Is file recovery from a SSD (Solid State Drive) possible? As more and more PCs and laptops are shipped with a SSD drive this question becomes more relevant. The question is relevant because a SSD treats deleted data differently than a conventional hard disk.
File recovery software companies that claim ‘best ssd recovery software’ (all over the place) are basically selling bullshit (pardon my French).
Conventional hard disk vs a SSD
Conventional hard disk
In this post “Can my data be recovered using file recovery software if..” I describe how data is stored on a hard disk from a file system perspective. On a conventional, magnetic hard disk it is the operating system file system drivers that handles deleted data. It is also the file system that handles formatting a disk. Due to the way file system handles deleted data, deleted data is actually often recoverable. Key is that the file system does not delete data, is simply removes pointers to data (your files). And also, clusters previously allocated to a deleted file are marked available for use. On a conventional hard disk only pointers to the data are deleted. Actual data remains intact until the sector is used again.
Solid State Drive (SSD) – simplified
On a conventional disk, to store or change one byte worth of data to let’s say sector 100, the system reads one sector into memory (the smallest addressable unit). One sector equals 512 bytes (or 4096 on modern hard disks). It changes the byte, in memory, and it writes the ‘new’ sector back to the disk at sector 100.
Due to the nature of a SSD it can not overwrite existing data. Flash memory must first be erased before it can be written to. The smallest writable unit on a SSD is called a page which is typically 8 – 16 KB in size. The smallest unit that can be erased is a block which consists of several pages (8 – 16 MB in size). So to change a single byte, a page must be written to (re-programmed) and for that to happen the entire block must be erased first.
Garbage collection
To speed up this process the altered byte, plus all other in use pages are written to an empty block. The original block is then scheduled to be erased during a process called ‘garbage collection’. It is the SSD itself that takes are of this entire process. During idle time, the garbage collection processes / erases pages no longer in use (invalid pages) so it can maintain a pool of empty and quickly to use blocks.
Also the drive may combine data from several partially used blocks into a new one during garbage collection.
It may sound as if as long as this garbage collection process didn’t fire the data in these ‘stale’ blocks may be recoverable. However from an end user level file recovery software point of view this data is already beyond reach. To the outside world the drive presents a chain of (LBA) blocks starting at block 0 up to the last block. In reality these blocks can be ‘all over the place’ but the drive keeps track of which actual physical block it needs to access when for example the OS or an application requests access to LBA block 100.
So if the OS signals the contents of LBA address 100 can be deleted, the associated block is moved to a different table so to speak. If the OS now requests to read to block 100 it will get a block of zeros in return.
TRIM
If the OS deletes data (files) it needs notifies the SSD, so the invalid pages can be erased during garbage collection, by issuing a TRIM command. So, on a SSD, deleted data is really deleted eventually!
Although you may think there is still time between the deletion of a file and the actual garbage collection, most modern SSDs return zeros or random data when data is requested from an ‘invalid’ page.
What this means
It means that file recovery from a SSD, of files that were deleted or lost using normal mechanisms can not be recovered using undelete or file recovery software due to the operating system sending a TRIM command to the SSD. Key is the fact that the OS issues a TRIM command.
Scenarios where data may be recoverable
File recovery from a SSD may be possible if data is lost, however not due to normal operating system procedures. If for example a file system is corrupt (RAW file system), no TRIM command is sent to the SSD. There is a good chance you can still recover data. If you (accidentally) format a partition then a TRIM command is issued and data recovery using file recovery software becomes very unlikely.
So, rule of thumb, if you purposely or accidentally deleted data using an operating system feature (delete a file, format a partition, deleted a partition) the OS issues a TRIM command and the data is unrecoverable.
If data suddenly disappears due to file system corruption (RAW file system), partition table corruption or unknown reasons, file recovery software may be worth a shot. Also if the lost data is on an USB connected disk, hardware RAID array you may be lucky and the data was not ‘trimmed’.
If Windows suggest to format a drive or initialize a disk then DON’T.
For file recovery I suggest ReclaiMe File Recovery.
Other situations where file recovery from a SSD may work:
- OS does not support TRIM, example: Windows XP. If a file is deleted in XP no TRIM command is issued so actual data may survive.
- OS does support TRIM, but TRIM is disabled. To check run a command prompt (as administrator) and type:
fsutil behavior query DisableDeleteNotify [enter]. You’ll see one of two results. If you see DisableDeleteNotify = 0 , TRIM is enabled. Else, if you see DisableDeleteNotify = 1 , TRIM is disabled. Again,l if a file is deleted, actual data may survive. - Windows does not TRIM non NTFS formatted volumes (exFAT, FAT32).
- If SSD is part of a (hardware) RAID array.
- If SSD is an external USB drive.
- SSD itself doesn’t support TRIM.
- Bugs in SSD firmware may cause to TRIM not function properly.
- No DRAT/DZAT support: This SSD does not return either zeros of random data for deleted files so data may be available as long as garbage collection did not fire (idle time).
- Your SSD is not actually SSD although flash based storage (cheap laptops).
- other non SATA SSD drives.
More on TRIM (Wikepedia).
More on TRIM and exceptions