In the last series consisting of two articles “How Data Recovery Works” and “How Carving Works”, we looked at how Windows deletes files and how information is left on the hard drive and not automatically erased or overwritten. Well, this is not always the case with SSD drives. In this article we’ll see why.
Contents
Principles of Solid-State Storage
Solid-state storage works in a very different manner compared to HDD drives. Information is stored in NAND flash cells. Without going much technical, it is important to know two things. First, one can only write to an empty flash cell. If a flash cell contains non-zero data, it must be first erased before any other data can be stored in it. Second, solid-state storage is much faster to write information into empty flash cells than to erase (initialize, fill with zeroes) those cells.
These two things mean that filling up your brand-new SSD drive with data for the very first time is blazing fast. However, if you delete some files and start writing again, the speed will drop 3 to 10 times compared to a fresh SSD. Apparently, users would not be too happy about this drop in performance, and so SSD manufacturers invented a smart trick: they re-initialize (erase) ‘dirty’ cells (flash units that have data that no longer belongs to any given file) in background, before any new data is written on the disk. This allows returning the SSD drive to as-new performance soon after the file is erased.
How does the SSD drive know that a certain flash cell now contains information that no longer belongs to a file? For that, the developers implemented a now standard command called TRIM. The TRIM command is issued by the operating system at the time a file is deleted, or if the user formats the disk, or if the user deletes a disk partition, or if disk space gets released in some other way. It is important to know that TRIM by itself does not erase any data; this command is merely an advisory measure telling the SSD controller that this and that flash cells are no longer used and can be erased.
What happens next? The SSD controller takes those flash cells and erases their content, re-initializing them to prepare for new write operations. The SSD drive is ready to accept new data, write speeds are at their max. Your data is gone.
Is that the end? Not really. Read our other article on when and how your data can be recovered from SSD drives!