Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Windows 10 / How to Recover Deleted Files from a TRIM-Enabled SSD?

November 14, 2019 MiscToolsWindows 10

How to Recover Deleted Files from a TRIM-Enabled SSD?

Currently, a large number of programs for recovering deleted files and partitions on a hard disk or USB drive are available. All these programs are based on the fact that when a file is deleted from the file system, its data and metadata continue to be stored on physical media until they are overwritten with new files. Data recovery software for PC allows you to scan a drive and find deleted files by signature or by analyzing unused data blocks. However, the classic file recovery apps does not work properly with SSDs (Solid State Drive). Let’s see why.

how to recover data from the solid state drive?

Contents:
  • Deleting Files on an SSD and the TRIM Command
  • SSD Devices Detection in Windows
  • How to Recover Data from SSD after File Deletion Using the EaseUS Data Recovery Wizard?

Deleting Files on an SSD and the TRIM Command

The process of deleting files on an SSD is fundamentally different from the process of deleting files on a traditional hard drive. When a file is deleted, the operation system sends an ATA interface TRIM command to the SSD device, which reports that this data is no longer needed. The SSD device marks these cells for deletion and sets all cells to zero in the background (with the separate garbage collection process). This allows you to quickly save data in the unused SSD cells and reduces wear of storage cells. Thus, the TRIM command forces the drive to physically clear unused data blocks.

As a result, any file recovery software sees only zeros in the SSD cells with deleted data. This means that if your SSD-drive is connected to the computer via the SATA interface, then it is almost impossible to recover deleted files from it. This also applies to the NVMe SSDs. For such devices, there is an analogue of the TRIM command, which is called – Deallocate (supported on Windows 8 and newer).

SSD Devices Detection in Windows

Windows by default enable the TRIM command for SSD drives that are connected via the ATA/IDE/SATA/M.2/PCI Express interface (but not USB!) in the AHCI mode. In addition, TRIM is enabled only for NTFS and REFS file systems. When these conditions are met, the TRIM command is automatically executed and the SSD background process cleans the cells almost immediately after you delete the file from the file system.

TRIM is enabled by default on MacOS for the Apple SSDs with APFS and HFS+ file systems. The Trim command is also sent immediately after the file is deleted.

You can recover deleted data files and partitions from an SSD drive if:

  • Your SSD is connected to the computer via USB or FireWire port;
  • You are using a RAID array of several SSD devices (Windows doesn’t enable TRIM for such a storage device);
  • You are using old OS version: Windows Vista, Windows XP, MacOS up to OS X 10.10.4 (TRIM is not supported in these versions);
  • TRIM is disabled at Operating System level;
  • Your SSD does not support TRIM commands (possibly on older SSD models);
  • The SSD is not formatted in the NTFS file system (for example, used FAT32, exFat, etc.).

How to Recover Data from SSD after File Deletion Using the EaseUS Data Recovery Wizard?

Let’s see if is it possible to recover deleted files from the Trim-enabled SSD using the popular EaseUS Data Recovery Wizard Free (there is a version for Mac and Windows).

The free version of EaseUS Data Recovery Wizard Free allows you to recover up to 500 MB of deleted files (or up to 2 GB if you share the program on Facebook or Twitter).

EaseUS Data Recovery Wizard is one of the best programs for quickly recovering lost data from various drive types.

Key features:

  • Data recovery from HDD, memory cards, external USB drives;
  • File recovery after deletion and quick formatting;
  • File system support: HFS+(macOS), NTFS/NTFS5/ReFS (Windows), ext2/ext3 (Linux), FAT/ExFat;
  • Logical partition recovery.

So, I have an SSD drive connected to my computer. Let’s check that one of the local disks (21 GB) is detected as an SSD using the PowerShell command:

Get-PhysicalDisk | Select Number, PhysicalLocation, MediaType, Size

powershell - Get-PhysicalDisk ssd info

Check if Trim is enabled for it:

fsutil behavior query DisableDeleteNotify

fsutil behavior query DisableDeleteNotify check TRIM state for SSD in Windows 10

The following result indicates that TRIM is enabled:

NTFS DisableDeleteNotify = 0 (Disabled)

Next I’ll delete one file from the SSD and try to restore it using the EaseUS Data Recovery Wizard:

  1. I downloaded and installed the EaseUS Data Recovery Wizard Free
    In order to prevent accidentally overwriting deleted blocks on a disk, you shouldn’t install the EaseUS Data Recovery Wizard on the same disk from which you want to recover files!
  2. Now I delete one file from the SSD drive; delete test file frm ssd
  3. Run a data recovery wizard in the EaseUS Data Recovery to perform a full scan of the SSD drive. Wait until the disk scan is complete. In my case, the data recovery programm could not find the deleted file.

EaseUS Data Recovery - recover file from SSD

Now try to disable TRIM with the command:

fsutil behavior set DisableDeleteNotify 1

If TRIM is disabled successfully, you will see a following message: “NTFS DisableDeleteNotify = 1 (Enabled)”.

On the macOS environment, you can disable TRIM with the command:
sudo trimforce disable

disable TRIM on SSD in Windows 10

I delete another file from the SSD drive and run a full disk scan with the EaseUS Data Recovery Wizzard. The file recovery program will instantly find the deleted file and offer to recover it.

recovering deleted files from SSD using EaseUS Data Recovery Wizzard

Select the file you want to recover and click the Recover button. When restoring a file, it is advisable to specify a different disk, so as not to accidentally overwrite the metadata on the source drive.

To enable the TRIM mode for your SSD, run the command:

fsutil behavior set DisableDeleteNotify 0

So, you cannot recover a deleted files from a Trim-enabled SSD drive. Even scanning file signatures doesn’t help.

To prevent the TRIM command from being applied to your SSD, you can

  • Connect your SSD device via USB, FireWire or Thunderbolt interface;
  • Disable TRIM on the OS-level. However, this reduces your SSD life span and maximum writing speed.

2 comments
5
Facebook Twitter Google + Pinterest
previous post
FAQ: Windows 10 Enterprise LTSC 2019 Explained
next post
How to Delete Old User Profiles Using GPO and PowerShell?

Related Reading

How to Deploy Windows 10 (11) with PXE...

June 27, 2022

Checking Windows Activation Status on Active Directory Computers

June 27, 2022

Configuring Multiple VLAN Interfaces on Windows

June 24, 2022

How to Disable or Enable USB Drives in...

June 24, 2022

Adding Domain Users to the Local Administrators Group...

June 23, 2022

2 comments

John Alexander June 2, 2020 - 10:57 am

This is by far the most informative and useful information I’ve found on SSD and file deletion/recovery – and I’ve researched this topic for quite a while. However, I don’t understand how data recovery companies are able to recover data from SSD and claim a 95%+ success rate (this is backed with a “no file recovery, then no payment” policy).

Reply
Graham Scott January 12, 2021 - 2:08 pm

The article describes a methodology that operates at the consumer level using the SSD in-situ, a non-modified operating system and recovery software readily available as an app (in many cases freeware) on the internet.

The 95% success rate originates with professional forensics laboratories analyzing SSDs taken from consumer based installations. These professional organizations have access to tools (software and hardware), and manufacturer information that is unavailable to the average consumer. With these tools they invariably de-package the target SSD and are able to readily access areas such as the over-provisioning area and Factory Mode reserved area. Most importantly they are able to take control of the internal SSD controller and (for example) terminate all garbage collection operations, whether foreground or background, as well as all TRIM operations. And the list goes on, but i hope this gives you some idea how easy it is to recover inaccessible data from a SSD.

Reply

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows 7
  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2
  • PowerShell
  • VMWare
  • Hyper-V
  • MS Office

Recent Posts

  • How to Deploy Windows 10 (11) with PXE Network Boot?

    June 27, 2022
  • Checking Windows Activation Status on Active Directory Computers

    June 27, 2022
  • Configuring Multiple VLAN Interfaces on Windows

    June 24, 2022
  • How to Disable or Enable USB Drives in Windows using Group Policy?

    June 24, 2022
  • Adding Domain Users to the Local Administrators Group in Windows

    June 23, 2022
  • Viewing a Remote User’s Desktop Session with Shadow Mode in Windows

    June 23, 2022
  • How to Create a Wi-Fi Hotspot on your Windows PC?

    June 23, 2022
  • Configuring SSH Public Key Authentication on Windows

    June 15, 2022
  • How to Run a Program as a Different User (RunAs) in Windows?

    June 15, 2022
  • FAQ: Licensing Microsoft Exchange Server 2019/2016

    June 14, 2022

Follow us

woshub.com

ad

  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Microsoft KMS Volume Activation FAQ
  • Configuring Kerberos Authentication in Different Browsers
  • IPMI: Configuring SuperMicro Remote Management Interface
Footer Logo

@2014 - 2018 - Windows OS Hub. All about operating systems for sysadmins


Back To Top