Windows filesystems and TRIM

By -

On NTFS, the process of file deletion is not limited by only the work of the file system driver such as zero filling pointers in MFT. Physical or virtual store takes part in this process as well. The filesystem driver sends a TRIM command to the store driver informing a data storage device that the blocks containing file data are not used any longer and therefore can be erased.
Depending on the type of underlying device, TRIM can lead to different results:
  • for a volume located on a regular hard drive, TRIM has no effect;
  • for a volume created in Storage Spaces, TRIM leads to unexpected consequences depending on how the files are located in relation to 256 MB slabs of Storage Spaces;
  • for an SSD, exactly for which the TRIM command was introduced, the blocks that are no longer in use are erased immediately.
However, it should be noted that NTFS never frees blocks with metadata and so the NTFS filesystem driver never sends the TRIM command to erase these blocks. This NTFS peculiarity generates one interesting consequence - since NTFS stores content of small files (resident files) along with metadata, these small files can be recovered even if the TRIM command is used.
As for ReFS filesystem, it doesn't use resident files and therefore nothing can be recovered if the TRIM command was applied on a ReFS volume.

Comments

Post a Comment

Popular posts from this blog

QNAP Data Recovery

By -
Image
We were doing some experiments with our QNAP TS-639: pulled off six drives storing several real shares total capacity of 7.5 TB, inserted new blank drives and created a new RAID5 over them, made new test shares, loaded the data to them, and turned off the system. When we put the old disks (with real shares) to the corresponding bays and turned on the unit, the system has booted without a problem but…our Windows 7 PC could no longer see the NAS. QFinder 6.2.0.0726 saw the NAS and reported that the QNAP had an IP address. More than that, all the shares were available in the Control panel of QFinder.   Went to the General setting in QFinder and everything looked good in there: Tried to map a network drive as described here and got the following: " Network failure: the device was not found on the network. Please check the device status. " In Windows Network we had the following: Clicked the NAS from the...
Read more

APFS Data Recovery

By -
Apple File System, APFS for short, is a brand-new filesystem released in 2017. The goal is to replace HFS+ which has been in use on Apple computers since 1998. Formally released in late 2017, APFS filesystem began to be used by default on Apple computers running under MacOS High Sierra. Among the main features of APFS filesystem are 64-bit pointers allowing to address 2^56 blocks More accurate created/accesses/modification time measured in nanoseconds since 1970-01-01 Copy-on-write Sharing blocks between APFS volumes Native full-disk encryption We are happy to announce that now ReclaiMe data recovery software is capable of recovering data from APFS-formatted devices be it a USB thumb drive, or external hard drive, or internal SSD boot drive. You can download the latest build of ReclaiMe at www.ReclaiMe.com .
Read more