File Recovery Specifics for SSD devices

Most modern computers, even very inexpensive ones, have a solid-state drive (SSD) as its system (and quite often the only one) storage device. Such devices are faster, run silently, consume less power, and more resistant to physical shock when compared with conventional hard disk drives. However, they also have some serious drawbacks, with file recovery being one of them.

SSD Basics
SSDs are solid state storage devices, like other flash memory types (SD cards, memory sticks, and alike), but not all solid state storage devices are SSDs. It's important to tell which device is an SSD and which is not. The rule of thumb is as follows:

  • If the device is external, like a memory card, stick, or even a real SSD device in an external USB/Thunderbird box, it should be treated as conventional flash memory, and all information below is not applicable to them.
  • If the device is intended for internal use and has an ATA/IDE/SATA/M.2/PCI Express interface, it should be treated as an SSD device, and all information below is fully applicable to them.

When a file is deleted from a mechanical drive, the OS simply marks the disk area occupied by the file as free, but its data is left on the disk untouched until some new file overwrites it. When a data recovery program accesses the untouched area it gets the old data. That is how file recovery works.

An SSD however, must either use its new cells, or first purge the old data in the occupied cells to store the fresh data. Purging old data in SSDs is quite a slow process. That is why file deletion in an SSD works in the following way: when a user, program, or OS itself deletes a file, the OS issues the TRIM command that informs the SSD that the data is no longer needed. The SSD puts the cells the file occupied to a special pool to be purged later. When any program or OS requests data from those cells, the SSD simply returns garbage or zeros.

Moreover, the device constantly shuffles the data across its cells to level their wear, and only the device itself knows where the file data is stored at any given time. The OS has no control over this process, and furthermore, it has no means to know the actual physical location of the data.

This is why data recovery from SSD devices when the TRIM command is used is extremely difficult, if ever even possible.

SSDs, OSs, and file systems that support the TRIM command
TRIM works when all three components support it: an SSD device, operating system, and file system on the SSD device. Almost all modern SSD devices support the TRIM command. As for complex volumes consisting of SSDs, it depends. Linux LVM2 and Windows software RAIDs support TRIM, whereas software RAIDs in macOS and most hardware RAID controllers don't.

Virtual disks of virtual machines are a little trickier. The fact that a virtual disk is stored on an SSD doesn't mean anything. For the host OS, this disk is a valid file and all disk operations of its virtual machine is read-write operations for that file. Inside the virtual machine with a virtual SSD disk, it all depends on the virtualization software. Some just simulate the TRIM command and return garbage without any actual changes on the SSD file, while some change file data.

Major OSs and file systems that support the TRIM command:

TRIM on/off by default File systems When TRIM is issued
Windows (7 and newer)
On NTFS and ReFS (Windows Storage Space only) Immediately upon deletion
macOS (Mac OS X Lion 10.6.8 and newer)
On on native Apple SSD devices
Off on non-native devices
APFS and HFS+ Immediately upon deletion
Linux (Kernel 2.6.28 and newer)
On on most distros, but depends on settings. Ext4, Btrfs, JFS, XFS, F2FS, NTFS Depends on distros and settings, usually weekly, but may be immediately upon deletion

How the TRIM command affects data recovery
Deleted files:
Windows and Mac: Almost always impossible. Even raw file recovery cannot help.
Linux: Possible if done before the TRIM command is issued.

Files lost in slightly damaged file systems (recognized by their native OS):
Every OS is gradually repairing such file systems using the TRIM command to delete garbage, invalid file records, and unnecessary files. Data recovery is possible if done fast and on systems with the TRIM command disabled.

Severely damaged file systems (not recognized by their native OS):
Data recovery is possible because the OS cannot repair them and doesn't delete any data.

How to minimize the negative effect of the TRIM command
Some steps can be made to minimize the negative effect of the TRIM command when the data recovery is possible.

  • Connect the SSD device through USB, FireWire, or Thunderbolt external boxes. TRIM doesn't work on such connections. But they may be slow, especially when recovering files from large devices.
  • Disable the TRIM command while recovering data. Don't forget to enable it once file recovery is complete.

Windows:
Press Win + X key key combination.
Windows PowerShell will appear:
Enter "fsutil behavior set DisableDeleteNotify 0/1"
(1 to disable, 0 to enable)

macOS:
In Terminal, enter "sudo trimforce disable"
Enter the administrative password, and answer "Y" to several questions.
The computer will automatically restart with TRIM disabled

To enable TRIM back, enter "sudo trimforce enable".

Linux:
Depends on distros and settings. Consult documentation for the particular installation.

Conclusion
Data recovery from SSD devices operating on a major modern OS is impossible for deleted files, and very difficult in other cases. Anyone claiming otherwise is either incompetent or willfully deceiving their customers. This is why proper and regular data backup is especially important for computers with SSD storage devices. R-Drive Image, created by R-TT Inc., is a convenient product for backing up such devices. If your computer uses an SSD, we recommend you download a fully functional 30 day trial.

© Copyright 2000-2018 R-Tools Technology Inc.
We use cookies to ensure you get the best experience on our website.   Read more Got It