Too TRIM? When SSD Data Recovery is Impossible

by Rob Williams on March 5, 2010 in Security, Storage

It goes without saying that solid-state drives are well-worth the investment in order to give your PC some responsiveness, but with all the benefits they can offer, there’s one lesser-known issue that we’ll talk about here. That issue is simple. As soon as you delete a file on a TRIM-enabled SSD, the data is gone, for good.


Have you ever upgraded your PC from one generation to the next and wondered where the performance-boost was to be found? Certainly, our CPU’s continue to get through tasks faster and faster, but when it comes to real responsiveness, that brand-new $2,000 beast could easily leave you with little more than a sigh. And if you’re anything like me, you load up numerous applications after booting to the desktop, and that’s when you really notice the lack of responsiveness.

But here comes along the modest solid-state drive, a brilliant invention that places ultra-fast NAND flash and effective controller in a small 2.5-inch chassis that can make even the fastest mechanical hard drive eat dust. It’s true, SSD’s can drastically improve your PC’s responsiveness, and to be honest, I don’t think it was until they hit the market that many of us realized just how much of a bottleneck our mechanical storage has been.

But not to detract from our topic at hand, our focus of this article isn’t to push SSD’s, but rather to take a look at a problem that doesn’t seem to have attracted much attention since TRIM was introduced last fall. It’s arguably a small issue, to be fair, but it’s certainly one that deserves being talked about.

The Reason for TRIM, and its Downside

As solid-state drives began to catch on, and Intel was quickly becoming known as a God-like controller developer, a major flaw was discovered… speed degradation. At first, it was believed that only Intel’s drives were at risk, but it turns out that pretty much every model on the market shared the same inherent issue.

Almost all of the storage devices we use on a regular basis handle files we delete similarly. Once a file is deleted, the link to that data, stored in the storage device’s indexer (normally the LBA for mechanical drives) is simply wiped clean. As a real-world comparison, imagine having a paper index of all of the movies in your collection, but you burn it up. The indexer would essentially be gone, but your movies haven’t moved. It’s the same situation with data storage.

Because the data is left in tact, data recovery is possible – at least, until that exact block is overwritten with fresh data. Anyone who’s accidentally deleted a file and later recovered it with a recovery tool can probably appreciate this sort of fail-safe. When SSD’s came along, this method of handling data didn’t change, but what did change was the speed that the process could complete.

Kingston's SSDNow M Series Solid-State Drives
Kingston’s SSDNow M Series – 1G & Non-TRIM (Left), 2G & TRIM (Right)

Mechanical drives are able to overwrite data with virtually no performance penalty, which is why even after years of use, the performance doesn’t seem to degrade. The situation is different with SSD’s, though, due to how NAND flash works.

To give a brief explanation of why this is the case, picture simple fragmentation. As more and more data is written to various blocks on a storage device, anything to be deleted later from the same block isn’t likely to take all of the data within the block with it. There may be a few 4K blocks that are part of an image, for example, and another few 4K blocks that are part of a Word document. If you delete that image, the remnants of the Word document remain.

After a certain amount of time, these blocks end up in a very cluttered state, which basically explains the reason of performance degradation. So then we have garbage collection schemes, which help in this area by occasionally removing all loose data in a certain block and moving it to a more convenient one. But that doesn’t rid the issue of an SSD having to write more than a block’s worth of data.

For that process to take place, the SSD must first purge the data in the block, then write the fresh data to it. Compare this to a mechanical drive which simply overwrites the old data. It’s easy to spot why there would be a hit in performance on the SSD. That’s where TRIM comes in.

First widely deployed with Windows 7, TRIM is a brand-new ATA command that the OS will issue to the SSD when a certain request is made, such as Delete, Format or Discard. What it does is rather simple, but it’s immensely helpful. When you either delete a file, or format the entire SSD, TRIM will purge both the data and the link to it, so in essence, it’s gone. There is no trickery, or any advanced algorithms being used to wipe the block clean… it’s simply cleaned, and left in a ready-to-use state.

SSD's - TRIM and Data Recovery

The final statement in the last paragraph is the reason for this article. One of the more overlooked aspects of TRIM, as amazing and helpful as the command is, is that once it’s issued, your chance of data recovery has essentially gone to 0. As mentioned earlier, data recovery on hard drives, and even non-TRIM affected SSD’s, is made rather simple. You just need to run a reliable recovery tool and you’ll likely get the data back, as long as that particular block or set of blocks hasn’t been overwritten since you deleted your file.

You might be asking, “What’s the big deal?”, and if so, that’s a great question. I am sure I’m not alone in having deleted an important file at some point in the past. There have been occasions where I haven’t been able to get my data back, but other times, tools such as testdisk proved to be an absolute life-saver. There are few levels of relief as high as the one you get when you successfully recover that all-important file.

But on an SSD with TRIM enabled, if you delete a file (and subsequently empty the Recycle Bin / Trash), you’re simply not going to get your data back. As far as I’m aware, even with forensics, the data recovery simply isn’t going to be possible. Unlike mechanical hard drives, which hold data magnetically, all it takes for NAND to assuredly erase the data is that little command, and boom, gone.

Whether or not TRIM on a mechanical hard drive would absolutely render the data unrecoverable is impossible for me to say. If I had to assume, the data would be unrecoverable for a consumer, but in the right hands, and with the proper tools, it might be. NAND in some regards acts similarly to the memory (RAM) in our PCs. As soon as the charge is lost, the data in all the memory chips is gone (cold boot recovery from RAM is possible because the charge is never lost).

  • James Hatton

    Hey, Thanks for your great write up. I got plenty from that.
    Can you tell me, if TRIM is enabled on the SSD within the OS and you have data on a conventional HDD and you delete a file from the HDD does it bypass the Trash can? Does it get permanently deleted?
    As in…if I have TRIM enabled and delete the file on the conventional HDD within the same OS will I need specific recovery tools to simply undelete it….unlike if the whole system was non-Trim and using conventional HDD where you could just restore from the Trash?

    Is there a way of using TRIM and still have Trash can working for all other drives and in particular User data drives. I use my SSD Intell 180GB drive for my OS only and I have several other storage drives in use for other data. I am trying to figure out how to use Windows Shadow copy but only on “some drives” and it seems as though this feature is either enabled r it isn’t no inbetweens in this case? I maybe doing something wrong here but I have not found any info in my searches? Regular backups of these drives means a huge amount of backup storage needs to be free which really sucks. Windows backup cannot backup anything until Shadow Copy service running and a restore point it created. So I am forced to enable the system restore. Run the backup and then disable the system restore. I want to do this for only the SSD but the system restore wipes all restore points when it is disabled which also sucks. It would be great to enable it. Take a snapshot and disabled it and/or disable it for one drive only and keep it running for the rest of the PC.

    I switched back to Windows backup also because Acronis completely hosed one of my backups and there has been absolutely no help from any of their tech support. They pretty much shit blame around and basically tell the users that it is their fault that they are doing something wrong bla bla bla I didn’t even waste my time posting on their forums or asking for support after what I had read. My clean 100% untouched backup to them is corrupt. Something I have never had an issue with using the standard Windows backup? So for what it’s worth I went back to using it and said good bye to Acronis backup forever. I will never use their software again. I diverse.

    Have you looked at the performance that people are claiming out of the new RAID 0 as well as TRIM? They set up using multiple smaller SSDs, the outcome has tech people throthing at the mouth for this but support from intel is….well…..questionable. Forget older technology being supported. Speeds though are meant to be incredible!

    For reference ^^^^

    • Rob Williams

      “Can you tell me, if TRIM is enabled on the SSD within the OS and you have data on a conventional HDD and you delete a file from the HDD does it bypass the Trash can? Does it get permanently deleted?”

      When something is deleted and placed in the Recycle Bin, the data gets moved to a hidden folder on the same drive and remains there until it’s permanently deleted (eg: when the Recycle Bin is emptied). TRIM doesn’t affect anything except data actually located on the SSD itself.

      By your wording, it sounds like you think that when a file is deleted off a hard drive, it gets copied over to the SSD’s Recycle Bin – but no, it doesn’t work like that. Whatever’s in the Recycle Bin is linked to its original location; it’s not all routed through the SSD.

      “My clean 100% untouched backup to them is corrupt.”

      This is why I keep multiple backups of the same Acronis .tib file. I’ve only ever encountered this particular issue once, and it was a number of years ago. But I never want to take a chance. I’d also recommend always using the validate option to make sure backups are captured successfully. You can also setup Acronis in Windows to automatically re-validate backups every so often to make sure no corruption occurs. I am not sure where you see a connection to TRIM here, but TRIM definitely has nothing to do with it. TRIM -only- affects deleted data, and on the SSD that said data was on.

  • angelina410329
  • angelina410329

    with the widely use of SSD drive, SSD drive data loss issues will also be paid attention to. Even when you take every precaution to avoid it, the day may still come when you have to face it. SSD drive recovery software is usually the first place people turn to solve their SSD drive data recovery issues. Usually, a free data recovery software will be the best choice.

  • Alva J. Starks

    All I know is that my SSD died and I had no idea what to do. I thought my data was gone forever. I was looking for articles on who would be able to tell me how to get my data back. I finally found a company SERT who actually did recover my data and wasnt as expenisve as some of the others like OnTrack and DriveSavers. So it is actually possible.

    • Rob Williams

      When an SSD “dies”, its data isn’t lost – it’s just inaccessible, until an expert gets ahold of it and is able to work their magic. That’s different than trying to get the data back after it’s been outright deleted, which is what this article’s focusing on.