedure:
- We repair firmware with specialized tools
- After repair you enter recovery key
- Data is accessible
Success rate: High (70-90%)
Scenario 3: Software encryption + disk readable
Situation: Disk physically works, but system doesn't boot. You have recovery key.
Procedure:
- We connect disk as secondary
- You enter recovery key to unlock
- We copy data
Success rate: Very high
When data recovery is IMPOSSIBLE
Hardware encryption + dead controller + no key
Situation: Controller is dead. Hardware encryption was active. Key was stored in controller.
Problem:
- Key was only in controller
- Dead controller = lost key
- Chip-off gets only encrypted (unreadable) data
Result: Data exists, but is permanently unreadable without key.
CANNOT BE BYPASSED – AES-256 is mathematically unbreakable.
BitLocker/FileVault + lost recovery key
Situation: System requests recovery key, but you don't have it.
Problem:
- Recovery key is the only way to unlock data
- Microsoft nor Apple can restore it
- There is no "back door"
Result: Data is permanently inaccessible.
CANNOT BE BYPASSED – Encryption works exactly as it should.
TPM-bound encryption + faulty TPM
Situation: BitLocker key was bound to TPM chip. TPM is faulty or was wiped.
Problem:
- Key existed only in TPM
- Faulty TPM = lost key
- Cannot decrypt without key
CANNOT BE BYPASSED
Recovery keys – CRITICALLY IMPORTANT
Recovery key is the only salvation when problems occur with encrypted drive. Without it, data is lost.
BitLocker Recovery Key
Where to find it:
Microsoft account – if you were logged in
- Visit: account.microsoft.com/devices/recoverykey
Azure AD – company computers
- Contact IT department
USB flash drive – if you saved it there
- Look for file with .BEK extension
Printed – if you printed it
- 48-digit numeric code
Active Directory – domain environment
- IT administrator has access
FileVault Recovery Key
Where to find it:
iCloud – if you enabled saving
- appleid.apple.com → Sign in → Devices
Printed – if you printed it when enabling FileVault
MDM system – company Mac
- Contact IT department
VeraCrypt
Where to find it:
Rescue disk – did you create it during encryption?
- Saved as ISO or burned to CD
Header backup – if you created header backup
What to do NOW (prevention)
If you're reading this article without an acute problem, you have a chance to prepare.
1. Find out if you have encryption
Use guides above. Find out what's active on your computer.
2. Find your recovery key
- Log into Microsoft/Apple account
- Check if key is there
- If not, find out where it is
3. Save recovery key in multiple places
We recommend:
- Cloud (Microsoft/Apple account)
- Printed in safe
- USB drive in secure location
- Password manager
NEVER:
- Only on encrypted drive (dead end)
- Only in one copy
4. Test recovery key
Make sure key works:
- Try unlocking drive using recovery key (not password)
- Verify you have correct key
5. Document
Create a record:
- What encryption you use
- Where recovery keys are
- Date of last check
Corporate environment
In companies, encryption key management is critical. Recommendations:
Central key management
- Azure AD for BitLocker
- Jamf for FileVault
- Automatic key escrow on activation
Escrow policies
Set policies so recovery keys are automatically saved to central location.
MDM solutions
Mobile Device Management systems (Intune, Jamf, Kandji) enable:
- Remote encryption management
- Central key storage
- Audit logs
IT department should have access
Ensure IT can obtain recovery key for any company device. Otherwise employee departure = lost data.
Practical examples
Successful recovery
Situation: Customer brought SSD with firmware problem. Drive not visible in system. BitLocker active.
What customer had:
- Recovery key saved in Microsoft account
Procedure:
- Diagnostics – firmware problem detected
- Firmware repair using PC-3000 SSD
- Drive visible again
- Customer entered recovery key
- Data accessible and copied
Result: 100% data recovered
Unsuccessful recovery
Situation: Samsung SSD with hardware encryption. Controller completely dead.
Problem:
- Key was stored only in controller
- Controller unrepairable
- Chip-off doable, but data would be encrypted
Result:
- Chip-off would get only encrypted, unreadable data
- Recovery impossible
Lesson:
- Backups are the only real protection
- For hardware encrypted SSDs, controller failure is fatal
FAQ
Can encryption be "bypassed" or "cracked"?
No. Modern encryption (AES-256) is mathematically unbreakable with today's technology. There are no "back doors" for manufacturers, police, or us.
Is hardware encryption more secure?
From security perspective yes – key never leaves controller. From data recovery perspective it's worse – if controller fails, key may be lost.
What if I don't know password, but have recovery key?
Recovery key supersedes password. With recovery key you can unlock drive even without knowing password.
Can DataHelp find out my recovery key?
No. Only the person who has it saved knows the recovery key. Microsoft, Apple, nor we can "find" or "restore" it.
Should I disable encryption due to risk?
No. Encryption protects your data from theft or loss. Correct solution is:
- Have recovery key safely saved
- Regular backups
Need to recover data from encrypted SSD?
If you have recovery key, situation is solvable. If not, we can at least determine if there's another way.
Diagnostics is free.
24/7 hotline: +420 775 220 440 Email: info@datahelp.eu