A Hybrid Machine Learning Method for Secure Assessment of NAND Flash Health and SSD Data Recovery Feasibility

Abstract

NAND flash-based solid state drives (SSDs) are increasingly common in computers, but they present a problem for forensic data recovery. SSDs use controller logic, flash translation layers, error correction, wear leveling, TRIM, garbage collection, and encryption to influence the recoverability of data after being written or erased, which is not the case for hard disk drives (HDDs). In this paper, we propose a machine learning-based method to determine the health of NAND SSDs and their data recoverability. The approach involves telemetry (SMART and NVMe) analysis, subsystems’ interpretation of NAND and controller health, and anomaly detection with the Isolation Forest machine learning algorithm. The task is formulated as a single-class learning problem that takes into account asymmetry, where telemetry from a healthy SSD represents the reference state and NAND degradation, controller instability, TRIM effects, and encryption-related limitations act as asymmetric deviations from this state. The presented method uses telemetry data, such as the temperature, wear level, spare blocks, media and data integrity errors, error logs, unsafe shutdowns, and uptime. This study shows that the potential for data recovery depends on the health of the NAND flash memory and controller, TRIM, encryption, and other anomalies but not necessarily any single SMART metric. The proposed approach provides explainable, data recovery-focused assessment and categorizes the SSD cases as recoverable, partially recoverable, and non-recoverable. The model was trained using a healthy SSD dataset consisting of 56,482 SATA SSD records and 82,665 NVMe SSD records, for a total of 139,147 healthy drive samples. Additionally, 20,000 synthetic training samples were generated for each SSD type to support controlled model training. The proposed platform was evaluated using 30 SSD recovery scenarios, including recovery, partial recovery, and no recovery cases. The results demonstrate that the proposed method can distinguish between healthy, warning, and abnormal SSD states and provide recovery recommendations based on NAND health, controller stability, TRIM status, and encryption limitations.

1. Introduction

Solid state drives (SSDs) play an important role in many computer systems, including laptops, enterprise systems, and high-capacity data centers. This is because of their speed, power efficiency, and reliability, but the increased adoption of SSDs has encouraged several studies on data recovery in computer forensics. Solid state drives (SSDs) are different from hard disk drives (HDDs). This characteristic improves storage performance and reliability but has an impact on SSD analysis in forensic science. As a result, methods developed for HDD analysis cannot be directly transferred to SSDs [1].

The problem with forensic investigations of SSDs is that the availability of data is dependent on several factors, including the physical state of the NAND flash memory and controller operations. NAND memory cells can be affected by several factors, such as wear-out from program and erase operations, charge leakage, bad block accumulation, increases in the raw bit error rate, and degradation due to temperatures. Stability of the controller, remapping and ECC schemes, and internal address translations can also decrease data availability. Even if the NAND memory is physically healthy, logical blocks may be invalid due to deletion, and data may be encrypted and inaccessible without keys.

Lastly, recent research has demonstrated that SSD degradation and failure can be captured using SMART and NVMe metrics such as wear indicators, error counts, bad block counts, and media integrity. Machine learning techniques like anomaly and single-class learning and supervised classification have been shown to be effective for SSD health monitoring and failure prediction [2]. In particular, the approaches don’t typically bring together the NAND degradation parameters with controller stability, TRIM operations, and encryption constraints into a unified model that can be used for recovery. In terms of symmetry and asymmetry, SSD health assessment is inherently an asymmetric diagnostic problem [3].

To overcome this problem, this research presents a hybrid approach with a machine learning algorithm for securely evaluating NAND flash health and data recovery from SSDs. The proposed approach examines SMART and NVMe parameters that reflect wear out, media and data integrity errors, uncorrectable errors, spare block status, programming and erasure failure, temperature, and controller warning status. In particular, an Isolation Forest algorithm is employed to detect anomalous health conditions in an SSD based on multivariate diagnostic data, while a decision layer maps the observed conditions into three NAND states that are relevant to data recovery: NAND Alive, NAND Degrading, and NAND Critical or Dead. This is then further evaluated with controller stability, TRIM status, and encryption restrictions to determine the potential for recovering data from the SSD [4,5].

The key contribution of this study is the development of a data recovery-focused diagnostic system that goes beyond traditional SSD failure prediction and provides intelligent support for forensic analysis. Instead of predicting only the device failure probability, the proposed system estimates the probability of continued data availability and determines a recovery method that may be appropriate under the observed technical conditions. This study also contributes to the asymmetric interpretation of SSD telemetry; the behavior of a healthy drive is modeled as a reference pattern, while deviations caused by NAND wear, controller instability, TRIM activity, encryption limitations, or abnormal error accumulation are interpreted as asymmetric indicators of reduced recoverability. Thus, this study provides a practical link between SSD telemetry analysis, single-class anomaly detection, secure data processing, and data recovery assessment for NAND-based forensic investigations.

Unlike traditional SSD monitoring tools, which primarily report device health or failure risk, the proposed framework focuses on data recovery through forensic analysis. It combines NAND flash health, controller stability, TRIM activity, and the encryption status to classify SSD recovery cases as recoverable, partially recoverable, or unrecoverable.

The rest of this paper is structured as follows. Section 2 reviews related work on SSD data recovery, SSD failure prediction, NAND health indicators, TRIM effects, and machine learning-based SSD diagnostics. Section 3 describes the proposed hybrid method, which includes data collection, NAND health assessment, Isolation Forest-based anomaly detection, mathematical formulation, and recovery feasibility assessment. Section 4 presents the experimental results and discusses the effectiveness of the proposed approach in various SSD recovery scenarios. Section 5 concludes the paper and outlines future research directions.

2. Related Work

2.1. Forensic Challenges of SSD Data Recovery

Solid state drives (SSDs) and hard disk drives (HDDs) differ in their architecture and also in their failure mechanisms. HDD failures are primarily due to mechanical degradation. However, SSD failures are related to NAND memory wear, error accumulation, and controller behavior. Therefore, approaches and methods for determining HDD integrity cannot be applied equally to SSDs [6]. SSDs use NAND flash memory, which is subject to a limited number of program-erase cycles, charge leakage, and progressive wear of memory cells. These processes lead to gradual degradation of stored data and an increase in the error rate during device operation. In addition to NAND wear, SSD reliability is significantly affected by controller behavior and internal control mechanisms. The accumulation of bad blocks, the growth of internal errors, and controller instability can significantly impact data availability and complicate recovery procedures. Several studies report that SSD failures are often associated with a complex interaction between memory degradation and controller-level faults, which differ significantly from the mechanical failure mechanisms observed in HDDs [7]. As device degradation progresses, the likelihood of successful data recovery decreases due to an increase in memory errors and controller instability and the potential loss of logical address mapping. Based on the results obtained from recent reliability and forensics studies, Figure 1 presents a conceptual model illustrating the relationship between SSD degradation and the probability of data recovery [8].

As shown in Figure 1, the likelihood of successful data recovery from SSDs decreases significantly as NAND degradation and controller instability increase. Early stages of degradation are typically associated with memory cell wear and the accumulation of bad blocks, while later stages include controller failures and severe NAND damage, which can lead to irreversible data loss [9]. Previous research suggests that SSD degradation is driven by limited write endurance, charge leakage, and the accumulation of internal errors, which together contribute to a progressive reduction in reliability and, ultimately, device failure [10]. Furthermore, the presence of complex internal control mechanisms, including flash translation layers and controller-based error handling, makes data recovery from degraded SSDs significantly more challenging than from traditional hard drives [11]. These results confirm that SSD degradation should be considered a critical factor affecting the probability of data recovery and highlight the importance of collecting data in the early stages before severe NAND wear and controller failure occur. Recent studies on the TRIM function have shown that data recovery on SSDs is significantly dependent on internal data movement, block invalidation, garbage collection, and the controller’s behavior after file deletion [12].

Existing studies analyzed SSD failures, SMART parameters, and the TRIM function, but little research has focused on forensic analysis of NAND flash memory health before attempting data recovery. Current approaches and tools focus on predicting SSD failures but neglect recovery capabilities [13]. Therefore, a diagnostic model that determines NAND flash memory health and correlates it with recovery probability is an important research challenge.

2.2. SSD Failure Prediction and Recovery Gap

As solid state drives (SSDs) have become a popular storage medium, particularly in modern computing environments, research into SSDs has grown proportionally. SSD diagnostics are influenced by the internal architecture and the underlying mechanisms. These factors collectively impact performance and reliability [14].

Previous studies have shown that SSD degradation and failure can be analyzed using internal telemetry derived from SMART and NVMe logs. Key metrics include the wear level, bad block count, media and data integrity errors, uncorrectable error rate, spare block availability, program and erase failures, temperature, and controller warning conditions. Because these parameters reflect internal degradation processes, they provide a suitable basis for computational modeling of SSD health [15]. Previous studies have also employed threshold-based approaches, statistical reliability analysis, feature selection methods, anomaly detection, one-class learning, and supervised classification. Threshold-based methods are simple and interpretable but are often too stringent for heterogeneous SSD models and may fail to capture patterns of gradual degradation [16].

Recent studies have further demonstrated that machine learning can be effectively applied to SSD monitoring for failure prediction. For example, Chakraborty and Litz proposed one-class Isolation Forest and autoencoder models for SSD failure prediction using telemetry collected from over 30,000 SSDs in Google data centers. Their study showed that SSD failure prediction is highly dependent on class imbalance, feature selection, and the difficulty of detecting previously unseen failure modes. It also confirmed that indicators such as bad block counts, program-erase cycle information, and read errors are useful for distinguishing between healthy and failed SSD states.

Despite these advances, existing SSD analysis methods still primarily focus on reliability monitoring, anomaly detection, and failure prediction. Their applicability to forensic data recovery assessments is limited. In most cases, these approaches are designed to detect anomalous drive behavior or predict failure events, rather than determine whether NAND flash memory remains accessible for successful data recovery [17]. As shown in

Table 1. Limitations of existing SSD methods in forensic data recovery evaluation.

Method or Approach	Advantages	Limitations
1-class anomaly detection	Detects anomalous SSD behavior and works well with imbalanced data.	Focuses on anomaly or failure detection, not on NAND recovery capability; does not address TRIM, encryption, or controller-related recovery limits.
Isolation Forest	Effective for unlabeled anomaly detection in multidimensional SSD telemetry.	Identifies anomalies rather than forensic recoverability; does not explicitly evaluate NAND condition, TRIM, encryption, or controller health.
Supervised classification models (Random forest, neural networks, 2-class SVM)	Learns patterns from labeled telemetry and separates healthy and failed SSD states.	Requires labeled failure data and mainly targets failure prediction, not NAND health assessment or recovery feasibility.
Feature selection methods	Improves accuracy, reduces complexity, and highlights informative indicators.	Useful only as a preprocessing step; does not determine whether data remain accessible or recoverable.
Threshold-based diagnostic rules	Simple and interpretable.	Often too rigid for different SSD models and do not capture combined effects of NAND degradation, controller instability, TRIM, or encryption.

, existing methods only consider individual aspects of SSD degradation and do not integrate NAND health, controller stability, TRIM activity, or encryption limitations into a unified assessment framework focused on data recovery.

Previous studies on SSD health assessment typically define health using SMART alert thresholds, manufacturer-specific health indicators, anomaly scores, failure probabilities, or binary “healthy or failed” labels. However, these health values are primarily intended for reliability monitoring and failure prediction. Direct numerical comparison with the health values in this study is limited, as the proposed framework uses a normalized health assessment derived from machine learning, along with NAND health, controller health, TRIM status, and encryption limitations. Therefore, the health value in this study is interpreted not only as a technical health indicator but also as part of a recovery-oriented forensic analysis.

In practical forensic scenarios, data recovery from SSDs depends on a combination of NAND flash memory health, controller stability, logical mapping availability, TRIM functionality, and encryption mechanisms. These factors were rarely considered together in previous SSD research. Therefore, a clear research gap remains between SSD failure prediction and data recovery-focused forensic assessment. Although existing methods can be applied to SSD failure detection, they do not provide a unified system for determining whether data recovery is possible given the combined effects of NAND degradation, controller behavior, TRIM, and encryption [18]. To address this issue, this study proposes a hybrid machine learning framework that combines monitoring-based anomaly detection with recovery-focused forensic interpretation to assess NAND flash memory health and the feasibility of data recovery from SSDs.

Although several new non-volatile memory technologies, such as RRAM, MRAM, PCM, and other memory types, are actively being researched, NAND flash memory remains the dominant data storage technology in commercial SSDs and modern storage systems [6]. Therefore, this study focuses on NAND flash-based SSDs, where data recovery is significantly dependent on NAND wear, erase operations, controller behavior, TRIM, garbage collection, and encryption mechanisms.

2.3. NAND Health Indicators

NAND flash memory degradation is caused by multiple interacting factors, including wear from program-erase cycles, error accumulation, spare block depletion, and thermal instability. These factors directly impact SSD reliability and, consequently, the likelihood of successful data recovery. Previous studies have shown that SMART and NVMe telemetry provide useful low-level indicators for monitoring SSD health, including wear level, media and data integrity errors, uncorrectable errors, spare block availability, and controller warning conditions.

Because individual indicators describe only specific aspects of SSD health, previous studies have emphasized the importance of multivariate telemetry analysis rather than isolated interpretation based on thresholds. In this context, machine learning-based anomaly detection has attracted particular interest. Machine learning algorithms such as Isolation Forest are well suited for SSD monitoring, as healthy drives are abundant, and serious failures are relatively rare [19]. This makes anomaly detection a promising approach to identifying abnormal SSD states and supporting more adaptive state estimation under heterogeneity.

The metrics presented in

Table 2. SMART and NVMe diagnostic indicators used for NAND flash condition assessment.

Indicator	Source (SMART or NVMe)	Relevance to NAND Viability
Percentage Used or Wear Level	NVMe SMART log or SATA SMART	Program-erase cycles consumed and overall NAND memory wear. High values indicate serious deterioration.
Media and Data Integrity Errors	NVMe SMART log	Reflects read and write errors. An increase in the number of errors indicates wear on memory cells and reduced data availability.
Uncorrectable Error Count	SMART attribute	Indicates errors that cannot be corrected by ECC mechanisms.
Available Spare Blocks	NVMe SMART log	Shows the remaining reserve of spare memory blocks used to replace failed cells. Low spare block availability indicates critical NAND memory wear.
Program Fail Count	SMART attribute	Reflects failures that occur during the programming process. Frequent failures indicate memory cell instability.
Erase Fail Count	SMART attribute	Indicates failed erase operations due to NAND cell wear. High values indicate cell is approaching end of life.
Temperature	SMART or NVMe log	Elevated temperatures accelerate charge leakage and oxide degradation, increasing the likelihood of NAND memory failure and data loss.

form the basis for evaluating NAND flash memory performance. By analyzing these parameters together, one can determine the performance and suitability of NAND flash memory for data recovery [20]. The table shows that existing SSD analysis methods only consider individual aspects of degradation, anomaly detection, or failure prediction. While these approaches provide valuable diagnostic information, they do not integrate the NAND state, controller behavior, TRIM activity, or encryption limitations into a unified assessment system focused on data recovery [21]. Therefore, a dedicated approach is needed to evaluate SSD health specifically for data recovery potential for forensic purposes.

3. Method

3.1. Data Collection and Model Training

To train the anomaly detection module, real-world Self-Monitoring, Analysis, and Reporting Technology (SMART) data was collected from an open-source repository hosted on GitHub [22]. This repository contains smartctl output files contributed by Linux users worldwide and covers a wide range of SSD manufacturers and models. The dataset includes data collected from SSDs from over 300 manufacturers, including major vendors such as Samsung, SanDisk, Kingston, Crucial, Western Digital, Intel, Micron, SK Hynix, Toshiba, KIOXIA, Seagate, Corsair, ADATA, Transcend, and Lenovo, as well as numerous regional and OEM brands. This broad coverage increases the specificity of the collected data and supports model generalization to a diverse set of consumer and enterprise SATA SSDs. The collected data was used to create a reference dataset of healthy drives for SATA and NVMe SSDs. The files were filtered by two criteria. First, each drive had to report a SMART health self-assessment result of PASS. Second, the critical error-related attributes, including reallocated sectors, pending sectors, uncorrectable errors, program failure count, and erase failure count, had to be zero. After filtering, the final dataset consisted of 56,482 healthy SATA SSD records and 82,665 healthy NVMe SSD records, for a total of 139,147 healthy drive samples.

The dataset in this study was compiled to support the detection of a single class of anomalies, with healthy SSD telemetry (SSD healthy state reporting) serving as the reference (normal behavior) in this study, as summarized in

Table 3. Composition of the SSD dataset used in this study.

Dataset Component	SSD Type	Number of Samples	Purpose
Healthy SMART records	SATA SSD	56,482	Used as healthy reference data for SATA SSD behavior.
Healthy SMART and NVMe records	NVMe SSD	82,665	Used as reference data to evaluate the performance of NVMe SSDs.
Total healthy records	SATA + NVMe	139,147	Used to construct the one-class learning baseline of normal SSD health.
Synthetic training samples	SATA SSD	20,000	Created using properties of healthy SATA SSD records for controlled one-class training.
Synthetic training samples	NVMe SSD	20,000	Generated from statistical properties of healthy NVMe SSD records for controlled model training.
Recovery scenarios	Mixed SSD cases	30	Used to assess the possibility of recovery in conditions of possible, partial, and impossible recovery.

. Separate records were selected for the SATA and NVMe drives because they contained different diagnostic attributes and state reporting mechanisms.

The size and diversity of the benchmark dataset demonstrate the generalizability of the proposed framework. The dataset included telemetry data from SSDs, both SATA and NVMe, from over 300 manufacturers. Furthermore, different Isolation Forest models were trained for the SATA and NVMe SSDs, accounting for differences in diagnostic attributes and status reporting. The resulting design minimizes dependency on a specific SSD manufacturer, device family, and interface, making the proposed method more applicable to heterogeneous SSD systems.

In this paper, the module was based on the Isolation Forest anomaly detection algorithm. This algorithm was chosen due the number of labeled failed drive samples being limited and SSD telemetry being inherently unbalanced. This study utilized the Isolation Forest machine learning algorithm for unsupervised anomaly detection. This algorithm was chosen because it does not require labeled failed drive samples. Instead, it learns the statistical profile of healthy SSDs and identifies deviations from this profile as anomalous behavior. Therefore, the task was to detect single-class anomalies, where the model examined the normal behavior of healthy SSDs and identified significant deviations as abnormal states.

The model was trained exclusively on healthy drive samples using the following parameters. The number of estimators was set to 200, the pollution factor was fixed at 0.05, and the random state was set to 42. To support model training under controlled conditions, Monte Carlo simulation was used to generate synthetic samples based on statistical properties extracted from the collected healthy drive dataset, including the median and 95th percentile values of selected diagnostic attributes. A total of 20,000 synthetic samples were generated for the SATA SSDs, and 20,000 were generated for the NVMe SSDs.

To ensure interpretability, the deviations obtained by the trained model were normalized to a percentage of health on a scale from 0 to 100. Values above 70% were interpreted as healthy behavior, values between 40% and 70% indicated a worrisome state, and values below 40% indicated abnormal behavior.

3.2. Proposed Method for Diagnosing NAND Memory

The primary objective of the proposed method is to determine the health of NAND flash memory and its ability to access stored data. Unlike traditional reliability prediction approaches, which estimate the device’s service life, this method focuses on assessing NAND flash memory health in the context of data recovery.

NAND flash memory viability is defined as the ability of memory cells to reliably store and retrieve data during read operations. If NAND flash memory degrades critically or stops responding, then data recovery becomes technically impossible because the physical storage medium containing the original data becomes inaccessible.

Based on the analysis of SMART and NVMe indicators, the health of NAND memory is classified into three categories:

• NAND Alive, where memory cells remain functional and data can be accessed;
• NAND Degrading, where memory is subject to significant wear and tear and accumulation of errors, which reduces the likelihood of their recovery;
• NAND Critical or Dead, where memory is severely damaged or unresponsive, making recovery impossible.

To comprehensively assess the feasibility of data recovery from SSDs, this study proposes an integrated diagnostic system that evaluates the health of NAND flash memory, taking into account controller characteristics and storage limitations.

The proposed method combines two parallel analytical approaches. The first approach focuses on assessing the physical health of NAND flash memory using SMART and NVMe diagnostic indicators, as well as a logic-based health model. The second approach analyzes controller-related parameters, including encryption mechanisms and TRIM functionality, which directly impact data recovery even with operational NAND flash memory. The combination of these two analytical approaches allows for a more accurate and realistic assessment of the potential for data recovery from SSDs. The general algorithm of the proposed method is shown in Figure 2.

As shown in Figure 2, the diagnostic process begins with SMART or NVMe log data retrieved with a single terminal command. The first analytical branch evaluates the health of the NAND flash memory, extracting key health indicators such as the wear level, media errors, spare block availability, and temperature. These parameters are processed using a logic inference model to calculate a NAND health index and classify the memory state as healthy, degrading, or critical.

The second analytical branch evaluates controller-related limitations that may impact data availability, including hardware encryption mechanisms and TRIM functionality. Even if the NAND memory remains healthy, the presence of active encryption or TRIM operations can significantly reduce the likelihood of successful data recovery.

The proposed system makes an important distinction between the technical health of an SSD and the feasibility of data recovery through forensic analysis. A drive may be technically healthy in terms of performance or reliability if the NAND memory and controller are functioning normally, and the SMART and NVMe indicators do not report critical errors. However, such a drive may still offer limited data recovery capabilities if TRIM has invalidated deleted logical blocks or if hardware encryption prevents access to user data without the appropriate key. Therefore, the proposed system does not treat SSD health and recovery capability as identical concepts.

In the proposed system, data recovery is determined by a combination of four key factors: NAND flash memory state, controller stability, TRIM activity, and encryption status. The NAND flash memory state determines whether physical memory cells remain readable, while controller stability determines whether the flash translation layer and logical address translation remain functional. TRIM activity influences whether deleted logical blocks are recoverable, while encryption status determines whether recovered data can be interpreted without the corresponding key. Thus, data recovery is determined not by a single SMART or NVMe attribute but by the combined influence of physical, controller-level, and logical conditions.

The proposed decision-making process first evaluates the NAND and controller health to determine whether the physical storage media and address translation mechanisms remain functional. TRIM health and encryption status are then analyzed as forensic constraints. If the NAND and controller health are normal but TRIM is active, then the system can classify the device as technically healthy, limiting recovery to partial recovery, as the deleted data may be inaccessible. Similarly, if encryption is active, and the required key is unavailable, then the drive may remain functional. However, forensic interpretation of the recovered NAND contents may be limited. This distinction allows the system to distinguish between a healthy SSD and a state with limited recoverability.

The results of both branches are combined into a single decision module that determines the overall feasibility of data recovery. This integrated approach enables a preliminary forensic assessment before initiating complex recovery procedures and reduces unnecessary recovery attempts in cases where the NAND memory has critically degraded or is unavailable.

3.3. Machine Learning-Based Assessment of NAND Flash Viability

NAND flash memory degradation is a gradual and nonlinear process influenced by multiple interacting factors, including the wear level, error accumulation, spare block availability, and thermal conditions. These factors vary across SSD models and manufacturers and do not always follow rigid threshold behavior. Therefore, conventional binary or threshold-based diagnostic approaches are insufficient for accurately determining NAND flash viability in the context of forensic data recovery.

To address this challenge, the proposed method applies a machine learning-based approach for assessing the condition of NAND flash memory. Instead of relying on manually defined rules, the model learns degradation patterns from diagnostic indicators extracted from SMART and NVMe logs. This enables the system to capture complex relationships among multiple SSD health parameters and to provide a more flexible assessment of the NAND condition under varying operating states.

A machine learning model based on the Isolation Forest anomaly detection algorithm is used to assess the health of NAND flash memory. As mentioned earlier in the article, this algorithm was chosen due to the differences in SSD telemetry data; records of healthy SSDs are relatively numerous, while the number of flagged faulty SSD samples is smaller. Therefore, the assessment task was formulated as a single-class anomaly detection problem. In this approach, the model learns the normal telemetry pattern of healthy SSDs and identifies significant deviations from this pattern as abnormal conditions.

The Isolation Forest model uses SMART and NVMe diagnostic features related to NAND reliability, including the wear level, media and data integrity errors, uncorrectable errors, available spare blocks, programming failure count, erase failure count, temperature, and controller warning indicators. These features are normalized before being processed by the model to reduce the influence of different numerical scales. The model’s output is then converted into a normalized health metric and interpreted using diagnostic rules specific to NAND.

Based on machine learning results and NAND-specific metrics, the SSD’s health was classified into three recovery states: NAND Alive, NAND Degrading, and NAND Critical or Dead. Consequently, the Isolation Forest model was used as part of a hybrid diagnostic system that combines anomaly detection with forensic interpretation of NAND health and SSD data recovery capabilities.

The input feature set includes key indicators associated with NAND reliability, such as the wear level, media and data integrity errors, uncorrectable error count, available spare blocks, program fail count, erase fail count, temperature, and controller warning flags. These parameters were first normalized and then used as input to the classification model. Based on the learned feature patterns, the model assigns NAND flash memory to one of three diagnostic categories: NAND Alive, NAND Degrading, or NAND Critical or Dead.

The NAND Alive class indicates that the memory cells remain operational and that stored data is likely to be accessible for further recovery procedures. The NAND Degrading class reflects significant wear and error accumulation, suggesting reduced recovery probability and increased forensic complexity. The NAND Critical or Dead class indicates severe degradation or non-responsiveness of NAND memory, in which case successful data recovery becomes highly unlikely or technically impossible.

The proposed model is intended to support forensic pre-assessment rather than merely predict device failure. In this study, NAND flash viability is evaluated as a recovery-oriented diagnostic state derived from internal SSD health indicators. This allows the framework to move beyond conventional reliability prediction and toward practical estimation of data recovery feasibility.

Figure 3 illustrates the general workflow of the proposed machine learning-based NAND viability assessment. Diagnostic indicators extracted from SMART and NVMe logs are preprocessed and normalized before being used as input to the classification model. The resulting NAND health state is then integrated with controller-related constraints in order to estimate recovery feasibility.

It should be noted that the recovery probability shown in Figure 3 is not a directly measured, continuous experimental value. In practical forensic recovery, an exact numerical probability is difficult to obtain because recovery results depend on numerous uncontrollable factors, including the controller behavior, FTL mapping availability, TRIM execution, encryption state, NAND error distribution, and forensic extraction quality. Therefore, the probability values in Figure 3 should be interpreted as conceptual and recovery-oriented feasibility levels, rather than as precisely measured probabilities. In experimental evaluation, these feasibility levels are represented by categorical results: recoverable, partially recoverable, and non-recoverable.

To further interpret the results of the proposed diagnostic model, a scenario-based evaluation of data recovery feasibility was performed. The analysis considers the combined influence of NAND flash memory health, controller stability, TRIM status, and encryption mechanisms. These parameters represent the most critical technical factors affecting the possibility of successful data extraction from SSD devices.

NAND flash memory health reflects the physical integrity of memory cells and their ability to reliably retain and return stored information during read operations. Controller status determines whether the flash translation layer (FTL) and internal management mechanisms remain operational. Even when NAND memory is physically intact, controller failure may prevent logical address translation, significantly complicating data recovery.

In addition, modern SSD technologies introduce further constraints for forensic analysis. The TRIM command may permanently invalidate previously deleted logical blocks, while hardware encryption mechanisms can prevent direct interpretation of NAND memory contents without access to the corresponding keys. Therefore, these factors must be considered when estimating the probability of successful recovery.

The final recovery category is calculated by taking four sets of diagnostic factors into consideration: NAND health, controller stability, TRIM activity, and encryption status. The NAND health value indicates whether the physical Flash memory cells are readable, and controller stability will tell if the FLASH translation layer and logical address translation mechanisms are working. The activity status of TRIM and the presence or absence of encryption in the SSD is then used as a forensic constraint that can impact the recoverability of the SSD even if it is physically operational.

When the NAND flash memory is considered NAND Alive, the controller is stable, TRIM is not enabled or does not impact the target data, and encryption is not enabled, or the needed key is offered. Logical file system analysis or standard recovery techniques are likely to be possible in this situation. An SSD is considered to be partially recoverable if the NAND memory is still usable to some degree, but the degree of recovery is restricted by the degradation of the NAND, the instability of the controller(s) or active TRIM, or encryption limitations. In these instances, only data that can be accessed now or certain portions of that data may be recovered, and sophisticated techniques like chip-off analysis, NAND dump analysis, or TRIM-aware recovery can be necessary.

When any of the following conditions hold, the SSD is considered non-recoverable; NAND flash memory is critical or unresponsive, the controller has failed, making logical address translation not available, TRIM has removed the corresponding deleted blocks, or the data cannot be interpreted without the proper key because of encryption. Therefore, the proposed framework is not based on one SMART or NVMe value to determine recovery feasibility. Rather, it integrates the viability of physical NAND, the accessibility of the controller level, and security or control restrictions to yield the overall recovery conclusion.

Table 4. Predicted recovery feasibility under different NAND flash and controller conditions.

NAND Health Condition	Controller Status	TRIM Status	Recovery Probability	Recommended Recovery Method
NAND Alive	Stable	Disabled	High	Logical recovery/filesystem analysis
NAND Alive	Stable	Enabled	Moderate	Logical recovery with TRIM-aware analysis
NAND Degrading	Stable	Disabled	Moderate	Chip-off/NAND dump analysis
NAND Degrading	Unstable	Disabled	Low	Advanced NAND reconstruction
NAND Critical or Dead	Stable	Disabled	Extremely low	Limited recovery attempts
NAND Critical or Dead	Failed	Any	Near zero	Recovery technically impossible

summarizes the predicted recovery feasibility under different NAND degradation levels and controller conditions.

As shown in Table 4, the feasibility of SSD data recovery depends strongly on the physical condition of the NAND flash memory and the operational state of the SSD controller. When both components remain functional, the probability of successful recovery is highest because stored data can still be accessed through normal controller operations and logical address translation mechanisms.

However, when NAND degradation increases or controller instability occurs, the probability of successful recovery decreases significantly. In such cases, advanced forensic techniques such as chip-off extraction or NAND-level reconstruction may be required. If both the NAND flash memory and the controller fail, then data recovery becomes technically impossible because the original storage medium can no longer be accessed or interpreted.

These results confirm that reliable assessment of NAND health and controller status is essential before initiating complex forensic recovery procedures. The proposed machine-learning-based diagnostic approach enables preliminary evaluation of recovery feasibility, helping investigators avoid unnecessary recovery attempts and select appropriate forensic methods.

3.4. Mathematical Formulation of Isolation Forest-Based SSD Health Assessment

In addition to rule-based interpretation of SMART and NVMe telemetry, the proposed framework incorporates a machine learning module for anomaly detection based on Isolation Forest. The role of this module is to learn the statistical profile of healthy SSD operation and to identify drives whose observed telemetries deviate from this normal behavior. This approach is particularly appropriate for SSD diagnostics because the available data is inherently imbalanced. In such conditions, one-class learning is more suitable than conventional supervised classification, since the model can be trained exclusively on healthy device observations and later used to detect abnormal deviations. This idea is consistent with prior SSD failure prediction studies, which showed that the one-class Isolation Forest is effective for detecting previously unseen failure patterns in highly imbalanced telemetry data.

The rationale for formulating SSD evaluation as a single-class learning problem is based on drive telemetry. In real-world settings, telemetry from healthy SSDs is more abundant, structured, and easier to collect. However, data from degraded or failed drives with corresponding SSD degradation labels is rare. Such data is also heterogeneous and can manifest differently, depending on the NAND type, controller design, firmware, workload history, TRIM behavior, and encryption state. Therefore, creating a complete and balanced dataset for supervised learning that represents all possible degradation states is a challenging task.

For this reason, telemetry from healthy SSDs was considered a reference state for normal drive behavior. The Isolation Forest model learns this normal telemetry profile and identifies observations that deviate from it as anomalous. Such deviations are considered asymmetric because degradation does not occur as a homogeneous opposite class to healthy behavior. Instead, it can only affect a subset of diagnostic metrics, such as the wear level, media errors, available spare blocks, unsafe shutdowns, error log entries, or controller-related warnings. This makes single-class anomaly detection suitable for SSD health assessment, as the model does not require exhaustive examples of all failure modes and can detect previously unseen deviations from the reference healthy profile.

The asymmetry between the telemetry of healthy and degraded SSDs justifies the use of single-class anomaly detection. Records of healthy SSDs are more structured and accessible, while degraded states are rare, heterogeneous, and can result from various combinations of NAND wear, controller instability, TRIM activity, or encryption limitations. Consequently, the behavior of a degraded SSD cannot be reliably represented as a single, balanced, opposite class. By using telemetry from healthy SSDs as a reference state, Isolation Forest can detect significant deviations that may indicate deterioration of the NAND or limited recovery capabilities.

The details of the Isolation Forest model configuration used in this study are provided in

Table 5. Configuration details of the Isolation Forest model used in this study.

Configuration Item	Description or Value
Machine learning algorithm	Isolation Forest
Learning strategy	One-class anomaly detection
Training data	Healthy SSD telemetry samples only
SSD-specific models	Separate models were trained for SATA and NVMe SSDs
SATA input features	10 features: temperature, reallocated sectors, power-on hours, wear level, program fail, erasure fail, uncorrectable errors, command timeout, pending sectors, and CRC errors
NVMe input features	7 features: temperature, available spare, percentage used, media errors, error log entries, unsafe shutdowns, and power-on hours
Feature normalization	StandardScaler and z-score normalization
Number of estimators	200
Contamination factor	0.05
Random state	42
Model output	Raw anomaly score, binary anomaly label, normalized health score, and final machine learning verdict
Health score range	0–100
Health interpretation	Healthy: $H_{ML}\ge 70$; warning: $40\le H_{ML}<70$; anomaly: $H_{ML}<40$

. These parameters determined the training strategy, input features, preprocessing method, and output data interpretation used in the proposed SSD health assessment system.

This configuration was chosen to support anomaly detection in the presence of unbalanced SSD telemetry, where there is a large number of healthy writes but a limited number of flagged bad drive samples.

To reduce the risk of overfitting, the model was formulated as a single-class anomaly detection system. The Isolation Forest model was trained only on telemetry from healthy SSDs, allowing it to learn a general profile of normal SSD behavior rather than memorizing specific failure cases. Separate models were developed for SATA and NVMe SSDs, and all input characteristics were normalized using StandardScaler to reduce the impact of different numerical scales between SMART and NVMe attributes. Furthermore, model complexity was controlled using 200 evaluations and a fixed pollution factor of 0.05. The final recovery decision was based not only on the machine learning results but also on an assessment based on NAND health rules, controller stability, TRIM status, and encryption constraints.

The proposed system comprises two Isolation Forest models: one for SATA SSDs and another for NVMe SSDs. This is because the two classes have different diagnostic features and internal health reporting systems. The implementation shows that the SATA model was trained with a 10-dimensional feature vector

$${\mathbf{x}}^{\left(\mathrm{SATA}\right)}={[x_1,x_2,\dots ,x_{10}]}^{\top },$$

(1)

defined as

$$\begin{array}{c}{\mathbf{x}}^{\left(\mathrm{SATA}\right)}=[\mathtt{temperature},\mathtt{reallocated}\_\mathtt{sectors},\mathtt{power}\_\mathtt{on}\_\mathtt{hours},\mathtt{wear}\_\mathtt{level},\mathtt{program}\_\mathtt{fail},\\ {\mathtt{erase}\_\mathtt{fail},\mathtt{uncorrectable}\_\mathtt{errors},\mathtt{command}\_\mathtt{timeout},\mathtt{pending}\_\mathtt{sectors},\mathtt{crc}\_\mathtt{errors}]}^{\top }.\end{array}$$

(2)

For NVMe SSDs, a separate seven-dimensional feature vector was used:

$${\mathbf{x}}^{\left(\mathrm{NVMe}\right)}={[x_1,x_2,\dots ,x_7]}^{\top },$$

(3)

where

$$\begin{array}{c}{\mathbf{x}}^{\left(\mathrm{NVMe}\right)}=[\mathtt{temperature},\mathtt{available}\_\mathtt{spare},\mathtt{percentage}\_\mathtt{used},\mathtt{media}\_\mathtt{errors},\\ {\mathtt{error}\_\mathtt{log}\_\mathtt{entries},\mathtt{unsafe}\_\mathtt{shutdowns},\mathtt{power}\_\mathtt{on}\_\mathtt{hours}]}^{\top }.\end{array}$$

(4)

These feature definitions were stored explicitly in the model metadata and reused during inference, ensuring consistency between training and deployment.

The feature vectors were standardized with z-score normalization before training. For each feature $x_j$, the transformed variable $z_j$ was computed as follows:

$$z_j={\displaystyle \frac{x_j-{\mu }_j}{{\sigma }_j}},$$

(5)

where ${\mu }_j$ and ${\sigma }_j$ denote the mean and standard deviation estimated from the healthy training data, respectively. In vector form, the transformation can be written as follows:

$$\mathbf{z}=\mathrm{StandardScaler}\left(\mathbf{x}\right).$$

(6)

This was achieved using the StandardScaler class, which is applied during model training and during inference with new SSD observations. Normalization is required because SMART and NVMe features are measured in different numerical ranges, and anomaly detection is more robust when features are standardized (centered and scaled) prior to training the model.

The model was trained with healthy drive data. Currently, training samples are simulated from a statistical reference dataset containing healthy SMART and NVMe features. For SATA SSDs, temperature is generated from a normal distribution parameterized according to empirical median and percentiles, reallocated sectors are mostly fixed at zero, power-on hours follow an exponential-type distribution, and key NAND-specific attributes are fixed at zero. Likewise, for NVMe devices, the healthy samples are drawn from the empirical distributions of temperature, available spare, percentage used, unsafe shutdowns, and power-on hours, with media_errors set to zero for healthy samples. In this implementation, we generated 20,000 training samples for SATA SSDs and 20,000 for NVMe SSDs.

Let the healthy training set be denoted as

$${\mathcal{D}}_{\mathrm{healthy}}={\left\{{\mathbf{x}}_i\right\}}_{i=1}^N,$$

(7)

where N is the number of healthy training instances. The Isolation Forest model is then fitted on the standardized data:

$$\mathcal{M}=\mathrm{IForest}({\left\{{\mathbf{z}}_i\right\}}_{i=1}^N;T,\alpha ),$$

(8)

where T is the number of trees and $\alpha$ is the contamination parameter. In the implemented model, the number of estimators was set to $T=200$, while the contamination level was fixed at $\alpha =0.05$. The contamination parameter represents the expected proportion of anomalous observations and is used by the model to define its decision threshold.

Isolation Forest is an anomaly detection algorithm that relies on the fact that anomalous points are “few and different”, and thus they can be isolated by fewer random partitions than normal points. Essentially, the method splits the feature space by random feature and random threshold. Anomalous points are those that reach short average path lengths in the forest, while normal points are those that are not separated from other points. This is appealing for SSD diagnostics, as the method does not rely on a specific parametric distribution assumption of the telemetry data and can accommodate for heterogeneous multivariate data. Previous works on anomaly detection and SSD failure prediction have stressed this feature of one-class Isolation Forest in ever-changing environments with new types of failures. Given an observation of the SSD, the model outputs two things. First, it predicts a continuous anomaly score:

$$s_{\mathrm{raw}}=f_{\mathrm{IF}}\left(\mathbf{z}\right),$$

(9)

where $f_{\mathrm{IF}}(·)$ corresponds to the score_samples function of the fitted Isolation Forest. Second, it produces a binary prediction

$$y=\left\{\begin{array}{cc}1,\hfill & \mathrm{normal}\mathrm{observation},\hfill \\ -1,\hfill & \mathrm{anomalous}\mathrm{observation}.\hfill \end{array}\right.$$

(10)

In the implementation, the label $y=-1$ indicates that the drive behavior is considered anomalous by the machine learning model.

To improve interpretability, the raw anomaly score is transformed into a normalized health score on a 0–100 scale. Let $s_{\min }$ and $s_{\max }$ denote the lower and upper score bounds estimated from the training process. Then, the normalized ML health score is computed as follows:

$$H_{\mathrm{ML}}=100·{\displaystyle \frac{s_{\mathrm{raw}}-s_{\min }}{s_{\max }-s_{\min }}}.$$

(11)

The resulting value is clipped to the interval $[0,100]$:

$$H_{\mathrm{ML}}=\min \left(100,\max (0,H_{\mathrm{ML}})\right).$$

(12)

According to the stored model metadata, the SATA model uses the score interval

$$s_{\min }^{\left(\mathrm{SATA}\right)}=-0.7340902912,s_{\max }^{\left(\mathrm{SATA}\right)}=-0.3584426948,$$

(13)

whereas the NVMe model uses

$$s_{\min }^{\left(\mathrm{NVMe}\right)}=-0.7110966122,s_{\max }^{\left(\mathrm{NVMe}\right)}=-0.3698818151.$$

(14)

Thus, higher score values correspond to healthier drives, while lower values indicate increasingly anomalous behavior.

The normalized machine learning health score is then mapped to a qualitative verdict:

$${\mathrm{Verdict}}_{\mathrm{ML}}=\left\{\begin{array}{cc}\mathtt{healthy},\hfill & H_{\mathrm{ML}}\ge 70,\hfill \\ \mathtt{warning},\hfill & 40\le H_{\mathrm{ML}}<70,\hfill \\ \mathtt{anomaly},\hfill & H_{\mathrm{ML}}<40.\hfill \end{array}\right.$$

(15)

This conversion makes the anomaly detector easier to interpret in forensic and engineering settings, because the output is not limited to a binary label but also provides a continuous estimate of how far the current SSD state deviates from the learned healthy profile.

From a methodological point of view, the ML part of the proposed framework can therefore be summarized as the following pipeline:

$$\mathbf{x}\to \mathbf{z}\to s_{\mathrm{raw}}\to H_{\mathrm{ML}}\to {\mathrm{Verdict}}_{\mathrm{ML}}.$$

(16)

Here, $\mathbf{x}$ is the extracted SMART or NVMe feature vector, $\mathbf{z}$ is its standardized representation, $s_{\mathrm{raw}}$ is the Isolation Forest anomaly score, $H_{\mathrm{ML}}$ is the normalized health score, and ${\mathrm{Verdict}}_{\mathrm{ML}}$ is the final machine learning label.

While the ML part is key to anomaly detection, it is not used on its own. In the proposed framework, the ML results are complemented by explicit rule-based scoring for NAND health and controller health. The NAND score is based on indicators such as reallocated sectors, uncorrectable errors, program failures, erase failures, media errors, depletion of available spares, and wear counters; the controller score is based on indicators such as critical warnings, error log entries, CRC errors, command timeouts, and pending sectors. As a result, the overall system should be viewed as a hybrid SSD diagnostic system, rather than a pure ML classifier. The ML component captures multivariate anomalies in behavior, while the forensic rules provide insight into the probable cause and its implications for data recovery.

This combination is advantageous for SSD forensics. Isolation Forest offers flexibility and responsiveness to anomalous telemetry even when failure data is unavailable, while the rule-based component ensures interpretability and establishes direct connections between detected anomalies and NAND and controller health, encryption compatibility, and recoverability. Therefore, the proposed method combines the strengths of data-driven anomaly detection and domain-specific forensic interpretation in a unified SSD health assessment framework.

4. Results

The platform was developed using Python 3.13 as the primary programming language. Machine learning was performed using the scikit-learn 1.6 library, which provides an Isolation Forest implementation (sklearn.ensemble.IsolationForest). Feature normalization was performed using sklearn.preprocessing.StandardScaler. Numerical computations and the generation of synthetic training samples were performed using NumPy. Trained models were serialized and saved to the disk using the joblib library (model.pkl), enabling offline inference without retraining. SMART data analysis was performed using Python’s built-in regular expression (re) module, which extracts numerical attribute values from smartctl raw output in various formats and from different vendors.

Figure 4 presents the input interface of the proposed SSD diagnostic system. The prototype is designed to accept raw SMART and NVMe telemetry collected using the smartctl utility. To improve usability across different operating systems, the interface provides predefined command examples for Linux, macOS, and Windows PowerShell, including both SATA and NVMe devices. The collected output can be pasted directly into the input area and processed by the analysis module. This stage represents the entry point of the proposed diagnostic workflow and demonstrates that the developed method can be applied through a practical software interface rather than only as a theoretical model.

The interface shown in Figure 4 represents the input stage of the proposed SSD diagnostic workflow. At this stage, the user provides raw SMART or NVMe telemetry obtained from the smartctl utility. The interface supports multiple operating systems and device types by displaying example commands for Linux, macOS, and Windows PowerShell, including both SATA and NVMe SSDs. This design improves usability and reduces the effort required to collect diagnostic information. After the telemetry is pasted into the input field, the analysis module can be executed to perform further health assessment of the SSD.

To illustrate the output generated by the proposed diagnostic framework, Figure 5 presents an example of the subsystem-level and machine learning-based assessment results for an SSD classified as healthy. The interface displays separate evaluations of NAND memory and controller condition, together with the result of the Isolation Forest module. This representation was designed to provide both technical detail and interpretability, allowing the user to understand the final status of the drive but also the specific factors that contributed to the diagnostic conclusion.

As shown in Figure 5, the NAND assessment reported a score of 100/100, indicating that no NAND-related issues were detected. Similarly, the controller assessment also produced a score of 100/100, suggesting the absence of controller-level faults or interface-related problems. The machine learning module confirmed this conclusion by assigning a health score of 97.7%, classifying the drive as consistent with healthy SSD patterns. The displayed feature values further support this interpretation, since all critical degradation-related indicators, such as reallocated sectors, program failures, erasure failures, uncorrectable errors, pending sectors, and CRC errors, remained at zero. Overall, this result demonstrates that the proposed framework can provide a coherent and interpretable diagnostic output by combining rule-based subsystem evaluation with anomaly-based machine learning analysis. To demonstrate the recovery-oriented output of the proposed framework, Figure 5 presents an example in which the SSD was classified as allowing only partial data recovery. In this case, the system indicated that the NAND memory and controller remained operational, which means that the currently stored data was physically preserved. However, the TRIM zeroed condition was detected, implying that deleted files had most likely been physically erased by the SSD controller and therefore could not be recovered by standard software-based methods.

As shown in Figure 6, the system reported the status “Partial Recovery Possible” and provided a set of practical recommendations. These recommendations include immediately stopping write operations, creating a forensic disk image, and performing recovery attempts only on the image copy rather than on the original device. The interface also suggests standard recovery tools, such as TestDisk, PhotoRec, and R-Studio, for extracting the still-accessible data. The result demonstrates that the proposed framework not only assesses SSD health but also translates the technical state of the NAND, controller, and TRIM behavior into an interpretable recovery-oriented conclusion for the user.

In another case, Figure 7 shows the results of testing a faulty SSD using the proposed machine learning-based diagnostic and assessment system. The machine learning module identified the faulty drive as abnormal, indicating a significant difference in its diagnostic profile from the normal behavior studied on healthy SSD samples. The model was trained using seven key diagnostic features and a benchmark dataset consisting of 56,482 SATA SSD samples and 82,665 NVMe SSD samples.

The analysis revealed an overall SSD health score of 18.2%, indicating critical degradation. While some NAND-related metrics, such as the available spares of 100, percentage used of zero, and media errors of zero, showed no direct signs of NAND wear or media-level failures, the controller parameters revealed serious issues. Specifically, the system detected 158 error log entries and 121 unsafe shutdowns. These values indicate controller instability or abnormal device behavior caused by multiple abnormal shutdowns.

As a result, the controller health score was 60/100, and the system reported controller issues. Thus, despite the absence of direct media errors, the SSD was classified as problematic because its operating history and controller metrics demonstrated anomalous behavior. This confirms that SSD recovery capability should be assessed not only by NAND wear indicators but also by controller stability, error logs, unsafe shutdown events, and machine learning-based anomaly detection.

For the proposed framework, the evaluation was performed with diagnostic and recovery-oriented metrics, rather than with conventional supervised classification-based metrics. The machine learning problem was formulated as an anomaly detection problem, and thus the accuracy, precision, recall and F1 score were not used as the primary metrics for evaluating the system, as there was no large labeled dataset of failed SSDs. The following metrics were used instead: the normalized machine learning health score ($H_{ML}$), Isolation Forest anomaly verdict, NAND health score, controller health score, and final recovery feasibility class. The recovery feasibility class was split into three groups: possible recovery, partial recovery, and impossible recovery. These metrics were chosen because the goal of the proposed framework is not just to identify abnormal SSD behavior but also to aid in forensic decision making prior to data recovery procedures.

As shown in

Table 6. Evaluation metrics used in the proposed SSD recovery assessment framework.

Metric	Purpose
Normalized ML health score ($H_{ML}$)	Measures how closely the SSD telemetry matches the learned healthy SSD profile on a 0–100 scale.
Isolation Forest anomaly verdict	Classifies the SSD telemetry as normal or anomalous based on the deviation from healthy behavior.
NAND health score	Evaluates the physical condition of NAND flash memory using wear, error, spare block, and temperature indicators.
Controller health score	Evaluates controller stability using error logs, command timeouts, CRC errors, unsafe shutdowns, and warning indicators.
Recovery feasibility class	Provides the final forensic interpretation: possible recovery, partial recovery, or impossible recovery.

, the selected metrics reflect both the machine learning results and expert interpretation of SSD recoverability. The normalized ML health metric and anomaly conclusion indicate whether the observed SSD telemetry deviated from the learned health profile. In turn, the NAND and controller health metrics provide subsystem-level explanations for the detected condition. The final recoverability class combines these results into a practical expert judgment, thereby enabling the system to distinguish between possible, partial, and impossible recovery scenarios.

Experimental Evaluation of SSD Data Recovery

To evaluate the proposed diagnostic approach, 30 SSD samples were analyzed according to the main factors affecting data recovery. These included controller health, NAND flash memory status, encryption status, TRIM function, and combined diagnostic data derived from selected SMART and NVMe attributes. Based on these parameters, each SSD sample was classified into one of three recovery capability classes: possible, partially recoverable, or impossible. As shown in Table 4, the manually selected cases demonstrated three distinct recovery scenarios. SSDs classified as “Possibly Recoverable” typically had a functional controller, healthy NAND flash memory, inactive encryption, and no active TRIM restrictions. These conditions indicate that the device can still provide stable access to user data, making logical or file system-level recovery possible.

SSDs classified as “Partially Recoverable” remained physically accessible, but their recoverability was limited by active encryption, TRIM activity, or early signs of controller or NAND degradation. In these cases, full recovery cannot be guaranteed, but partial recovery of still accessible data may be possible depending on the time of data deletion, controller stability, NAND condition, and the presence of encryption keys.

The “Unrecoverable” class represents SSDs with faulty controllers, critical NAND degradation, active TRIM effects, encryption limitations, or a combination of these conditions. In such cases, access to user data becomes severely limited or technically impossible, as the translation layer, memory cells, or cryptographic mechanisms prevent reliable data retrieval. These findings confirm that the ability to recover data from an SSD cannot be assessed using a single SMART indicator. Instead, a comprehensive interpretation of the controller’s health, NAND memory health, TRIM behavior, encryption status, and diagnostic telemetry is required.

The goal of this experiment was to demonstrate how different combinations of controller stability, NAND flash memory status, TRIM activity, and encryption could influence the final recovery decision. In this study, 10 SSD samples were classified as recoverable, 10 were classified as partially recoverable, and 10 were classified as unrecoverable.

Table 7. Experimental results of SSD diagnostics and data recovery feasibility assessment.

SSD Model	Controller	NAND	Encryption	TRIM Function	Recovery
Samsung 980	Alive, 90%	Alive	No	No	Possible
Samsung 970 EVO Plus	Alive, 88%	Alive	No	No	Possible
Samsung 870 EVO	Alive, 87%	Alive	No	No	Possible
Samsung 860 EVO	Alive, 82%	Alive	No	No	Possible
Crucial MX500	Alive, 80%	Alive	No	No	Possible
WD Blue SN570	Alive, 79%	Alive	No	No	Possible
WD Blue SN550	Alive, 76%	Alive	No	No	Possible
Kingston A2000	Alive, 73%	Alive	No	No	Possible
SK hynix Gold P31	Alive, 89%	Alive	No	No	Possible
TeamGroup MP34	Alive, 75%	Alive	No	No	Possible
Samsung 980 PRO	Alive, 85%	Alive	Active	Yes	Partially possible
Samsung 990 PRO	Alive, 92%	Alive	Active	Yes	Partially possible
Crucial P5 Plus	Alive, 78%	Alive	Active	Yes	Partially possible
WD Black SN850X	Alive, 86%	Alive	Active	Yes	Partially possible
WD Black SN850	Alive, 83%	Alive	Active	Yes	Partially possible
Kingston KC3000	Alive, 84%	Alive	Active	Yes	Partially possible
Kingston FURY Renegade	Alive, 81%	Alive	Active	Yes	Partially possible
SK hynix Platinum P41	Alive, 91%	Alive	Active	Yes	Partially possible
Sabrent Rocket 4 Plus	Alive, 83%	Alive	Active	Yes	Partially possible
Seagate FireCuda 530	Alive, 85%	Alive	Active	Yes	Partially possible
Crucial P3 Plus	Failed, 20%	Critical	Active	Yes	Impossible
Kingston A400	Failed, 18%	Critical	No	Yes	Impossible
Intel 660p	Failed, 15%	Critical	Active	Yes	Impossible
Intel 670p	Failed, 22%	Critical	Active	Yes	Impossible
ADATA XPG SX8200 Pro	Failed, 25%	Critical	No	Yes	Impossible
Lexar NM790	Failed, 17%	Critical	Active	Yes	Impossible
Corsair MP600 PRO LPX	Failed, 19%	Critical	Active	Yes	Impossible
Solidigm P44 Pro	Failed, 21%	Critical	Active	Yes	Impossible
Intel 760p	Failed, 16%	Critical	Active	Yes	Impossible
Faulty SSD sample	Failed, 18.2%	Critical	Unknown	Yes	Impossible

displays the diagnostic results and the final recovery capability assessment.

As shown in Table 7, SSDs classified as “Possible Recovery” typically had a functioning controller, healthy NAND flash memory, inactive encryption, and no active TRIM restrictions. These conditions indicate that the device can still provide stable access to user data, making logical or file system-level recovery possible. It should be noted that the selected cases were intended to evaluate the diagnostic logic of the proposed model and not to estimate the statistical prevalence of each recovery class in real-world SSD patient populations. Therefore, the equal number of cases in each category reflects the evaluation design and not the natural distribution of SSD failures or recovery outcomes.

SSDs classified as “Partially Possible Recovery” remained physically accessible, but their recoverability was reduced by factors such as active encryption, TRIM activity, or early signs of controller or NAND degradation. In such cases, full recovery may not be guaranteed, but partial recovery of accessible data may still be possible, depending on the timing of the data deletion, controller stability, and the health of the NAND flash blocks.

The “Unrecoverable” class represents SSDs with failed controllers, critical NAND degradation, active TRIM effects, or a combination of these conditions. In such cases, access to user data becomes severely limited or technically impossible, as the translation layer, memory cells, or cryptographic mechanisms prevent reliable data recovery. Thus, the results confirm that the ability to recover data from an SSD cannot be assessed using a single SMART indicator. Instead, a comprehensive assessment of the controller’s health, NAND memory health, TRIM behavior, encryption status, and diagnostic attributes is required.

5. Discussion

The results show that the proposed diagnostic framework is more focused on SSD data recovery than traditional SSD health monitoring utilities. Traditional tools, such as CrystalDiskInfo, are useful for displaying SMART attributes for generalized monitoring but are not designed for forensic analysis. The key contribution of the proposed approach is that it evaluates the feasibility of SSD data recovery. Instead of interpreting each indicator independently, the framework evaluates a combination of aspects, such as the impact of NAND wear, media and integrity errors, spare block depletion, controller instability, TRIM activity, and encryption limitations. This is important because SSD recovery is not determined by a single parameter. In many practical situations, data recovery depends on the interaction between the physical state of the NAND and controller behavior. At the SMART level, a drive may appear healthy, but data recovery can be significantly hampered by controller instability, spare block depletion, active TRIM processing, or the inaccessibility of encrypted storage.

The results also demonstrate that the proposed framework is more aligned with forensic analysis principles than threshold-based interpretation. Traditional threshold-based tools treat SSD health as a simplistic monitoring task, whereas forensic assessment requires a deeper interpretation of whether data can still be accessed, recovered, or extracted. In this regard, the proposed method extends beyond standard SMART monitoring by combining subsystem-level interpretation with a machine learning-based anomaly detector. The rule-based layer preserves interpretability by explicitly linking observed indicators to NAND degradation and controller-related limitations, while the Isolation Forest module increases sensitivity to multivariate deviations from normal SSD behavior. This hybrid design is particularly valuable in forensic applications where both explainability and reliability are required. The proposed method supports pre-sorting before costly or invasive recovery procedures are undertaken. From a forensics perspective, this is of significant importance. If the system identifies an SSD as functioning NAND with stable controller behavior and no critical logical limitations, then logical data extraction or file system-level recovery may be warranted. However, if the platform detects a degraded NAND, controller instability, or serious anomalies in SMART or NVMe telemetry, then more sophisticated methods may be required, such as NAND dump analysis, chip data extraction, or low-level reconstruction. Conversely, if both NAND and controller health are critically compromised, then the system can indicate an extremely low recovery probability, helping investigators avoid unnecessary recovery attempts. Enabling TRIM analysis and encryption also increases the practical value of the system. Existing research on SSD failure prediction primarily focuses on reliability assessment and anomaly detection, but data recovery for forensic purposes depends not only on whether a drive fails but also on whether deleted or logically inaccessible data remains physically recoverable. For example, the experimental interface demonstrated a case where the SSD hardware remained functional, but recovery was only partial, as the TRIM reset likely resulted in the erasure of deleted data. This highlights an important distinction between conventional health prediction and data recovery assessment in forensic applications: a drive may be technically “healthy” in terms of performance yet offer limited data recovery capabilities.

The proposed product demonstrates clear practical value. It provides a structured bridge between SSD telemetry analysis and forensic decision making. Unlike traditional software, it evaluates the probability of recovery, the factors that reduce this probability, and which recovery strategy may be considered more appropriate under the observed conditions. For this reason, this framework can be considered as a promising decision support tool for forensic experts working with modern SSD drives. The ability to pre-screen SSD drives is practical, helping investigators prioritize devices for recovery, identify cases requiring complex recovery methods, and avoid unnecessary attempts when recovery is technically unlikely. This reduces time, costs, and the workload of the forensic lab and facilitates more effective recovery strategies.

Future work will focus on incorporating more comprehensive forensic information and larger datasets of real-world SSD data recovery cases to improve the accuracy of recovery probability assessments. Larger datasets collected from different SSD manufacturers, NAND generations, controller families, firmware versions, and workload histories will also improve model validation under various forensic conditions. These improvements may contribute to more accurate recovery probability assessments and a more reliable selection of appropriate recovery methods.

6. Conclusions

This study proposes a recovery-focused diagnostic framework for assessing the health of NAND flash memory and its impact on data recovery from SSDs. The developed method addresses a key limitation of existing approaches to SSD monitoring and failure prediction: while such methods are useful for identifying degradation or anomalous behavior, they do not directly determine whether NAND flash memory remains suitable for forensic recovery. To overcome this limitation, the proposed framework combines SMART and NVMe telemetry analysis, subsystem-level interpretation of NAND and controller health, and machine learning-based anomaly detection using Isolation Forest. The results show that the recovery potential is highly dependent on the combined health of the NAND flash memory and SSD controller. When the NAND flash remains healthy and the controller is stable, recovery is likely because logical addressing and stored data remain accessible. As degradation increases, reserve resources are depleted, or controller instability occurs, the likelihood of recovery decreases, and more advanced methods such as NAND dump analysis, chip data extraction, or low-level reconstruction may be required. Furthermore, TRIM and hardware encryption were identified as important forensic limitations that can significantly reduce the likelihood of data recovery, even if the SSD is still operational.

These results confirm that SSD forensic assessments must consider not only physical memory wear but also controller-level and logical factors affecting data availability. This also confirms the asymmetric nature of SSD degradation, in which abnormal conditions manifest as heterogeneous deviations from the healthy telemetry profile. An additional advantage of the proposed framework is its hybrid approach. Rule-based subsystem analysis ensures interpretability by explicitly linking observed SMART and NVMe indicators to NAND degradation and controller-related risks, while the Isolation Forest model increases sensitivity to multivariate deviations from normal SSD behavior. This combination makes the framework more suitable for preliminary forensic assessment than simplified threshold-based monitoring tools, which typically only report overall health conditions and do not evaluate recovery-focused outcomes.

Experimental evaluation demonstrated that the framework can provide stable and consistent diagnostic conclusions in normal, warning, and degraded SSD scenarios, validating its use as a practical decision support tool. Despite these promising results, the study has several limitations. The proposed methodology relies on the availability and consistency of SMART and NVMe telemetry, which may vary across SSD manufacturers, controller families, and firmware implementations. Furthermore, the current assessment should be expanded using broader datasets from different manufacturers and a larger number of real-world data recovery cases. Therefore, future work should focus on validating different SSD architectures, controller designs, NAND generations, and workload conditions, as well as refining the recovery probability assessment using more comprehensive forensic information. Overall, the proposed method demonstrates that SSD telemetry can be transformed into a more meaningful forensic recovery assessment. By integrating NAND health assessment, controller-related limitations, and anomaly-based machine learning into a unified framework, the study provides a practical basis for data recovery decision making. Therefore, the proposed method represents a promising step toward more intelligent and recovery-focused forensic analysis of modern SSDs.