Hello, I accidentally erased an important project I was working on. I was careless and erased the wrong document. I spent weeks typing it up and I need to have it ready by monday. I dont have the time to restart it and I need to retrieve it asap. I'm an intern and my job requires me to shred any client specific data if I'm no longer actively working on it. I think I did a 7 times overwrite. I have a windows 10 laptop with a trim enabled SSD. Any help would be greatly appreciated. Thank you.
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Is it possible to retrieve overwritten ssd data?
- Thread starter Neofite
- Start date
Ryom
[H]ard|Gawd
- Joined
- Oct 11, 2006
- Messages
- 1,854
If you didn't back it up, you're boned. Local backup encryption is free. Encrypted remote backups are inexpensive. Lesson learned?
drklu
2[H]4U
- Joined
- Jul 15, 2013
- Messages
- 2,893
I would guess there is zero chance of recovery if you overwrote the data 7 times. I would very much consider backing up crucial data like this.
Navigate to the file location, open properties, and go to the Previous Versions tab. You could also use ShadowExplorer, that's a free third party tool.
Though if you used a special program to delete it, it may have deleted your previous versions also.
Though if you used a special program to delete it, it may have deleted your previous versions also.
Last edited:
Here is the website. https://eraser.heidi.ie/ I'm not sure what you mean by free space.
doublejack
Limp Gawd
- Joined
- Apr 13, 2015
- Messages
- 491
Even if you just deleted the file and didn't use the eraser app, the odds of recovery are low on a SSD. This is because of how they work. Unlike a mechanical drive, SSD drives move unchanged data for wear leveling purposes. Mechanical drives will only move unchanged data during a defrag operation. Combine that with TRIM / garbage collection functionality and the odds of recovering data are slim because the odds are high the blocks the file was stored in have been wiped and reused.
I once used software intended to recover deleted files for forensic analysis to try recovering accidentally deleted images. I was able to recover zero full images out of an album of hundreds. In that case all the user did was a shift-delete. I did get some partial pics back, but the files were either partially or totally unrecoverable. The problem is that if the device continues to be used then areas of the drive that contained the deleted data will be reused, and Windows is not even aware of it.
So, based on that alone I'd say you are, unfortunately, screwed. Factor in the eraser app and what it does, and there's just no way.
I once used software intended to recover deleted files for forensic analysis to try recovering accidentally deleted images. I was able to recover zero full images out of an album of hundreds. In that case all the user did was a shift-delete. I did get some partial pics back, but the files were either partially or totally unrecoverable. The problem is that if the device continues to be used then areas of the drive that contained the deleted data will be reused, and Windows is not even aware of it.
So, based on that alone I'd say you are, unfortunately, screwed. Factor in the eraser app and what it does, and there's just no way.
TRIM would of wiped the file out the moment you deleted or did the first pass with that unneeded eraser tool (TRIM assures its erased)
do note there is no point using a 1-100 times file eraser tool if your using a SSD as you just be simply erasing random parts of the SSD not the file you're actually trying to overwrite it self (the file you deleted was elsewhere on the SSD but it would of been wiped out by the TRIM command any way 0-10 seconds after you hit Delete or overwrite it the first time)
SSDs are not HDDs they dont save data into the same spot when a write comes in if your overwriting a file your not overwriting the same location of where it was stored, you can just delete the file no tool is needed when using a SSD due to TRIM zeroing out where the data was stored any way
i would recommend using bitlocker (win10pro) if data is sensitive (ssd TRIM still works as normal) especially if you have set up that thing i did posted below so you don't accidentally lose files,, if you have Home version of windows 10 and its Not a HP system you can buy 10 pro keys for less then $5 so you can use bitlocker or use Veracrypt if you don't want to spend that money (Note the listings normally say you have to use it on a clean install of windows 10 pro but i only found that not to work on HP systems as they annoying use win10home single language version witch you can't use OEM keys on)
windows 10 does not have shadow copy service make snapshots like windows 7 (i set mine now to make a snapshot every day, as its useful for recently deleted files as happened to you, and me ish witch was just factorio game save that i saved over)
to restore Previous Versions History Tab back to windows 10 (when you right click properties on a folder)
Last edited:
Pervious versions and stuff... you never rely truly on these.
Nothing can replace a true backup (strategy). Especially for something relatively small as one file you spend weeks! writing.
There is virtually zero chance to recover it if Windows hadn't done something to save it like Pervious versions etc.
My backup strategy is simple, I use console rar.exe within a big backup script I wrote myself with functionality just as I like it, configurable etc, which supports two ways to detect changes, and currently I use the Archive bit (winrar supports it) and run the tasks daily. It only creates a new incremental archive if the archive is different from the last (there were changes), also I keep track of deleted files since the last full archive because this is also crucial for many (incremental or differential) tasks. Having incrementals is the same as having the multiple versions of "the" file, in a daily schedule.
Nothing can replace a true backup (strategy). Especially for something relatively small as one file you spend weeks! writing.
There is virtually zero chance to recover it if Windows hadn't done something to save it like Pervious versions etc.
My backup strategy is simple, I use console rar.exe within a big backup script I wrote myself with functionality just as I like it, configurable etc, which supports two ways to detect changes, and currently I use the Archive bit (winrar supports it) and run the tasks daily. It only creates a new incremental archive if the archive is different from the last (there were changes), also I keep track of deleted files since the last full archive because this is also crucial for many (incremental or differential) tasks. Having incrementals is the same as having the multiple versions of "the" file, in a daily schedule.
Archaea
[H]F Junkie
- Joined
- Oct 19, 2004
- Messages
- 11,826
Unless your windows has shadow copies or previous versions turned on, or unless you saved A previous version of Windows and associated data, you can restore. You’re screwed.
I work with expensive corporate forensic software. Encase and Axiom and like a previous poster said, even just normally deleted files are cleared off the SSD in seconds, due to Windows Trim functions and not only that but also the SSD drives vendor specific drive wear leveling firmware functions.
It is faster for an SSD to write to a empty cell than A) delete and then B) write to a cell — so any file marked for deletion by the OS is deleted completely by the OS Trim function for performance reasons. In the old days with spinning drives they would just delete the pointer to the file, but the file data would still be there until it happened to be overwritten. You could recover deleted data on a spinning drive easily enough. With SSDs, it’s nearly impossible to recover deleted files. I so rarely see it in conparison as to say confidently in nearly all cases you can’t.
Enter your erasure tool and you actively erasing the file, and your surely hosed unless you had a backup.
I also agree obviously that the eraser tool is wholly unnecessary with an SSD. (And likely isn’t doing anything at all that it claims to be). It’s current tech such that with the SSD drives vendor specific wear leveling firmware that the Windows OS doesn’t even know truly where on the drive the file is physically located because the SSD firmware has intercepted the command and placed it elsewhere to even out the write cycles across its available memory cells. So when the eraser tool is erasing the clusters the OS thinks the file is in, it’s actually not where the data is.
I work with expensive corporate forensic software. Encase and Axiom and like a previous poster said, even just normally deleted files are cleared off the SSD in seconds, due to Windows Trim functions and not only that but also the SSD drives vendor specific drive wear leveling firmware functions.
It is faster for an SSD to write to a empty cell than A) delete and then B) write to a cell — so any file marked for deletion by the OS is deleted completely by the OS Trim function for performance reasons. In the old days with spinning drives they would just delete the pointer to the file, but the file data would still be there until it happened to be overwritten. You could recover deleted data on a spinning drive easily enough. With SSDs, it’s nearly impossible to recover deleted files. I so rarely see it in conparison as to say confidently in nearly all cases you can’t.
Enter your erasure tool and you actively erasing the file, and your surely hosed unless you had a backup.
I also agree obviously that the eraser tool is wholly unnecessary with an SSD. (And likely isn’t doing anything at all that it claims to be). It’s current tech such that with the SSD drives vendor specific wear leveling firmware that the Windows OS doesn’t even know truly where on the drive the file is physically located because the SSD firmware has intercepted the command and placed it elsewhere to even out the write cycles across its available memory cells. So when the eraser tool is erasing the clusters the OS thinks the file is in, it’s actually not where the data is.
windows 10 having system restore turned on does not turn on shadow copies any more (have to do what i posted above as a scheduled task) normally System Restore is on by default but it wont recover any files just settings (some systems randomly default to off after clean install or "feature" upgrade i am unsure why)
i just turn run a shadow copy task per day via task scheduler in my last post (you can see your past files on the previous file tab again, far simper) and use a actual backup software and cloud backup (witch manages incremental and deleted files)