by Rob Williams on March 5, 2010 in Security, Solid-State Drives
It goes without saying that solid-state drives are well-worth the investment in order to give your PC some responsiveness, but with all the benefits they can offer, there’s one lesser-known issue that we’ll talk about here. That issue is simple. As soon as you delete a file on a TRIM-enabled SSD, the data is gone, for good.
We’ve covered a lot of ground here so far, so how about we actually try to prove that data recovery on a TRIM-affected drive is impossible? Although I’ve always been confident in the fact, I felt the only right thing to do would be to load up two SSD’s and put the theory to a good test.
The two drives we’re using for our testing were shown on the previous page, Kingston’s 80GB SSDNow M Series, 1G and 2G. These drives are based off of Intel’s own, so the 1G doesn’t support TRIM, but the 2G does just fine.
Before testing, I used HDDErase on the 1G drive in order to wipe it completely clean (you could consider this to be a form of TRIM, because it has the same effect… it just happens to affect the entire drive), and for the 2G, I simply installed it, as it was brand-new with no data ever written to it. For the OS, I used Windows 7 Ultimate x64, since it supports the TRIM command by default.
Because both drives were in a factory-fresh state, I used Windows’ “Computer Management” tool in order to both initialize and format the drives to NTFS.
The goal was to fill each drive with the exact same data (which was rather easy given we’re dealing with equal-sized drives), which I accomplished with the help of my personal documents folder. In total, the files copied to each drive weighed in at 79,873,675,264 bytes, or 74.3GB. With that much data on the drives, only 3MB was considered to be free space. Of all the space taken, it was attributed to 40,002 files and 670 folders.
As you can likely tell, there’s really no breathing room whatsoever on either of the two drives, which is what we were going for. We wanted to make sure that if even one file could be recovered, we’d have a good enough variety to make it so.
The first thing to do in Windows 7 when testing for TRIM is to see if it’s even enabled. To do so, you need to load up a command-line (Windows Key + R, then type in ‘cmd’, without quotes), and then type in this command:
fsutil behavior query disabledeletenotify
If this command returns a 0, it means that TRIM is enabled, and likewise, if it shows 1, then it means it’s not enabled, and that a TRIM-capable drive is not likely installed. Note that just because Windows says that TRIM is enabled doesn’t mean it’s “working”. Although there’s little reason for it not to, you’d want to run your own tests to make sure it’s working as it’s supposed to be.
With both of our drives filled to the absolute brim, I did a simple delete on each. There was nothing special done here, just a simple Ctrl + A to select all and then a swift push of the Delete key (followed of course by the typical “Are you sure?”). Could we recover anything? That’s to be seen on the next page.