Do SSDs with TRIM, make disk recovery obsolete?

[VirtualLarry]

My understanding, with TRIM, is that once you delete something on an SSD, it's REALLY gone. So traditional undelete utilities will no longer be effective. Even quickformatting a partition will wipe everything out.

Would these be arguments for disabling TRIM on SSDs?

 

[gbeirn]

That is my concern. I don't know for sure but it does appear that TRIM would render the data unrecoverable with traditional software-based recovery programs. I have an extra X-25M laying around, I should try a few experiments with it. If I find the time I will post the results here.

 

[SunSamurai]

No. Back your important stuff up. SSD is not for backup people.

 

[jvroig]

No. Back your important stuff up. SSD is not for backup people.

He wasn't concerned about backups. (But that's a good answer for whether it could be an argument for disabling TRIM, I agree that the answer should be a resounding no.)

He was just asking about disk recovery such as using something like OnTrack EasyRecovery to recover the supposedly lost deleted data.

Yes, a good backup regimen will solve those problems, but that's not the scenario here. It's probably just a technological question of whether current disk recovery solutions will or will not work on an SSD with TRIM. And it's an interesting question, and can possibly affect those businesses that offer such services especially if five or ten years down the road TRIM-enabled SSDs do replace HDs as the mainstream secondary storage medium in PCs.

I am interested in this question as well, and I hope a storage expert and/or recovery expert can chime in here.

Thanks.

 

[jimhsu]

I was thinking in terms of security actually. Would overwriting files once with something like Eraser be sufficient to hinder all reasonable recovery efforts? I thought no, because writes on the SSD are redirected by the LBA allocation table to various physical locations on the table; overwriting a file shouldn't result in writes to the exact same place, so low level access of the flash memory could theoretically recover the deleted data.

But of course without the controller, the most you will see are fragmented 4kb pages. A giant jigsaw puzzle perhaps ... but solvable.

 

[SunSamurai]

Well to be silly, I would say that SSD drives are MUCH more vulnerable to complete destruction that HDD. All it takes is a fireplace after removing the raw parts./ To fully destroy a HDD you pretty much need lava.

 

[bradley]

An unrecoverable TRIMed drive is a concern that I share. The real drawback being a more congnizant experience regarding the permanance of SSD deletion, due to malfunction, accident, or otherwise. With traditional hard drives I was a little more lacksadaisical. I guess you can't have your cake and eat it too

 

[RebateMonger]

He wasn't concerned about backups.

Well, it sorta' does involve backups. Things like "Previous Versions" in Windows and various backup software certainly can allow you to restore stuff that's accidentally deleted. This means that whether files are "permanently deleted" with TRIM isn't that important.

In Windows, at least, as long as you have Previous Versions enabled and have ongoing backups, recovery of accidentally-deleted data shouldn't really be an issue.

 

[taltamir]

Well to be silly, I would say that SSD drives are MUCH more vulnerable to complete destruction that HDD. All it takes is a fireplace after removing the raw parts./ To fully destroy a HDD you pretty much need lava.

a degausser works better (big magnet)...

As for data recovery... you should really back up your data. And I prefer the security of knowing that if I delete something it is gone without me having to use some specialized tool to eliminate the data.

 

[jimhsu]

You can't degauss a SSD (well, not with any reasonably sized magnetic field). A magnetar would do the job, but it would rip your atoms apart in the process.

What's a DOD federally approved way for sanitizing a used SSD drive with Top Secret data? Incineration? Do they even have such guidelines out there?

 

[jvroig]

You can't degauss a SSD (well, not with any reasonably sized magnetic field). A magnetar would do the job, but it would rip your atoms apart in the process.

I'm pretty sure he meant degauss for the HDD

As for data recovery... you should really back up your data. And I prefer the security of knowing that if I delete something it is gone without me having to use some specialized tool to eliminate the data.

Absolutely agree. But this really isn't the topic here. Bakcups are unanimously the best practice, yes. But in HDDs, there's still a way to recover the data you delete through various recovery tools, and expensive "data recovery" services. The question here, and an interesting one, is would there be something like that for SSDs as well, given TRIM?

We're not talking about whether a backup regimen is good or not. We all know it is GOOD(TM), and we all know all of us should have a backup or two in place.

Here, the OP is asking "will SSDs with TRIM make disk recovery obsolete"? He's not really asking "how can I recover my files from a TRIMMED SSD?".

So there's the question again for SSD/Storage/TRIM experts out there (if any): does TRIM make disk recovery obsolete? Or are there still ways to recover fully/partially (all/some) data from a SSD even if it has TRIM?

 

[IntelUser2000]

My understanding, with TRIM, is that once you delete something on an SSD, it's REALLY gone. So traditional undelete utilities will no longer be effective. Even quickformatting a partition will wipe everything out.

Would these be arguments for disabling TRIM on SSDs?

TRIM itself might not(or do it without messing up the files), but initializing Secure Erase or doing WIPE/TRIM on an empty drive might make it unrecoverable.

After all, what these commands and programs do is physically(by telling the controller) set the 1s back to a zero. In a traditional hard drive, having to physically delete is not that important to the drive's operation, while in an SSD, its fundamental.

 

[gbeirn]

Well I can confirm with my X25-M using the older non-TRIM firmware and Windows XP that deleted files and quick-formatted partitions are recoverable just like traditional hard drives (which I suspected would be the case). Does anyone have a link to the manual TRIM tool? I would like to test that next. Intel has removed it from their website while they work out the bugs.

 

[taltamir]

It will make undelete obsolete. But not data recovery.

Current undelete works because drives do not really erase the data unless you specifically use a "secure erase" tool. or the data has been overwritten. If you delete something, it will likely still be there and recoverable.
Note, that the way the mac filesystem works, you cannot undelete files on it... for no reason (unlike trim, it doesn't improve performance on a spindle drive).

However, if you delete a partition trim is NOT engaged, so you can undo that. And the most common reason for data recovery is not "I accidently deleted a file and want it back", it is "my drive broke and I want my files back, files which I never deleted".
Which:
1. Can be recovered, although via different techniques, with an SSD.
2. Not affected by trim.

 

[RebateMonger]

For "simple" undelete, there's always the "Recycle Bin" (PC) or "Trash Can" (Mac).

One recovery scenario not discussed is the "overwrite" error. Folks make changes on a document and save the document with the same name as before. Now they've lost the original copy. The Recycle Bin and, likely, an "undelete program" won't help, since the file wasn't deleted. It was overwritten with new data. In that case, "Previous Versions" or a backup will be required to get the original document back.

 

[jimhsu]

Ok, assume that the drive has a single word document. That is all. Assume that you have nothing like previous versions or backup running.

Now, you make some changes and save the file. Oops, you overwrote the original file. You make no further changes to the SSD.

My question is whether or not the original file is recoverable, when overwritten. On a hard disk, this is impossible because you've written a different set of 1's and 0's to the same location. On a SSD however, writes are redirected to different physical locations according to the allocation table. In fact, wear-leveling practically guarantees that a block with a lower write count (and thus not the original) will be chosen. So, theoretically the original data should still exist somewhere. Right? I doubt that consumer tools will be able to access it (because it'll basically be fragmented into 4kb blocks), but given enough time you could technically get the data back.

 

[RebateMonger]

In fact, wear-leveling practically guarantees that a block with a lower write count (and thus not the original) will be chosen. So, theoretically the original data should still exist somewhere. Right?

Sounds logical. I keep thinking in terms of "disks" and SSDs don't follow the same rules.

 

[gbeirn]

I do all sorts of data recoveries, whether they be failed drives, accidental deletions/formats, overwritten files and corrupted partitions/file systems. You would not believe the number of people who delete their files either on purpose (not realizing their back-up doesn't work) or by accident and want them back. These are the situations where I am curious on how TRIM affects recoveries. Most severe electronic/mechanical problems are not what I would be working on.

 

[glugglug]

Contrary to popular myth, TRIM does NOT immediately erase the data. It just sets a flag in the logical->physical cluster map to say that the cluster doesn't need to be read and rewritten when the block goes through the next read/modify/write cycle. If the drive correctly follows the spec, this flag will also make reads of that logical cluster return all zeros, but I am thinking that maybe there is an alternative read command that doesn't do this... If the drive doesn't follow this rule, it will make the TRIM implementation incompatible with RAID3, RAID5, & RAID6.

Also, in order to facilitate wear leveling, SSD drives and even most USB sticks have more storage than they make visible to Windows, and it is possible that multiple historical versions of a logical cluster exist on the drive, but the map of logical to physical clusters points to only the latest one.

Using http://www.diskinternals.com/flash-recovery/ I recovered almost 200MB of photos from a 128MB CF Card that had been reformatted. Don't know how it is able to get at the physical clusters that are no longer pointed to in the map but it apparently does. Don't know if this is possible on an SATA SSD.

The ATA "Secure Erase" command which HDDERASE does is specifically for wiping the data, and is not the same as a normal overwrite.

 

[jimhsu]

Right. The excess storage thing is something else that complicates data security. Even if you erase a partition normally, the spare blocks might possibly still contain valid data. Secure Erase is possibly the only way to guarantee data sanitization for a SSD device, aside from physical destruction. Full disk encryption also works and is advantageous in that erasing (wiping out the key) can be done very quickly.

 

[jimhsu]

... I recovered almost 200MB of photos from a 128MB CF Card....

Wait... what? Are the photos compressed?

 

[Mr.Wolf]

Contrary to popular myth, TRIM does NOT immediately erase the data. It just sets a flag in the logical->physical cluster map to say that the cluster doesn't need to be read and rewritten when the block goes through the next read/modify/write cycle. If the drive correctly follows the spec, this flag will also make reads of that logical cluster return all zeros, but I am thinking that maybe there is an alternative read command that doesn't do this... If the drive doesn't follow this rule, it will make the TRIM implementation incompatible with RAID3, RAID5, & RAID6.

This is interesting information, I have a intel x-25m G2 with last TRIM firmware, using win7, yesterday I tried to undelete some files and they were all empty.

I did a test with a text file and I could not undelete the file contents.
I could undelete the text file and it had the original size, but there was no text inside.


I did the same test in the hard disk just to validate undelete software and it works well i

 

[RollerBoySE]

This is interesting information, I have a intel x-25m G2 with last TRIM firmware, using win7, yesterday I tried to undelete some files and they were all empty.

I did a test with a text file and I could not undelete the file contents.
I could undelete the text file and it had the original size, but there was no text inside.


I did the same test in the hard disk just to validate undelete software and it works well i

Was that before or after the Recycle Bin had been emptied?

 

[Mr.Wolf]

Was that before or after the Recycle Bin had been emptied?

It was using file recovery software, after the recycle bin was empty or after a "shift-del".
The recycle bin undelete works well.