Solid State Devices (SSD) are replacing conventional hard drives in modern computers. They are much faster, more reliable due to lack of moving parts, and consume less power. However, all those features cannot prevent file loss in SSDs. Files can be erroneously deleted or get lost due to some system fault. Is it possible to retrieve them back, like from conventional HDDs? Many file recovery software vendors answer “Yes, we can!”. But is that true? Well, the answer isn’t that easy, especially for intentionally/erroneously deleted files. Why? Below we’ll give you the answer.
When an operating system deletes a file, it usually simply marks that file as unneeded. Some systems, like Windows, keep storing almost all information about that file until its place on the storage device is needed for another file, some systems, like macOS and Linux, immediately destroy that information, but all of them keep the content of the file it its original place on the storage device. A decent file recovery software can either find the information about that file and recover it with its proper file name and other attributes, or, at least, find its content on the device and recover it as a new file. File attributes will be lost, but the content won’t.
Conventional HDDs provide access to its entire storage space directly and unambiguously. If the system says the data starts at Sector 28328450, this will be a one and only place on the disk. That is why it is possible to read the disk from its beginning to end in search of lost files.
SSDs work quite different. They constantly shuffle data across their internal cells to level their wear, and only the device itself knows where the file data is stored at a certain time. The system has no control over this process, and moreover, it has no means to know the actual location of the data inside the device. When it deletes a file, it issues a special command TRIM that informs the SSD that this storage place has been freed and can be allocated for another piece of data. When the system or a file recovery program looks at this place once more, the SSD simply returns zeros rather than previous data.
Therefore, deleted files can be recovered only until the next TRIM command is issued. After that file recovery becomes impossible. Different operating systems issue this command in different time intervals. Windows does that in several minutes, while Linux does that during startup/shutdown.
Thus, the success of recovery from SSDs depends whether it happens before the TRIM command has been issued.
How to prevent the TRIM command from being issued:
- As soon as you discover file deletion, power the computer off, do not shutdown it. That can be done by pressing the Power button for a long time. That will prevent the TRIM command from being executed during normal shutdown.
- Use a startup version of a program for recovery from SSD. Usually, those startup programs do not support the TRIM command.
- Create an image of the SSD and recover files from that image.
By following these steps, you can reduce chances that the TRIM will be executed, and increase chances for successful file extraction from an SSD.
These steps are easy to follow, but they greatly increase chances for successful results.
