Too TRIM? When SSD Data Recovery is Impossible
It goes without saying that solid-state drives are well-worth the investment in order to give your PC some responsiveness, but with all the benefits they can offer, there’s one lesser-known issue that we’ll talk about here. That issue is simple. As soon as you delete a file on a TRIM-enabled SSD, the data is gone, for good.
Have you ever upgraded your PC from one generation to the next and wondered where the performance-boost was to be found? Certainly, our CPU’s continue to get through tasks faster and faster, but when it comes to real responsiveness, that brand-new $2,000 beast could easily leave you with little more than a sigh. And if you’re anything like me, you load up numerous applications after booting to the desktop, and that’s when you really notice the lack of responsiveness.
But here comes along the modest solid-state drive, a brilliant invention that places ultra-fast NAND flash and effective controller in a small 2.5-inch chassis that can make even the fastest mechanical hard drive eat dust. It’s true, SSD’s can drastically improve your PC’s responsiveness, and to be honest, I don’t think it was until they hit the market that many of us realized just how much of a bottleneck our mechanical storage has been.
But not to detract from our topic at hand, our focus of this article isn’t to push SSD’s, but rather to take a look at a problem that doesn’t seem to have attracted much attention since TRIM was introduced last fall. It’s arguably a small issue, to be fair, but it’s certainly one that deserves being talked about.
The Reason for TRIM, and its Downside
As solid-state drives began to catch on, and Intel was quickly becoming known as a God-like controller developer, a major flaw was discovered… speed degradation. At first, it was believed that only Intel’s drives were at risk, but it turns out that pretty much every model on the market shared the same inherent issue.
Almost all of the storage devices we use on a regular basis handle files we delete similarly. Once a file is deleted, the link to that data, stored in the storage device’s indexer (normally the LBA for mechanical drives) is simply wiped clean. As a real-world comparison, imagine having a paper index of all of the movies in your collection, but you burn it up. The indexer would essentially be gone, but your movies haven’t moved. It’s the same situation with data storage.
Because the data is left in tact, data recovery is possible – at least, until that exact block is overwritten with fresh data. Anyone who’s accidentally deleted a file and later recovered it with a recovery tool can probably appreciate this sort of fail-safe. When SSD’s came along, this method of handling data didn’t change, but what did change was the speed that the process could complete.
Mechanical drives are able to overwrite data with virtually no performance penalty, which is why even after years of use, the performance doesn’t seem to degrade. The situation is different with SSD’s, though, due to how NAND flash works.
To give a brief explanation of why this is the case, picture simple fragmentation. As more and more data is written to various blocks on a storage device, anything to be deleted later from the same block isn’t likely to take all of the data within the block with it. There may be a few 4K blocks that are part of an image, for example, and another few 4K blocks that are part of a Word document. If you delete that image, the remnants of the Word document remain.
After a certain amount of time, these blocks end up in a very cluttered state, which basically explains the reason of performance degradation. So then we have garbage collection schemes, which help in this area by occasionally removing all loose data in a certain block and moving it to a more convenient one. But that doesn’t rid the issue of an SSD having to write more than a block’s worth of data.
For that process to take place, the SSD must first purge the data in the block, then write the fresh data to it. Compare this to a mechanical drive which simply overwrites the old data. It’s easy to spot why there would be a hit in performance on the SSD. That’s where TRIM comes in.
First widely deployed with Windows 7, TRIM is a brand-new ATA command that the OS will issue to the SSD when a certain request is made, such as Delete, Format or Discard. What it does is rather simple, but it’s immensely helpful. When you either delete a file, or format the entire SSD, TRIM will purge both the data and the link to it, so in essence, it’s gone. There is no trickery, or any advanced algorithms being used to wipe the block clean… it’s simply cleaned, and left in a ready-to-use state.
The final statement in the last paragraph is the reason for this article. One of the more overlooked aspects of TRIM, as amazing and helpful as the command is, is that once it’s issued, your chance of data recovery has essentially gone to 0. As mentioned earlier, data recovery on hard drives, and even non-TRIM affected SSD’s, is made rather simple. You just need to run a reliable recovery tool and you’ll likely get the data back, as long as that particular block or set of blocks hasn’t been overwritten since you deleted your file.
You might be asking, “What’s the big deal?”, and if so, that’s a great question. I am sure I’m not alone in having deleted an important file at some point in the past. There have been occasions where I haven’t been able to get my data back, but other times, tools such as testdisk proved to be an absolute life-saver. There are few levels of relief as high as the one you get when you successfully recover that all-important file.
But on an SSD with TRIM enabled, if you delete a file (and subsequently empty the Recycle Bin / Trash), you’re simply not going to get your data back. As far as I’m aware, even with forensics, the data recovery simply isn’t going to be possible. Unlike mechanical hard drives, which hold data magnetically, all it takes for NAND to assuredly erase the data is that little command, and boom, gone.
Whether or not TRIM on a mechanical hard drive would absolutely render the data unrecoverable is impossible for me to say. If I had to assume, the data would be unrecoverable for a consumer, but in the right hands, and with the proper tools, it might be. NAND in some regards acts similarly to the memory (RAM) in our PCs. As soon as the charge is lost, the data in all the memory chips is gone (cold boot recovery from RAM is possible because the charge is never lost).
Setting Ourselves Up for the Test
We’ve covered a lot of ground here so far, so how about we actually try to prove that data recovery on a TRIM-affected drive is impossible? Although I’ve always been confident in the fact, I felt the only right thing to do would be to load up two SSD’s and put the theory to a good test.
The two drives we’re using for our testing were shown on the previous page, Kingston’s 80GB SSDNow M Series, 1G and 2G. These drives are based off of Intel’s own, so the 1G doesn’t support TRIM, but the 2G does just fine.
Before testing, I used HDDErase on the 1G drive in order to wipe it completely clean (you could consider this to be a form of TRIM, because it has the same effect… it just happens to affect the entire drive), and for the 2G, I simply installed it, as it was brand-new with no data ever written to it. For the OS, I used Windows 7 Ultimate x64, since it supports the TRIM command by default.
Because both drives were in a factory-fresh state, I used Windows’ “Computer Management” tool in order to both initialize and format the drives to NTFS.
The goal was to fill each drive with the exact same data (which was rather easy given we’re dealing with equal-sized drives), which I accomplished with the help of my personal documents folder. In total, the files copied to each drive weighed in at 79,873,675,264 bytes, or 74.3GB. With that much data on the drives, only 3MB was considered to be free space. Of all the space taken, it was attributed to 40,002 files and 670 folders.
As you can likely tell, there’s really no breathing room whatsoever on either of the two drives, which is what we were going for. We wanted to make sure that if even one file could be recovered, we’d have a good enough variety to make it so.
The first thing to do in Windows 7 when testing for TRIM is to see if it’s even enabled. To do so, you need to load up a command-line (Windows Key + R, then type in ‘cmd’, without quotes), and then type in this command:
fsutil behavior query disabledeletenotify
If this command returns a 0, it means that TRIM is enabled, and likewise, if it shows 1, then it means it’s not enabled, and that a TRIM-capable drive is not likely installed. Note that just because Windows says that TRIM is enabled doesn’t mean it’s “working”. Although there’s little reason for it not to, you’d want to run your own tests to make sure it’s working as it’s supposed to be.
With both of our drives filled to the absolute brim, I did a simple delete on each. There was nothing special done here, just a simple Ctrl + A to select all and then a swift push of the Delete key (followed of course by the typical “Are you sure?”). Could we recover anything? That’s to be seen on the next page.
Over the years, I’ve experimented with quite a bit of data recovery using various tools I’ve stumbled on. Sometimes, I’ve found, you don’t need a commercial tool to get the job done, because depending on the type of deletion, the very robust and cross-platform testdisk is all that’s needed to get the job done. I should also mention that if you ever need to recover multimedia, like pictures and videos, you should check out the Photorec tool from the same developer.
When testdisk fails to get your data back, your best choice is to go to the experts. Over the years, I’ve found three different commercial tools that I enjoyed testing with, so I used the same three here. Of these, R-Studio might be my favorite, primarily due to its ease-of-use, and also because it has the nicest aesthetics. It’s also quite affordable at $80 and holds no real limitations like other similarly-priced offerings. The two others I tested with (mainly to use as a backup) were Ontrack’s EasyRecovery and O&O’s DiskRecovery.
I should note that while I personally prefer R-Studio the most, if you ever want to consider purchasing any of the three above-mentioned tools, or any other not mentioned, make sure to give the available trials/demos a try. If you are looking to recover data right at that point in time, you can try multiple tools to see if one is more effective at recovering data than another.
That said, let’s get into testing. The first program I used for testing was R-Studio, and the results are seen below:
I admit that I was a bit struck by the fact that the TRIM-enabled drive still had so much pink (meaning there were “documents” found), but upon closer inspection, the facts became clear. On the left is the non-TRIM drive, and it shows that 288,407 files were found (ultra-inflated numbers are common with data recovery), while for the TRIM-enabled drive, that number plummeted to 488. So, does that mean that some files could be recovered? Not quite.
While there are some traces of files found, everything is broken, so nothing changes with regards to recovery. Some of the pink could be due to the file system stepping in as well. I’m not sure of the full story here, but the fact that data could be found does nothing but instill false hope to those who think there’s a chance of getting their data back.
To help prove it, I took a look through each drive’s recovery report and found files that both drives still had linked. I should note that the non-TRIM drive essentially had everything available, because nothing else was written over the data since. I recommend ignoring all of the X’s, because they pretty much tell you recovery isn’t possible (or so common-sense would tell you), but that’s not really the case. Most data is usually recoverable as long as you don’t overwrite it. So if you delete or format a drive, virtually all of the data should be immediately available through recovery.
I should also note that while it isn’t obvious, the TRIM-enabled drive found only two of the actual root folders (Games and Pictures) out of the original seven.
The file I found to recover is one I had for my favorite MMORPG (Asheron’s Call). It’s one of the screenshots from pre-beta, and at this point, it’s over 11 years old. If this was an important file, and lost, it would be upsetting to lose, but on the non-TRIM drive, it wasn’t any issue. On the TRIM drive, even though it was listed, and was “recovered”, you can see that the result wasn’t so good.
I of course tried to recover other files, and again, no cigar. I even tried to recover ultra-small text documents that were mere kilobytes, and again, recovered fine on the non-TRIM, and not whatsoever on the TRIM. One oddity of file recovery is that usually, the file size you recover is exactly the same as the original, but the data is completely corrupt, or is simply zeros. In the case of text documents I recovered (I didn’t show any due to the fact that those I found were of a personal nature), they were just empty when opened up in Notepad, despite having the exact same file-size as the original file.
For some reinforcement, I ran scans on both drives once again with both Ontrack and O&O’s respective tools.
As seen in the above screenshots, the TRIM-enabled drive just had no luck when it came to delivering a full real index of files. All it had left were scraps, and even then, no data was recoverable. It’s official. Recovering data from a TRIM-erased drive is just not going to happen.
As we have seen with our testing, data recovery on a TRIM-enabled SSD is simply a lost cause. As soon as the command is issued, you may as well kiss your data goodbye. Interestingly, some traces to specific data remained, and that’s one oddity I don’t quite understand. It could have something to do with the NTFS file system, though. As Windows formatted the drive, it may have left some of the index in tact, for whatever reason. But it’s clear that despite any index, the data is gone, long gone.
I should also mention that while our testing here may seem rather simple, and non-exhaustive, this is a project I’ve been working on since mid-December. It’s just taken about this long for an article to come to fruition, for a couple of reasons – namely, thanks to the amount of time other content required. In all this time, I’ve tested non-TRIM vs. TRIM recovery many times, so I’m very confident in all of my findings. What I find a bit interesting, though, is that in our most recent run, traces of data were found, but in months past, I’ve had runs where absolutely nothing was found after a deletion. So in that regard, it seems a little random, but the ultimate reality is that once the data is gone, it’s gone.
While I was doing research for this article, and of course hands-on testing, I e-mailed numerous companies for some information on the subject, and surprisingly enough, I didn’t receive a single worthwhile response from anyone. The companies I contacted included data recovery firms, SSD manufacturers and even T13, the company that governs the ATA standards.
The companies I received responses from were a couple of SSD vendors and also a single data recovery firm. The SSD vendors simply couldn’t answer our questions – not even their engineers – and the data recovery firm simply left me hanging, not once, but twice. It almost felt like no one wanted us to know the full story behind data recovery and TRIM, so given that, all of our opinions are based on personal findings only.
Although the focus of this article is to point out something that we should all be aware of with the TRIM command, I don’t at all mean to put it in a poor light. That’s the last thing I’d do, because it’s clear that TRIM is the reason our SSD’s are going to keep good performance numbers for the life of us using them. TRIM might have this one caveat, but aside from that, it’s an absolute necessity if you want to retain high performance numbers and an overall clean SSD.
What I am trying to advocate, though, is that backing up is made even more important with TRIM usage. On non-TRIM storage, if you delete a file, you still have a chance of getting it back. But with a TRIM-enabled drive, it’s long gone… you’re just not getting it back. Although I can’t confidently state that even forensics couldn’t get the data back, I’m leaning towards that being the case. Like computer RAM, once the data is cleared from the memory chip, it’s vanished.
We haven’t made it a secret before that backing up is important, because it is. Far too many times I’ve lost data due to my own idiocy, and I can say I’ve officially had enough and learned my lesson. While the TRIM “issue” affects few people right now, it’s only a matter of time before SSD’s are far more commonplace, and people who aren’t paying attention are of course going to lose valuable data. So be careful out there, and for the love of bytes, back your data up!