Yes. A damaged SSD can still contain recoverable information even when the device no longer works normally.

The key distinction is between device failure and data sanitisation.

An SSD may stop appearing in a computer, fail to boot, suffer damage to its controller or become physically damaged while some of the underlying flash memory still retains previously stored information. A device being unusable for normal business purposes does not automatically mean the information on it has been rendered unrecoverable.

The National Cyber Security Centre warns that if a sanitisation process cannot access all memory within a storage device, there may still be a residual risk that persistent data can be recovered. Its guidance also notes that SSDs can be difficult to sanitise reliably.

For organisations handling sensitive information, a failed SSD should therefore still be treated as data-bearing media until an appropriate sanitisation or destruction process has been completed.

Does a failed SSD still store data?

Potentially, yes.

Failure can happen at several different levels.

An SSD might stop functioning because:

• its controller has failed;
• its firmware has become corrupted;
• the connector or circuit board has been damaged;
• electrical components have failed;
• some memory areas have become unreadable;
• the device has suffered physical impact.

None of these outcomes necessarily means that every flash memory cell containing data has been securely erased.

This is why it is risky to equate:

“The computer cannot read the drive”

with:

“The information has been destroyed.”

They are not the same condition.

The NCSC defines sanitisation in terms of reducing the likelihood of data retrieval and reconstruction to an acceptable level. That is a stronger requirement than simply making a device unusable in its ordinary operating environment.

Why can an inaccessible SSD still contain information?

Solid-state drives store information in flash memory rather than on magnetic platters.

The SSD controller manages how that flash memory is used. It handles tasks such as translating logical addresses, managing wear and remapping storage areas.

If the controller fails, the computer may no longer be able to access the drive through its normal interface.

However, that failure does not automatically erase the information stored in the flash memory itself.

This distinction is particularly important when organisations are assessing failed hardware for disposal.

A drive that appears “dead” at operating-system level may simply be inaccessible through the normal hardware and software path.

The NCSC’s sanitisation guidance reflects this broader principle. It advises organisations to consider whether all user-accessible memory has been properly processed and warns that where sanitisation steps cannot be completed, there may be residual data remaining on the device.

For sensitive data, inaccessible should therefore not be treated as synonymous with unrecoverable.

Does physical damage make SSD data unrecoverable?

Not automatically.

The answer depends on what has actually been damaged and how extensively.

A cracked casing, broken connector or damaged circuit board may prevent an SSD from operating normally while leaving significant parts of the flash memory intact.

Similarly, physically bending or striking a storage device does not necessarily ensure that every memory component has been sufficiently damaged to prevent specialist recovery.

This is one reason secure destruction processes need to be designed around the media itself rather than simply creating visible damage.

A device that looks badly damaged may still contain usable storage components.

Conversely, correctly specified physical destruction is intended to reduce the remaining media to a condition where reconstruction becomes infeasible for the required threat model.

Those are very different standards.

Why does SSD architecture make sanitisation more complicated?

SSDs present several challenges that do not arise in exactly the same way with traditional magnetic hard drives.

One of the most important is that the operating system does not necessarily have simple, direct control over every physical memory location in the device.

Modern SSDs manage their own storage internally.

This can involve:

• wear levelling;
• spare memory areas;
• remapped blocks;
• inaccessible or reserved storage;
• controller-managed data movement.

As a result, overwriting the storage locations visible to the operating system does not automatically prove that every physical location that previously held information has been overwritten.

The NCSC specifically advises organisations to check device metadata for remapping and bad sectors during sanitisation. It warns that if remapping has occurred or bad sectors are present, there is a possibility that data may remain.

This is especially relevant when an SSD is already damaged because the organisation may be unable to perform or verify normal sanitisation procedures successfully.

What happens if an SSD cannot complete a secure erase process?

That creates uncertainty.

A secure erase, manufacturer sanitisation command or other logical process depends on the device being sufficiently operational to execute the required commands.

If the SSD fails before the process can be completed and verified, an organisation may not be able to demonstrate that all relevant data has been sanitised.

The NCSC’s current guidance states that where recommended sanitisation steps cannot be completed, or where not all memory space can be accessed, there is a residual risk that persistent information could remain recoverable by a suitably capable laboratory.

This does not mean every failed SSD will yield recoverable information.

It means the organisation should not assume the opposite without evidence.

From a compliance perspective, uncertainty itself can be enough to justify treating the SSD as still containing sensitive information.

Can data recovery specialists recover information from a damaged SSD?

Sometimes.

The likelihood depends heavily on the nature of the failure, the SSD design, whether the data was encrypted, the condition of the flash memory and the resources available to whoever is attempting recovery.

A simple interface or controller fault may present a very different recovery problem from extensive destruction of the memory packages themselves.

This is also why security decisions should be based on the likely threat model.

NIST defines media sanitisation as making access to target data infeasible for a given level of effort, rather than treating sanitisation as an abstract state completely independent of the likely attacker.

Similarly, the NCSC notes that its standard guidance is intended to protect against unauthorised users using commercially available recovery tools or forensic services, while more capable laboratories may present a higher threat.

For organisations handling highly sensitive information, this distinction can materially affect the destruction decision.

Does encryption protect data on a damaged SSD?

Encryption can significantly reduce recovery risk when it has been implemented correctly and the relevant encryption keys remain protected.

However, an organisation should not automatically assume that encryption resolves every disposal concern.

Important questions include:

• Was the entire relevant storage encrypted?
• Was encryption active before sensitive information was written?
• Where were the encryption keys stored?
• Can those keys still be recovered?
• Was the implementation appropriate for the organisation’s security requirements?

NIST SP 800-88 Revision 2 recognises cryptographic erase as a valid sanitisation technique in appropriate circumstances, but it places emphasis on establishing trust in the implementation and securely sanitising the relevant cryptographic keys.

If those conditions cannot be established, physical destruction may still be the more suitable route for damaged media.

Is deleting files from the SSD enough?

No.

Deleting a file normally changes the way the system references the information rather than immediately guaranteeing that every physical copy of the underlying data has been irreversibly removed.

Formatting presents a similar problem.

This issue becomes even more significant on SSDs because internal controller functions can move and remap data independently of the operating system.

The wider question of whether deletion or formatting is sufficient before disposal is covered separately within this blog series.

For a damaged SSD, the practical point is that ordinary file deletion should not be treated as evidence that sensitive information has been securely sanitised.

Why is degaussing not suitable for damaged SSDs?

Because SSDs do not store information magnetically.

A degausser works by applying a strong magnetic field to compatible magnetic storage media such as hard disk drives and magnetic tape.

An SSD stores information in flash memory.

NIST’s media sanitisation guidance states that degaussing should not be used for non-magnetic storage such as flash-based SSDs.

This remains true whether the SSD is working or damaged.

Using a more powerful degausser does not solve the problem because the storage technology itself is different.

Organisations managing mixed storage estates therefore need to distinguish between magnetic and solid-state media before choosing a sanitisation method.

When does physical destruction become appropriate?

Physical destruction becomes particularly important when reliable logical sanitisation cannot be completed or verified.

A damaged SSD illustrates this well.

If the device cannot execute an approved sanitisation process, cannot expose all relevant memory and contains information that must not leave organisational control in recoverable form, physical destruction may provide the more appropriate security outcome.

The NCSC advises organisations to consider destruction for SSDs because reliable sanitisation can be difficult.

The important qualification is that physical destruction must itself be appropriate.

Merely snapping a casing, drilling a single hole or damaging a connector should not automatically be assumed to have destroyed every memory component.

The method needs to address the storage media that actually retains the information.

What should happen to a failed SSD before destruction?

A failed SSD should continue to be treated as sensitive media.

The fact that IT staff can no longer access it should not reduce the security controls applied to it.

Depending on the organisation’s policy and risk level, this may mean:

• recording the SSD in the asset or destruction register;
• restricting access while it awaits processing;
• keeping it in secure storage;
• recording relevant asset identifiers;
• avoiding uncontrolled repair or recovery attempts;
• using an appropriate secure destruction process;
• retaining evidence showing the final outcome.

This approach also helps avoid an awkward governance problem.

If a failed device disappears from normal IT systems because it has been written off but does not immediately enter a controlled destruction workflow, it can fall into a gap between IT asset management and data-security processes.

That gap is precisely where sensitive data-bearing equipment should not be allowed to remain.

What if a damaged SSD is being returned under warranty?

This requires careful assessment because sending the device away may transfer intact or partially intact data outside the organisation’s direct control.

A manufacturer may legitimately require failed hardware to be returned before issuing a replacement, but that commercial process does not automatically resolve the data-security issue.

The organisation should establish whether the device contains sensitive information and whether it can be securely sanitised before return.

If reliable sanitisation is impossible because of the fault, compliance and security teams may need to consider the risks of returning the intact media.

The NCSC identifies repair and vendor return as situations where storage sanitisation may be necessary before equipment leaves organisational control.

For higher-risk data, security requirements may therefore take precedence over the residual financial value of the failed hardware or warranty.

Should a damaged SSD be tested for recoverable data before destruction?

Usually, attempting data recovery simply to establish whether sensitive information is still present can create unnecessary exposure.

A more security-focused approach is to assume that the data may remain unless a reliable sanitisation process has been completed and verified.

That removes the need to prove recoverability experimentally.

The question for compliance teams is not necessarily:

“Can we personally recover anything from this drive?”

It is:

“Can we demonstrate that access to the target information has been rendered infeasible to the level required by our risk assessment?”

That aligns much more closely with the way NIST defines effective media sanitisation.

If that assurance cannot be established, the SSD should continue to be handled as data-bearing media.

Frequently Asked Questions

Can data remain on an SSD after the controller fails?

Potentially, yes. A controller failure may prevent normal access to the drive without necessarily erasing information stored in the flash memory. The device should not be assumed to be securely sanitised simply because it is inaccessible.

Does smashing an SSD make the data unrecoverable?

Not necessarily. The security outcome depends on which components have been destroyed and how thoroughly. Cosmetic or localised physical damage may leave flash memory components intact.

Can damaged SSDs be degaussed?

No. SSDs use non-magnetic flash memory, so degaussing is not an appropriate sanitisation technique for them.

Can an SSD that will not boot still contain personal data?

Yes. Failure to boot or appear normally in a computer does not establish that the stored information has been erased.

Should failed SSDs be thrown away with ordinary electronic waste?

Sensitive data-bearing SSDs should go through the organisation’s approved secure disposal process rather than being discarded solely on the basis that they no longer work.

Treat failure as a hardware condition, not a data-destruction method

The safest assumption is that a damaged SSD may still contain information until an appropriate sanitisation or destruction process demonstrates otherwise.

A drive can be electronically dead, physically damaged or inaccessible through normal software while still retaining data in its flash memory.

That is why equipment failure should never become an accidental substitute for secure destruction.

For organisations handling sensitive or regulated information, failed SSDs should remain within the same controlled disposal framework as working storage media. They should be identified, secured, processed using a method appropriate to solid-state storage and supported by records showing what happened to the asset.

Varese Secure provides secure destruction services for SSDs and other data-bearing media, with on-site and off-site processing available for organisations requiring controlled and auditable disposal.

Phone: 01489 854 131
Email: sales@varese-secure.co.uk
Find out more: https://varese-secure.co.uk/