Data Recovery from SSDs: Worth a Try

• Oleg Afonin
• Published: June 11, 2014
• Updated: December 16, 2024

Data recovery from SSD drives is a controversial topic. Does TRIM render all data recovery efforts useless, or do we still have a chance? Apparently, you often have a good chance of getting your data back even in what seems to be the worst situation.

A lot has been written about solid-state storage and about the ill effect on data recovery caused by some of the technologies used in SSD drives. TRIM, constant remapping of physical addresses, background garbage collection and some other technologies all negatively affect your ability to recover deleted files from SSD disks.

That’s the theory

In reality, we found that more often than not, we were still able to successfully recover information from SSD drives. Our experience contradicts the theory saying that once data is deleted from an SSD drive, it’s trimmed and cleaned up by the internal garbage collection mechanism as soon as the drive has some idle time. However, this does not happen all the time.

Knowing a lot about why and how SSD handle data destruction, we were really surprised to see most of the data available to our recovery tools days and weeks after it’s been deleted. With more and more SSD drives passing through our hands, we became really cautious of what was going on. So we embarked on a research. We started noting things about the disks that had deleted data on them, and those that did not have anything available to recover. Quite soon we started getting the picture.

So what are the reasons of SSD drives NOT destroying trimmed data?

The top reason is cost savings. Many low-end laptops and sub-notes are equipped with what their manufacturers called “solid-state storage”. Not to be confused with real SSD drives, this is just cheap, flash-based storage that has none of the advanced wear leveling and performance optimization techniques found in “proper” SSD drives. When recovering data from such devices, we are seeing pretty much the same picture as when recovering magnetic hard drives.

Some manufacturers rush new SSD models on the market, which results in buggy firmware. Firmware bugs may be relatively harmless (by e.g. not implementing garbage collection in a proper manner), but they can also be severe enough to brick the drive after a short while (as was the case with Crucial M4 series SSD drives). As most users never update their SSD firmware, their drives may not be properly configured to process data trimming.

Magic Partition Recovery

Recover lost information, repair broken partitions and rebuild damaged file systems in fully automated mode.

Free Download

On the other end of the spectrum are high-end, ultra-slim ultrabooks that have no space inside even for a thin, 7mm SSD drive. These often use exotic types of storage such as SSD drives mounted as PCI Express devices. At the time of this writing, no version of Windows is known to support TRIM on such devices, hence we are often able to recover data from these disks with no problem.

Finally, we have overengineering. Striving for ultimate performance, some manufacturers rushed to release notebooks with two SSD drives inside configured as high-performance RAID arrays. While we do have TRIM support in such configurations, just a year ago there was no way to pass the TRIM command into a RAID of SSDs. As a result, SSD drives from many such systems remain recoverable.

Do you have a story about recovering files from an SSD drives? Share it by posting a comment at our Facebook!

• Oleg Afonin
• Technical Writer
• June 11, 2014

Oleg Afonin is a technical specialist in the field of data recovery, an expert in digital forensics. He is the author of numerous publications on mobile forensics and IT security. Oleg often speaks at conferences such as HTCIA, Techno Forensics, CEIC, FT-Day.