How to Recover Deleted Files

Cut off your power supply NOW before reading this if your data just gets deleted!

Your Drive Might Have TRIM Function, and It Will Impact on Your Data

One of the most critical and complex aspects that affect the change of recovered deleted files is the TRIM function. Nowadays, Solid State Drive(SSD) and some hard disk drive (HDD) models support the TRIM function as well(Western Digital Corporation, 2018). Particularly when it comes to data management and maintenance, this function plays a pivotal role in optimizing performance and prolonging the lifespan of these storage devices.

What is the Function of the TRIM?

This command allows the operating system to communicate with the drive, instructing it to erase unused data blocks proactively. In the "Deleted files recovery" chapter by Hassan and Hijazi (2016), when the TRIM command is enabled, it will erase entire blocks before new data can be written.

 McMillen (2021) explores the general benefits of the Trim Command for hard disk drives (HDDs). By identifying and erasing these blocks in advance, TRIM helps maintain consistent write performance and allows the device to become more performant.

When Will The Trim Be Triggered?

According to Moustafa (2022), the operating system will execute the Trim command during file deletion(p.16).

Implications for Data Recovery

While the TRIM function is essential for optimizing the drive's performance, it poses challenges for the data recovery process. When files are deleted, TRIM marks the block for erasure(Batini, Cabitza, & Magni, 2018, P. 79), potentially making it more difficult to recover deleted files and reducing the likelihood of successful data recovery using conventional methods. ACE Lab(2023, June) posted a blog highlighting that the drive will still trim the data even if plugged into a power supply.

Batini, Cabitza, and Magni (2018) note that the implementation of garbage collection (GC) algorithms, coupled with TRIM or TRIM equivalent software, can lead to the inadvertent erasure of potential evidence during investigations (p. 79). Similarly, Hassan and Hijazi (2016) highlight the immediate removal of deleted file data blocks facilitated by specific commands, creating space for new files (p. 234). These insights underscore the challenges inherent in digital forensics and data recovery processes.

How to Maximize The Chances of Data Recovery

FIRST, Cutting off the power supply. (Hassan & Hijazi, 2016, p. 234). You will have a higher chance of getting your data back if this action is done within 10 minutes after your data is deleted. Do not connect it to any power supply unless you know how to change it to factory mode and stop the CPU from erasing data in the background.

Act swiftly because if you leave your drive idle while connected to an OS, surveying for any software software and leave it to scan. While time has passed, you allow the CPU to erase the data in the background, decreasing the likelihood of successful recovery.

Conclusion

The TRIM function poses challenges for data recovery, particularly in cases of accidental file deletion or data corruption. This info will help you increase your chances of recovery. Feel free to contact us, an a centre specializing in data recovery services in Singapore.

Reference

1. Batini, C., Cabitza, F., & Magni, M. (2018). Potential Difficulties During Investigations Due to Solid State Drive (SSD) Technology. In C. Batini, F. Cabitza, & M. Magni (Eds.), Organizing for the Digital World: IT for Individuals, Communities and Societies. Germany: Springer International Publishing.
2. McMillen, W. (2021, December). Trim Command - General Benefits for Hard Disk Drives. Western Digital Corporation. San Jose, CA: 5601 Great Oaks Parkway, USA.
3. Hassan, N. A., & Hijazi, R. (2016). Deleted files recovery. In Data Hiding Techniques in Windows OS: A Practical Approach to Investigation and Defense. Netherlands: Elsevier Science.
4. Western Digital Corporation. (2018, December 21). TRIM Support for USB Flash, SSD and HDD on Windows and macOS. WD Support. Retrieved from https://support-en.wd.com/app/answers/detailweb/a_id/25185/~/trim-support-for-usb-flash%2C-ssd-and-hdd-on-windows-and-macos
5. ACE Lab. (2023, June). PC-3000 SSD: How to bypass the TRIM. ACE Lab Blog. https://blog.acelab.eu.com/pc-3000-ssd-how-to-bypass-the-trim
6. Moustafa, N. (2022). Digital Forensics in the Era of Artificial Intelligence. United States: CRC Press.