Windows filesystems and TRIM
On NTFS, the process of file deletion is not limited by only the work of the file system driver such as zero filling pointers in MFT. Physical or virtual store takes part in this process as well. The filesystem driver sends a TRIM command to the store driver informing a data storage device that the blocks containing file data are not used any longer and therefore can be erased.
Depending on the type of underlying device, TRIM can lead to different results:
- for a volume located on a regular hard drive, TRIM has no effect;
- for a volume created in Storage Spaces, TRIM leads to unexpected consequences depending on how the files are located in relation to 256 MB slabs of Storage Spaces;
- for an SSD, exactly for which the TRIM command was introduced, the blocks that are no longer in use are erased immediately.
However, it should be noted that NTFS never frees blocks with metadata and so the NTFS filesystem driver never sends the TRIM command to erase these blocks. This NTFS peculiarity generates one interesting consequence - since NTFS stores content of small files (resident files) along with metadata, these small files can be recovered even if the TRIM command is used.As for ReFS filesystem, it doesn't use resident files and therefore nothing can be recovered if the TRIM command was applied on a ReFS volume.