Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Windows 10 / How to Recover Deleted Files from a TRIM-Enabled SSD?

November 14, 2019 MiscToolsWindows 10

How to Recover Deleted Files from a TRIM-Enabled SSD?

Currently, a large number of programs for recovering deleted files and partitions on a hard disk or USB drive are available. All these programs are based on the fact that when a file is deleted from the file system, its data and metadata continue to be stored on physical media until they are overwritten with new files. Data recovery software for PC allows you to scan a drive and find deleted files by signature or by analyzing unused data blocks. However, the classic file recovery apps does not work properly with SSDs (Solid State Drive). Let’s see why.

how to recover data from the solid state drive?

Contents:
  • Deleting Files on an SSD and the TRIM Command
  • SSD Devices Detection in Windows
  • How to Recover Data from SSD after File Deletion Using the EaseUS Data Recovery Wizard?

Deleting Files on an SSD and the TRIM Command

The process of deleting files on an SSD is fundamentally different from the process of deleting files on a traditional hard drive. When a file is deleted, the operation system sends an ATA interface TRIM command to the SSD device, which reports that this data is no longer needed. The SSD device marks these cells for deletion and sets all cells to zero in the background (with the separate garbage collection process). This allows you to quickly save data in the unused SSD cells and reduces wear of storage cells. Thus, the TRIM command forces the drive to physically clear unused data blocks.

As a result, any file recovery software sees only zeros in the SSD cells with deleted data. This means that if your SSD-drive is connected to the computer via the SATA interface, then it is almost impossible to recover deleted files from it. This also applies to the NVMe SSDs. For such devices, there is an analogue of the TRIM command, which is called – Deallocate (supported on Windows 8 and newer).

SSD Devices Detection in Windows

Windows by default enable the TRIM command for SSD drives that are connected via the ATA/IDE/SATA/M.2/PCI Express interface (but not USB!) in the AHCI mode. In addition, TRIM is enabled only for NTFS and REFS file systems. When these conditions are met, the TRIM command is automatically executed and the SSD background process cleans the cells almost immediately after you delete the file from the file system.

TRIM is enabled by default on MacOS for the Apple SSDs with APFS and HFS+ file systems. The Trim command is also sent immediately after the file is deleted.

You can recover deleted data files and partitions from an SSD drive if:

  • Your SSD is connected to the computer via USB or FireWire port;
  • You are using a RAID array of several SSD devices (Windows doesn’t enable TRIM for such a storage device);
  • You are using old OS version: Windows Vista, Windows XP, MacOS up to OS X 10.10.4 (TRIM is not supported in these versions);
  • TRIM is disabled at Operating System level;
  • Your SSD does not support TRIM commands (possibly on older SSD models);
  • The SSD is not formatted in the NTFS file system (for example, used FAT32, exFat, etc.).

How to Recover Data from SSD after File Deletion Using the EaseUS Data Recovery Wizard?

Let’s see if is it possible to recover deleted files from the Trim-enabled SSD using the popular EaseUS Data Recovery Wizard Free (there is a version for Mac and Windows).

The free version of EaseUS Data Recovery Wizard Free allows you to recover up to 500 MB of deleted files (or up to 2 GB if you share the program on Facebook or Twitter).

EaseUS Data Recovery Wizard is one of the best programs for quickly recovering lost data from various drive types.

Key features:

  • Data recovery from HDD, memory cards, external USB drives;
  • File recovery after deletion and quick formatting;
  • File system support: HFS+(macOS), NTFS/NTFS5/ReFS (Windows), ext2/ext3 (Linux), FAT/ExFat;
  • Logical partition recovery.

So, I have an SSD drive connected to my computer. Let’s check that one of the local disks (21 GB) is detected as an SSD using the PowerShell command:

Get-PhysicalDisk | Select Number, PhysicalLocation, MediaType, Size

powershell - Get-PhysicalDisk ssd info

Check if Trim is enabled for it:

fsutil behavior query DisableDeleteNotify

fsutil behavior query DisableDeleteNotify check TRIM state for SSD in Windows 10

The following result indicates that TRIM is enabled:

NTFS DisableDeleteNotify = 0 (Disabled)

Next I’ll delete one file from the SSD and try to restore it using the EaseUS Data Recovery Wizard:

  1. I downloaded and installed the EaseUS Data Recovery Wizard Free
    In order to prevent accidentally overwriting deleted blocks on a disk, you shouldn’t install the EaseUS Data Recovery Wizard on the same disk from which you want to recover files!
  2. Now I delete one file from the SSD drive; delete test file frm ssd
  3. Run a data recovery wizard in the EaseUS Data Recovery to perform a full scan of the SSD drive. Wait until the disk scan is complete. In my case, the data recovery programm could not find the deleted file.

EaseUS Data Recovery - recover file from SSD

Now try to disable TRIM with the command:

fsutil behavior set DisableDeleteNotify 1

If TRIM is disabled successfully, you will see a following message: “NTFS DisableDeleteNotify = 1 (Enabled)”.

On the macOS environment, you can disable TRIM with the command:
sudo trimforce disable

disable TRIM on SSD in Windows 10

I delete another file from the SSD drive and run a full disk scan with the EaseUS Data Recovery Wizzard. The file recovery program will instantly find the deleted file and offer to recover it.

recovering deleted files from SSD using EaseUS Data Recovery Wizzard

Select the file you want to recover and click the Recover button. When restoring a file, it is advisable to specify a different disk, so as not to accidentally overwrite the metadata on the source drive.

To enable the TRIM mode for your SSD, run the command:

fsutil behavior set DisableDeleteNotify 0

So, you cannot recover a deleted files from a Trim-enabled SSD drive. Even scanning file signatures doesn’t help.

To prevent the TRIM command from being applied to your SSD, you can

  • Connect your SSD device via USB, FireWire or Thunderbolt interface;
  • Disable TRIM on the OS-level. However, this reduces your SSD life span and maximum writing speed.

2 comments
5
Facebook Twitter Google + Pinterest
previous post
FAQ: Windows 10 Enterprise LTSC 2019 Explained
next post
VMWare vSphere: Failed to Upload Files to Datastore

Related Reading

Configure User’s Folder Redirection with Group Policy

February 3, 2023

Disable Built-in PDF Viewer in Microsoft Edge

February 3, 2023

Join a Windows Computer to an Active Directory...

February 2, 2023

Using Previous Command History in PowerShell Console

January 31, 2023

How to Install the PowerShell Active Directory Module...

January 31, 2023

2 comments

John Alexander June 2, 2020 - 10:57 am

This is by far the most informative and useful information I’ve found on SSD and file deletion/recovery – and I’ve researched this topic for quite a while. However, I don’t understand how data recovery companies are able to recover data from SSD and claim a 95%+ success rate (this is backed with a “no file recovery, then no payment” policy).

Reply
Graham Scott January 12, 2021 - 2:08 pm

The article describes a methodology that operates at the consumer level using the SSD in-situ, a non-modified operating system and recovery software readily available as an app (in many cases freeware) on the internet.

The 95% success rate originates with professional forensics laboratories analyzing SSDs taken from consumer based installations. These professional organizations have access to tools (software and hardware), and manufacturer information that is unavailable to the average consumer. With these tools they invariably de-package the target SSD and are able to readily access areas such as the over-provisioning area and Factory Mode reserved area. Most importantly they are able to take control of the internal SSD controller and (for example) terminate all garbage collection operations, whether foreground or background, as well as all TRIM operations. And the list goes on, but i hope this gives you some idea how easy it is to recover inaccessible data from a SSD.

Reply

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Configure User’s Folder Redirection with Group Policy

    February 3, 2023
  • Using Previous Command History in PowerShell Console

    January 31, 2023
  • How to Install the PowerShell Active Directory Module and Manage AD?

    January 31, 2023
  • Finding Duplicate E-mail (SMTP) Addresses in Exchange

    January 27, 2023
  • How to Delete Old User Profiles in Windows?

    January 25, 2023
  • How to Install Free VMware Hypervisor (ESXi)?

    January 24, 2023
  • How to Enable TLS 1.2 on Windows?

    January 18, 2023
  • Allow or Prevent Non-Admin Users from Reboot/Shutdown Windows

    January 17, 2023
  • Fix: Can’t Extend Volume in Windows

    January 12, 2023
  • Wi-Fi (Internet) Disconnects After Sleep or Hibernation on Windows 10/11

    January 11, 2023

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Microsoft KMS Volume Activation FAQ
  • Configuring Kerberos Authentication in Different Browsers
  • IPMI: Configuring SuperMicro Remote Management Interface
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top