The TRIM command (TRIM in ATA and UNMAP in SCSI) informs a Solid-State Drive (SSD) drive which data blocks are no longer in use and can be wiped internally. It was developed in response to SSDs' unique operation characteristics, which differ from traditional hard drives. Without TRIM, SSDs faced degrading write performance over time. TRIM assists SSDs in garbage collection, optimising write operations and preventing slowdowns.

Why Was TRIM Introduced?

SSDs and traditional hard drives handle delete operations differently. SSDs need to know which blocks are genuinely unused to optimise their operations. Overwriting on an SSD is more complex than on a traditional drive, leading to a phenomenon known as "write amplification." SSDs also come with extra storage capacity, which is not user-addressable. This is to assist with wear levelling, performance, and drive longevity. Data that gets deleted and marked trimmed by the OS might move into this non-addressable space, which makes traditional recovery methods ineffective.

How Does TRIM Work?

When files are deleted, the operating system sends a TRIM command to the SSD. After TRIM is executed and combined with the drive's garbage collection, the identified blocks can be written to without needing a prior erase, enhancing performance and lifespan. Different SSDs might implement the TRIM command differently, influencing their performance.

Data Storage and Deletion in SSDs:

Unlike magnetic hard drives, which use sequential writing, SSDs store data in blocks across multiple NAND chips concurrently, making them much faster. When data is deleted, rather than leaving it until it's overwritten like on a magnetic drive, SSDs often mark it for trimming. The garbage collection process in SSDs then cleans up these trimmed blocks. This can make data recovery and forensics difficult as deleted data can be irretrievably wiped in the background.

TRIM's Implementation & Support:

TRIM's effectiveness depends on the physical drive and the Operating System (OS). Many operating systems like Windows, Linux, macOS, and others have introduced TRIM support. The TRIM command can also be used on certain RAID configurations, but support varies depending on the RAID type and the platform.

Hardware Support and Variants:

Beyond ATA's TRIM, standards like SCSI have similar commands, like UNMAP. Other technologies, like shingled magnetic recording (SMR) hard drives, SD/MMC and NVM Express, have incorporated analogous commands to TRIM, suited to their specifications.

Data Recovery and Forensic Challenges:

Extracting deleted evidence from an SSD was traditionally done through chip-off analysis, which was labour-intensive and time-consuming. However, the increase in SSD capacities, the combining of electronic components in a single chip and features like trimming, built-in hardware encryption and how data is stored added additional levels of complexity to the recovery and investigation of data from SSDs.

Advanced-Data Recovery:

There are, however, several advanced data recovery methods, like the factory mode, that can provide a potential method to access deleted or non-addressable areas of an SSD. The method involves preventing the SSD from booting in its standard mode and using specialised tools (like ACELab PC-3000) to access its data in a raw format. Factory mode can prevent SSDs from running background processes that might overwrite or erase data, thus preserving potential evidence and potentially allowing the recovery of deleted data.

What Are The Disadvantages Of Having Trim Enabled?:

When TRIM is disabled, the SSD does not immediately erase the data blocks where files were deleted. This makes it more likely that deleted files can be recovered, assuming the files have not been overwritten with new data.

How to Check If TRIM Is Enabled or Disabled on Windows:

- Press the Windows key + X and select "Windows PowerShell (Admin)" or "Command Prompt (Admin)."
- Type "fsutil behavior query disabledeletenotify" and press Enter.
- If the result is "0," TRIM is enabled. If the result is "1," TRIM is disabled.

How to Disable or Enable TRIM on Windows

- To disable TRIM, type "fsutil behavior set disabledeletenotify 1" and press Enter.|
- To enable TRIM, type "fsutil behavior set disabledeletenotify 0" and press Enter.

The TRIM function introduced a new set of challenges for data recovery and digital forensics. Unlike magnetic drives, where deleted data remains until overwritten, SSDs actively manage and clean up deleted data. Factory access mode, for instance, presents a novel approach to accessing data previously only possible with labour-intensive methods like chip-off analysis.

REQUEST A FREE ONLINE QUOTATION

If the data is essential and you wish to maximise the likelihood of retrieving it!

In the era of the cloud and omnipresent digital storage, many of us forget the perils that come with storing data on physical hard drives. If you're facing a situation where your hard drive is failing or has failed, and the data stored on it is crucial to you, it's imperative to know what actions might worsen the situation. Let's delve into the don'ts of managing a troubled hard drive if you wish to have the best possible chance of recovering your data.

Electro-mechanical hard drive failure is typically associated with a clicking or noisy disk drive, the drive is no longer detected, or the drive is slow to respond to read and write requests.

1. Do Not Continue Using It

The more you use a failing drive, the more it deteriorates. Using the drive can overwork it, potentially making data recovery more difficult or impossible. This includes rebooting as constantly rebooting might cause more damage. Each start-up cycle puts stress on the drive.

2. Do Not Leave It Powered On

• Hard disk drives - A knocking (or noisy) head stack will cause (more) physical damage to the platters and/or magnetic field if left knocking, possibly making the drive unrecoverable or only partially recoverable.
• SSDs - Solid-state drives use a technology called SSD TRIM or trimming, whereby deleted data areas first need to be cleared before new data can be written. TRIM is an automatic function, that will erase any previously deleted data areas, making recovery impossible with standard data recovery tools, and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered on, the more likely the drive will execute trimming.
  • It is potentially possible to recover deleted data from an SSD using factory access mode if trimming has not yet been executed.
    
    

3. Don't Assume It’s Dead Immediately

• Just because the drive isn't being recognised by your computer doesn't mean all hope is lost. Jumping to conclusions might lead to rash decisions.
  
  

4. Do Not Make Any Rash Decisions

• Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
  • Are you willing to play Russian roulette with your data, possibly ruining any chance of recovery?
  • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
• The value of your (or your customers) data will ultimately determine your next action.
• There may only be one chance at recovering data from a failed or failing drive!
  
  

Hard drives, SSDs and other storage devices are a lot more complex than many people think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - In essence, a computer within a computer. Every one of these components must be in a working condition for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.

 
5. Do Not Open The Drive

• Hard drives are manufactured in a Class 100 cleanroom as they are extremely sensitive to airborne contamination. Opening a drive outside of a cleanroom environment will contaminate the drive, possibly leaving the drive unrecoverable.

6. Do Not Replace The PCB (The Printed Circuit Board)

• There was a time when you could swap the PCB (between most drives) within a model range. The programming (firmware) on most modern hard drives is unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB, possibly leaving the drive unrecoverable or making recovery extremely difficult.
  
  

7. Avoid D.I.Y. Recovery Software

• While there are many data recovery software solutions available, they might not always be the best choice for severe hardware malfunctions. These tools can strain the drive even more.

8. Do Not Run Any Disk Tool Or Utility

• D.I.Y. disk tools are designed to test working hard drives and reallocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters complicating or hampering data recovery attempts.

9. Do Not Try To Write Data To The Drive

• Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure, and you can possibly overwrite valuable data, leaving that data unrecoverable.

10. Do Not Format Or Initialise The Drive

• If prompted, do not format or initialise the hard drive. This process will make data recovery much more challenging, as it can overwrite existing data. Formatting a failing hard drive may lead to permanent data loss or make recovery attempts difficult.

11. Do Not Run A System Restore Disk

• Restore disks or system recovery programs are designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable, especially if run on a failing hard drive.

12. Do Not Bump, Drop Or Knock The Drive

• There was a time when hard drives used bearings prone to seizing. A bump in some cases did solve the bearing problem, but you still ended up with platter damage due to the heads contacting the platters. Modern drives do not use bearings, and the only result will be platter damage and/or platter alignment issues, leaving the drive unrecoverable or, at best, partially recoverable.
  
  

13. Avoid DIY Fixes from Online Forums

• While some online advice can be helpful, many "quick fixes" found on forums can do more harm than good. Not all solutions are applicable to every situation.

14. Avoid Heat and Cold

Exposing the drive to extremes, like using a hairdryer or putting it in a freezer, are myths that can cause more harm. Temperature fluctuations can lead to component damage or condensation.

Do not put the drive in a fridge!

• • This is an urban legend that may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or bad solder connections by lowering the temperature, causing the joints to contract to make contact again. This may have worked briefly until the device heated up, causing the “dry joints” to expand, breaking the connection again. 
  • Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint”, you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
  • The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit, leading to damaged components. The drive will, in most cases, be unrecoverable if one of those components happens to be the firmware chip.

A failing or failed hard drive can indeed induce panic, especially if vital data is at stake. However, making hasty decisions can exacerbate the situation. If the information is crucial, the best course of action is to stop using the drive immediately and consult with professional data recovery experts. This will give your or your customer’s data, the best possible chance of being recovered. Always remember, when it comes to precious data: act wisely, not quickly. You may only have one chance at recovering the data from a failed or failing drive.

Need Help In Recovering Your Data - Contact Us Now!

REQUEST A FREE ONLINE QUOTATION

Hard drive failure is typically associated with a clicking or noisy disk drive, the drive is no longer detected, or the drive is slow to respond to read and write requests.

1. Do Not Make Any Rash Decisions.

• Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
  • Are you willing to play Russian roulette with your data, possibly ruining any chance of recovery?
  • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
  • The value of your (or your customers) data will ultimately determine your following action.
  • There may only be one chance at recovering data from a failed or failing drive!
    
    

Hard drives, SSDs and other storage devices are much more complex than many think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - A computer within a computer. Every one of these components has to be in a working condition for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.

2. Do Not Leave The Device Powered On.

• Hard disk drives - A knocking (or noisy) head-stack will cause (more) physical damage to the platters and/or magnetic field if left knocking possible, making the drive unrecoverable or partially recoverable.
• SSDs - Solid-state drives use SSD TRIM or trimming technology, whereby deleted data areas must first be cleared before new data can be written. TRIM is an automatic function that will erase any previously deleted data areas, making recovery impossible with standard data recovery tools and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered on, the more likely the drive will execute trimming.
  • It is potentially possible to recover deleted data from an SSD using factory access mode if trimming has not yet been executed.
    
    

3. Do Not Open The Drive.

Hard drives are manufactured in a Class 100 cleanroom as they are susceptible to airborne contamination. Opening a drive outside a cleanroom environment will contaminate the drive, possibly leaving the drive unrecoverable.

4. Do Not Replace The Pcb (printed Circuit Board).

• There was a time when you could swap the PCB (between most drives) within a model range. However, the programming (firmware) on most modern hard drives is unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB, possibly leaving the drive unrecoverable or making recovery extremely difficult.
  
  

5. Do Not Run Any Disk Tool Or Utility.

• D.I.Y. disk tools are designed to test working hard drives and re-allocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters and corrupt the firmware programming, complicating or hampering data recovery attempts.

6. Do Not Try To Write Data To The Drive.

• Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure, and you can possibly overwrite valuable data, leaving that data unrecoverable.
  
  

7. Do Not Format The Drive.

• Formatting a failing hard drive may lead to permanent data loss or make recovery difficult.
  
  

8. Do Not Run A System Restore Disk.

• Restore disks or system recovery programs are designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable, mainly if run on a failing hard drive.
  
  

9. Do Not Bump, Drop Or Knock The Drive.

• There was a time when hard drives used bearings prone to seizing. In some cases, a bump solved the bearing problem, but you still ended up with platter damage due to the heads making contact with the platters. Modern drives do not use bearings; the only end result will be platter damage and/or platter alignment issues, leaving the drive unrecoverable or partially recoverable at best.
  
  

10. Do Not Put The Drive In A Fridge.

• This urban legend may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or lousy solder connections by lowering the temperature, causing the joints to contract to make contact again. This may have worked briefly until the device heated up, causing the “dry joints” to expand, breaking the connection again.
• Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint”, you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
• The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit, leading to damaged components. In most cases, the drive will be unrecoverable if one of those components happens to be the firmware chip.
  
  

Losing data is possibly one of the most traumatic events you can encounter. Give your or your customer's data the best possible chance of being recovered by not making rash decisions. You may only have one chance at recovering the data from a failed or failing drive.
Need Help In Recovering Your Data - Contact Us Now!

Updated - Originally published 18 January 2016