In the last series consisting of two articles “How Data Recovery Works” and “How Carving Works”, we looked at how Windows deletes files and how information is left on the hard drive and not automatically erased or overwritten. Well, this is not always the case with SSD drives. In this article we’ll see why.
Contents
Principles of Solid-State Storage
Solid-state storage works in a very different manner compared to HDD drives. Information is stored in NAND flash cells. Without going much technical, it is important to know two things. First, one can only write to an empty flash cell. If a flash cell contains non-zero data, it must be first erased before any other data can be stored in it. Second, solid-state storage is much faster to write information into empty flash cells than to erase (initialize, fill with zeroes) those cells.
These two things mean that filling up your brand-new SSD drive with data for the very first time is blazing fast. However, if you delete some files and start writing again, the speed will drop 3 to 10 times compared to a fresh SSD. Apparently, users would not be too happy about this drop in performance, and so SSD manufacturers invented a smart trick: they re-initialize (erase) ‘dirty’ cells (flash units that have data that no longer belongs to any given file) in background, before any new data is written on the disk. This allows returning the SSD drive to as-new performance soon after the file is erased.
How does the SSD drive know that a certain flash cell now contains information that no longer belongs to a file? For that, the developers implemented a now standard command called TRIM. The TRIM command is issued by the operating system at the time a file is deleted, or if the user formats the disk, or if the user deletes a disk partition, or if disk space gets released in some other way. It is important to know that TRIM by itself does not erase any data; this command is merely an advisory measure telling the SSD controller that this and that flash cells are no longer used and can be erased.
What happens next? The SSD controller takes those flash cells and erases their content, re-initializing them to prepare for new write operations. The SSD drive is ready to accept new data, write speeds are at their max. Your data is gone.
Is that the end? Not really. Read our other article on when and how your data can be recovered from SSD drives!
Frequently Asked Questions
Yes, it is possible to recover deleted files if they have not been overwritten by new data.
Stop using the disk (create an image) as soon as the files have been deleted and use the professional data recovery software RS File Recovery to recover the deleted files.
This greatly depends on the capacity of your hard drive and your computer's performance. Basically, most of hard disk recovery operations can be performed in about 3-12 hours HDD 1TB in normal conditions.
If the file does not open, it means that the file was damaged or corrupted before recovery.
Use "Preview" to evaluate the quality of the recovered file.
When you try to access the drive, you get the message "Drive is not accessible" or "You need to format the partition drive"
Your disk structure is corrupted.
In most cases, the data may still remain available. Just run the data recovery software and scan the desired partition to get it back.
Please use free versions of programs with which you can analyze the storage and view the files available for recovery.
You can save them after purchasing the program - you won't need to scan it again.
