unable to recover as many deleted files on ssd vs hdd

K

Kdawg

[H]ard|Gawd
Joined
Aug 12, 2017
Messages
1,116
I just ran Recuva on a wd blue ssd, and I was not able to recover any deleted files beyond a few days ago.

Files I deleted prior to last week didn't even show up in the recovery log.

unlike old hdd's, where tons of deleted files and fragments would show up.

is this just how ssds are?


if i ever have to undelete something from last week, i'm out of luck.
 
I think thats just how SSD's are. They have built in things like TRIM and wear leveling that make it much more likely that a deleted file gets overwritten by somthing else. It would be similar to running a disk defrag on a HDD then trying to recover deleted files.
 
yeah, but my drive still has 438gb free, out of 465gb.

plenty of space to write elsewhere instead of overwriting previous files.
 
Kdawg said:
yeah, but my drive still has 438gb free, out of 465gb.

plenty of space to write elsewhere instead of overwriting previous files.
Click to expand...

I don't know if SSD's write sequentially, but if they do, and TRIM has flagged blocks at the beginning as empty or useable, I would expect it to write to them first.
 
SSDs are really great for security purposes.

Not so much for recovering files you deleted.... and why would you want to recover files that you intentionally deleted.. unless you didn't want somebody else that was going to be using the computer to find said files?

If you really wanted those files, then they should have been backed up.
 
with an SSD you have TRIM so if you delete a file and dont have shadow copy enabled its gone

annoying windows 10 out of the box has it disabled by default (heck even system restore might be off by default on windows 10, make sure its enabled and its not set no 0GB, i recommend just under 20GB default is 10GB), you only have basic system restore that only protects system files not user folders as it used to on 8 and 7,
you have to run a task schedule to a set time, i set it to 10 minutes after login on customer PCs (i set mine to once a day on my system as it does not get switch off often), the command is >wmic shadowcopy call create Volume= 'C:\'< and set system restore size to approx 20GB, that restores Previous Versions again when you right click Properties on a folder or file (i set this up on every system i setup as makes it very easy to recover deleted files and folders)

your file is gone puff the moment you press delete as the TRIM command is sent to the SSD witch zeros out where that file data was stored on the ssd (so unless you have the above setup, normally under 1 second after you hit delete its gone and is unrecoverable)

But as your stating you can recover files from last week maybe windows only sends TRIM command after defrag has been ran (when you defrag a SSD it does not defrag it, it just sends a mass TRIM command to all empty space) windows 10 by default runs once a week or when maintenance task is ran

if you have that task running >wmic shadowcopy call create Volume= 'C:\'>, you don't need to use recovery software, you just right click on a real folder (not a shortcut/link sometimes does not work) and click Restore Previous Versions
 
auntjemima said:
I don't know if SSD's write sequentially, but if they do, and TRIM has flagged blocks at the beginning as empty or useable, I would expect it to write to them first.
Click to expand...
SSDs write to the lowest written to area of the NAND first so not to burn out the NAND by writing to the same spot lots of times (wear leveling) SSDs are not like HDDs, the data is spread over all 4-8 chips on the SSD so when it reads the data back it reads much faster

TRIM wipes all Virtual LBA blocks where all the data was stored after you told it to be deleted (most ssds do this when the drive is Idle) so generally under 1 second the file is gone even if it is not the drive should return zeros of where the file was stored (data recovery is generally not possible on a SSD where the user has pressed delete, unless i have touched the system to restore shadow copy as in my last post)
 
i'm pretty new to ssd's, so this is all interesting.

and no, I misspoke. Undelete app will only show deleted files from 3 days ago, not a week ago.

I didn't even think about disabling trim.
I should look into this.

But even with TRIM off, the ssd is still doing wear leveling, right?
What's the damage with Trim off? Does TBW increase >2x rate?

I see that trim is supposed to make the ssd faster and increase lifespan.
But I'm going to be putting this in my dad's pc, and okboomers aren't so great about being careful deleting shit.
 
IMHO if you are that worried about it spend $5 a month for unlimited backblaze backup. I think 30 days of versioning is included by default and you can upgrade to a full year for like $2.

It seems silly to hack around your non issue by disabling good features, just on the odd chance that you may have to run a recovery utility, that's really only intended as an absolute last resort anyways.
 
Kdawg said:
i'm pretty new to ssd's, so this is all interesting.

and no, I misspoke. Undelete app will only show deleted files from 3 days ago, not a week ago.

I didn't even think about disabling trim.
I should look into this.

But even with TRIM off, the ssd is still doing wear leveling, right?
What's the damage with Trim off? Does TBW increase >2x rate?

I see that trim is supposed to make the ssd faster and increase lifespan.
But I'm going to be putting this in my dad's pc, and okboomers aren't so great about being careful deleting shit.
Click to expand...
it's not recommended to have TRIM disabled

if you know your way around task Scheduler just do what i do on every pc i set up (this will restore Previous Versions in the properties tab so you can restore files like you could on windows 7/8)

Create and new task (i norm do it under microsoft folder)
wmic shadowcopy call create Volume= 'C:\'
set it to run 10 minutes after login
make sure it runs as SYSTEM user Group
and set to hidden, with highest Privileges, windows 10

once saved run the task and right click on a folder properties and click on Previous Versions tab and you will sill a new version points (also make sure system protection is enabled and set to 10GB ish as for some random reasons its disabled and set to 0GB on some systems after a clean install, i set it to approx 20GB so has months of restore point versions available)

i have exported it onto my USB stick so only have to import it very quickly (when importing it the only thing you must do before you save onto a New PC your setting up it is reset the User Group back to SYSTEM even if it's already set to SYSTEM as i found it norm errors when you try and save it)
 
Last edited:
SSD can work much faster than a mechanical HDD. Apart from it using flash memory, it is also designed with a protocol of TRIM. This feature will automatically erase the files designated for deletion to leave the sectors empty. In this way, it’s pretty quick to read/write data to the SSD. Nowadays, most PCs have supported TRIM feature. Thus, if the SSD where you delete a file accidentally is an internal one, it is very likely that the data may have been erased by TRIM. In this case, the chances for recovery are considerably low and even totally impossible. But you can still have a try with other data recovery tools.
 
Unplug the drive after you delete the files, then plug it back in when you want to recover them?
Start keeping your "Frequently deleted and recovered" files on a HDD?
Make a secret partition?
Get a separate Thumb Drive for those files and just encrypt & hide it?
🤷‍♂️

From what I understand, even without TRIM, SSDs will write fragmented data across the NAND on purpose, so with more parts of files spread out over the drive's capacity. Like constantly airbrushing data over top of old airbrushed data, the paint (fragmented data) is bound to block enough of the old to make recovery difficult to impossible.
 
You can do data recovery on an SSD. However, Windows 10 and most newer setups support TRIM which automatically 0 out the empty cells. This makes data recovery much harder compared to an HDD that does not 0 out any part and only overwrites when the space becomes available and not always immediately.

I can tell you that if an HDD fails it's not hard to do data recovery for a normal user unless it is a mechanical failure while SSDs on the other hand almost always require specialized tools to recover data so long as the NAND chips have not failed.
 
You must log in or register to reply here.
Back
Top