Data recovery vs. TRIM
TRIM wins.
The TRIM command available on modern SSD reduces the chances to successfully undelete a file. TRIM violates the most significant principle of the data recovery that “the data is not overwritten until the disk space is actually required to store another piece of data”.
Writing on a SSD is slower because before writing something to the block, it's needed to erase this block, and the erase operation is relatively slow. This is responsible for the performance degradation effect of the SSD when the performance starts to degrade as the device is filled to capacity, because there are no more blank blocks on the SSD.
To compensate for this performance degradation, a hardware command TRIM was implemented to erase the specified blocks in advance. TRIM is supported by most modern high capacity SSDs. TRIM is commanded by the OS (supported starting with Windows 7). When Windows 7 is in the idle state, it commands TRIM to erase those blocks which are not in use any longer.
TRIM violates the most significant assumption made in data recovery that “data is not overwritten until the disk space is actually required to store another piece of data”. Thus, it is no longer enough "not to write anything to the disk". Even if Windows just sits idle long enough, it wipes out the content of the files in the background. When you try to undelete a file, the content is all zeros.
If you delete a file, it is likely that the TRIM command will be issued soon and destroys the data completely. In case of catastrophic damage, when the entire disk is unreadable, becomes raw file system, or if Windows fails to start, there are no side effects from TRIM because the operating system is either not there or does not command TRIM for a raw filesystem drive.
The TRIM command available on modern SSD reduces the chances to successfully undelete a file. TRIM violates the most significant principle of the data recovery that “the data is not overwritten until the disk space is actually required to store another piece of data”.
Writing on a SSD is slower because before writing something to the block, it's needed to erase this block, and the erase operation is relatively slow. This is responsible for the performance degradation effect of the SSD when the performance starts to degrade as the device is filled to capacity, because there are no more blank blocks on the SSD.
To compensate for this performance degradation, a hardware command TRIM was implemented to erase the specified blocks in advance. TRIM is supported by most modern high capacity SSDs. TRIM is commanded by the OS (supported starting with Windows 7). When Windows 7 is in the idle state, it commands TRIM to erase those blocks which are not in use any longer.
TRIM violates the most significant assumption made in data recovery that “data is not overwritten until the disk space is actually required to store another piece of data”. Thus, it is no longer enough "not to write anything to the disk". Even if Windows just sits idle long enough, it wipes out the content of the files in the background. When you try to undelete a file, the content is all zeros.
If you delete a file, it is likely that the TRIM command will be issued soon and destroys the data completely. In case of catastrophic damage, when the entire disk is unreadable, becomes raw file system, or if Windows fails to start, there are no side effects from TRIM because the operating system is either not there or does not command TRIM for a raw filesystem drive.
Comments
Post a Comment