SSD Data Deletion Explained: Why SSD Data Recovery is so Difficult?

When a file is deleted on an SSD, what unfolds behind the scenes is a bit complex than it appears on the surface. Unlike a hard disk drive, where data is directly overwritten, SSDs manage the data in a way that is often irrecoverable. 

When the user deletes a file, the operating system is instructed to delete it. What operating system does rather than immediately removing the file content, it marks the space occupied by that file (the file to be deleted) as available for reuse? The data still resides in the pages, but the operating system no longer maintains a pointer to it. 

The TRIM plays an essential role in the entire process of deletion. Made specifically for SSDs, TRIM helps the operating system to inform the drive about any blocks of data that are no longer in use. Once the pointer has been logically removed, the TRIM command signals the controller that the pages containing the data to be deleted should be treated as invalid. Then Garbage collection enters the scene and clears these invalid pages. 

Note: Since the data can only be erased at the block level, the controller ensures that the valid pages inside the block to be erased are copied to a fresh location in the meantime. Once a block contains only invalid pages, garbage collection erases it completely. 

Garbage collection occurs actively as a hidden process, often without user awareness. 

These three things, combined (Controller, TRIM, and garbage collection), create a highly proficient tool for managing data. Therefore, once TRIM + GC has completed, data recovery is effectively impossible — even for forensic labs.

A little on how data is stored and erased in SSDs

At the core of the NAND flash, which is the primary storage medium in SSDs, lie nanoscopic cells. Each cell can hold one, two, three, or four bits of data. An SLC cell can be charged or discharged at a time. Other cells, such as TLC or QLC, can have different charge levels to represent different bit values. Any data (images, videos, etc.) on our computer is composed of these bits, i.e., 0s and 1s. Generally, the charged state (in SLC) represents a bit value of 0, while a discharged state is considered 1.

A raw series of 0s and 1s by itself has no inherent meaning.

Now, when we delete any data from your computer, all the memory cells containing its information, in the form of bits, are marked as invalid. The cells still hold their state (charged or discharged). If the operating system doesn’t run TRIM and Garbage collection, these cells will stay in the same state, and using some recovery algorithms, we can easily retrieve our data.

In hard drives, techniques such as file system analysis, signature-based carving, and magnetic remanence analysis are employed. In SSDs or flash memory, Flash Translation Layer (FTL) mapping reconstruction, Pattern matching & carving, Error Correction Code (ECC) exploitation, and Chip-off methods are used.

However, when the TRIM and Garbage collection algorithms run, these invalid blocks are erased, which means all the cells are now charged. They are now again a raw series of bits and hold no data. In this case, there is no way we can recover the deleted data.

As everything is cleared, the mapping tables (FTL) and the metadata are also removed. Even if it exists, it will not matter because the actual data has been cleared from its very basic level.

Analogy: Sticky Notes on a Whiteboard

Imagine a big whiteboard divided into boxes (blocks), and inside each box are smaller sticky notes (pages). Each sticky note can hold a word or a number. It’s your data.

When you “delete” a file, the computer doesn’t erase the sticky note immediately. Instead, it simply removes the title from the index (much like erasing the note’s label in a catalog). The sticky note with the writing is still there for now.

TRIM is like the teacher walking by, marking those sticky notes with a red X, saying: “These are no longer needed; you can reuse them later.”

The janitor then comes in at some point, collects all the sticky notes with red Xs, and discards them. But here’s the catch: The janitor can’t erase just one sticky note at a time (SSDs erase at the block level).

So before wiping the whole box, they carefully copy the still-useful sticky notes into a fresh box, then erase the entire old one.

Once those sticky notes are physically tossed in the trash (cells erased), there’s no pencil mark left behind to read. Unlike an old chalkboard (like an HDD platter), where faint chalk residue can sometimes be recovered, the whiteboard here is wiped perfectly clean.

Scenarios Where Recovery Is Possible (and Not Possible)

Yet there are specific scenarios where recovering the data from an SSD is possible. One such common situation where recovery may happen is when the TRIM command is disabled and not executed. Since TRIM is responsible for marking the pages of deleted files for erasure, its failure to function leaves the deleted data intact on the NAND flash cells for a particular temporary period. At this time, there is a chance that the data recovery tool may access and restore the file fragments because the SSD has not yet been instructed to erase the physical pages. However, in modern operating systems like Windows 10 and macOS, TRIM is typically enabled by default, which means the appearance of circumstances that require recovery is likely sporadic unless the system is somehow misconfigured or the drive is connected to a system that doesn’t support TRIM. 

Another scenario where recovery in SSD may seem possible is the accidental formatting or file system damage. When formatting the drive, the process typically does not erase the data blocks; instead, it typically erases the file allocation table and directory structure, particularly during the quick format. If TRIM is not triggered in the event of a format, the data may still be present, allowing specialized recovery software to perform its job and retrieve the information. Similarly, suppose the file system experiences a crash due to malware or other issues. In that case, the file may remain physically intact, except that the pointer is lost and the system is no longer able to locate it. 

Data Recovery Methods for SSDs

Recovering data from an SSD requires a different approach altogether from traditional HDDs. One of these methods is software-based recovery, which advances into the system by scanning the drive for deleted files, piecing together the data collection by its pointer addresses (serial data must have been stored at a continuous pointer), and rebuilding its directory structure. It all happens successfully only where the TRIM has not been enabled and the garbage collection has not been executed behind the scenes. However, software also faces some limitations in scenarios where wear-leveling algorithms spread file fragments across different locations in the NAND memory, making the overall recovery task even more challenging, even for the most advanced software.

Since the hardware-based recovery is too complex, professional data recovery labs equipped with advanced imaging tools, cleanrooms, and software capable of examining the mapping and encryption used by SSD controllers are almost always required.

The most common methods for recovering data from SSDs involve file system reconstruction and signature-based carving, where recovery software scans the drive for metadata structures or known file patterns to rebuild lost files. In forensic scenarios, more advanced techniques such as flash translation layer (FTL) mapping analysis or chip-off forensics are employed, but for everyday recovery, signature carving and file system analysis remain the most practical and widely used approaches.

How to Improve Your Chances of Recovery After Data Loss

If a data loss occurs, the immediate action taken is most likely to succeed. Trying to act immediately means you are looking for something that the SSD’s garbage collection has not yet targeted. You must avoid using the drive immediately and refrain from even simple tasks, such as booting the OS or installing recovery software, as the SSD is constantly involved in shuffling and reshuffling data during its garbage collection process. The best way is to remove the drive from the system and attach it to another machine for further analysis. 

Some SSD manufacturers’ software will allow you to enable or disable TRIM, which can be helpful. Disabling TRIM immediately when you realize you have deleted an important file can increase the chances of recovery. You can know more about TRIM here.

Additionally, knowing when to seek help is another crucial aspect. Suppose the data is essential and the drive is exhibiting any signs of electronic failure or displaying unusual signals. In that case, the best course of action is to contact a specialized data recovery lab immediately.

Best Practices to Prevent Data Loss on SSDs

Depending solely on or primarily on a single drive for your critical files is risky, as problems such as unexpected power surges, hardware failure, or corruption can occur without warning. Hence, a cloud backup or an external drive can ensure the safety and accessibility of your data. You can also use the 3-2-1 backup strategy, which is my personal preference, where I store three copies of data on two different media, with one stored off-site.

Additionally, monitoring the SSD’s health is another good practice. Many SSDs come with tools provided by the manufacturer to track SSD life metrics, such as the number of write cycles used, potential threats, and remaining lifespan. 

Protecting the SSD physically is also important. Although it doesn’t contain any moving parts, as it has an HDD, it can still be damaged by dampness, moisture, electric charge leaks, or exposure to extreme temperatures. Therefore, keeping the drive in a stable environment free from all these factors can significantly impact its lifespan.

Conclusion

It is difficult to determine whether the TRIM command is executed after you have deleted your data. So, there is always a chance that you can recover it. You can try using a good data recovery software and see if it works. If you accidentally delete important data and realize it instantly, it’s a good idea to disconnect from the computer to prevent TRIM and GC from running. You can then contact professional data recovery service providers.