Home

Recovering data from SSD drives

The short answer: It is generally not possible to recover deleted data from SSD drives, because the TRIM function is usually enabled by default.

How do I know if TRIM is enabled?

It probably is. If you have an SSD drive that is internal to your computer (NVMe drive, SATA drive, etc), and you're using a modern operating system (Windows 7 and newer, macOS, etc), then it's very likely that TRIM will be enabled by default, because it's highly beneficial to the performance of your SSD drive.

What is TRIM, and why is it enabled?

SSD (flash memory) drives work fundamentally differently from older magnetic (spinning disk) hard drives. With both types of drives, when data is deleted, the physical blocks that were occupied by the data are marked as "available", and become ready to be overwritten by new data. With a magnetic hard drive, an available block can be overwritten regardless of what data was in that block previously; the old data gets overwritten directly. However, the same is not true for flash memory: a flash memory block must be erased explicitly before new data is written to it. And this erase operation is relatively expensive (i.e. slow). If an SSD drive were to erase memory blocks "on demand", i.e. only when a new file is being written, it would slow down the write performance of the drive significantly.

Therefore, an SSD drive will erase unused memory blocks preemptively, so that the memory will be pre-erased when a new file needs to be written to it. Since the drive has no knowledge of what filesystem exists on it, the drive relies on the operating system to inform it about which memory blocks can be erased. This is done using the TRIM command: When the operating system deletes a file, in addition to updating the necessary filesystem structures, it also sends a TRIM command to the drive, indicating that the memory blocks occupied by the deleted file can now be queued up for erasing. The SSD drive erases TRIMmed blocks in the background, transparently to other operations.

In effect, this means that for any file that's deleted from an SSD drive, the actual contents of the file will be wiped permanently from the drive shortly afterwards, and will no longer be recoverable.

Exceptions

There are a few cases when deleted data may be recoverable from an SSD drive:

  • If TRIM happens to be disabled for some reason. As mentioned above, the TRIM feature is something that is enabled at the level of the operating system. It is usually enabled by default for performance reasons. Nevertheless, most operating systems will let you check whether or not TRIM is enabled. For example, in Windows you can run the command fsutil behavior query disabledeletenotify to see if TRIM is currently enabled.
  • If you're using an external SSD drive connected over USB. Support for issuing the TRIM command over a USB connection is relatively new, and is not yet supported by all USB controllers and operating systems. If you deleted files from an external SSD drive that's connected to a USB port, there's a fair chance that the data might be recoverable.
  • If you attempt to recover the files immediately after they're deleted. As mentioned above, the TRIM command puts the deleted memory blocks in a queue to be erased, so it's possible that the SSD drive won't actually erase them for a short while. The timing of when exactly the TRIMmed blocks are erased is entirely up to the drive itself, and differs by manufacturer. If you search the drive for deleted data sufficiently soon after it's deleted, it may still be possible to recover it.

In any case, there's no harm in trying to use DiskDigger on an SSD drive to see if your lost data is recoverable, but if you're using an internal SSD drive with a modern operating system, I'm afraid the prognosis is not good.