Deleted on an SSD — why the data is often still there
Once something has been deleted on an SSD, no recovery software finds anything — and many people conclude that the data is gone. It is not: with many controllers we recover deleted files, even after TRIM. What matters is what you do in the first few minutes.
Why deleting on a hard drive barely deletes anything
On a hard drive every location can be overwritten directly. So when you delete a file, nothing at all is overwritten — the operating system merely removes the entry in the table of contents and marks the blocks as free. The magnetic patterns remain until something new is eventually written over them. That is precisely why deleted files can often still be found there weeks later.
Why flash memory works differently
An SSD cannot simply overwrite. It is written page by page but erased only in considerably larger blocks. To change four kilobytes the SSD would therefore have to empty an entire block — which is why it does not. It writes the new version to a free location and notes in an internal translation table where the current version lies.
This table is the actual core of every SSD. It translates the addresses used by the operating system into physical positions in the memory. Without it the content of the memory chips is only an unsorted collection of fragments.
TRIM: reported empty is not empty
Because the SSD itself does not know which of its data the operating system still needs, there is a command for it. When deleting, the system informs the drive: these address ranges are no longer needed. That is exactly what TRIM is, and it has been active by default everywhere for years.
The SSD then marks the affected ranges as invalid and immediately reports them to the outside as empty. Anyone reading through the normal interface — and that is exactly what every recovery program does — no longer sees any data there. Physically, however, nothing has been erased at this point: the content is still in the memory cells.
Only garbage collection actually clears the blocks so that they can be written to again. It works in the background whenever the drive has power, and not all at once. Between deletion and physical clearing there is therefore a window of time — and that is exactly where we come in.
What follows from this
How we recover deleted files from an SSD
Recovery software queries the drive through the normal interface — and for deleted areas it gets the answer “empty”. We go one level deeper: with many controllers we put the SSD into a technical mode in which the memory can be read directly, bypassing the translation table. There we find the pages that the controller lists as invalid but has not yet cleared.
From these fragments we reassemble the deleted files and the file system. Because the controller itself does the reading, it also resolves any factory encryption — the decisive difference from desoldering the memory chips.
When the prospects are particularly good
The drive was switched off immediately
Without power, garbage collection does not run. Switching off straight after the deletion leaves us the largest window.
The controller is faulty
If the SSD is no longer detected, reports an incorrect capacity or an unfamiliar model name, then usually the electronics or the translation table are affected — while the memory content itself is intact. A controller that is not working does not clean up either: the data is then often still fully present.
The loss was not caused by deletion
Damaged administrative structures, an interrupted copy operation, a corrupt partition table: in these cases the data was not reported as free and is still fully present.
External SSDs without TRIM pass-through
Some USB enclosures do not pass the command on to the drive. On such devices deleted files behave as they do on a hard drive — and the prospects are correspondingly good.
And encryption
Many modern SSDs encrypt everything they store within the controller — even when the user has never switched on any encryption. The key is generated inside the controller and does not leave it. Reading out the memory chips alone therefore achieves nothing, because their content is ciphertext. The route leads through the original controller — and that is exactly what we work with.
Answered briefly.
Can deleted files be recovered from an SSD?
Yes, in many cases — even after TRIM. The SSD does report deleted areas to the outside as empty straight away, but physically the data remains in memory until garbage collection clears the blocks. With many controllers we read the memory directly and reassemble the deleted files. What matters is switching the drive off immediately.
I deleted a file on my SSD and switched the computer off immediately. Any chance?
A good one. The shorter the time between deletion and shutdown, the more is still in memory. Do not switch the device back on — send it in or bring it to our lab in Frankfurt.
Why does my recovery software find nothing?
Because it reads through the normal interface — and there, after TRIM, the SSD reports deleted areas as empty. That does not mean the data is gone. With many controllers we read the memory directly, bypassing that interface. Please do not install any further software: every write can trigger garbage collection.
Does it help to remove the SSD and connect it to another computer?
No. As soon as the SSD has power it can clean up in the background — regardless of which computer it is attached to and whether anyone is accessing it.
Why is it a good sign if the SSD is no longer detected at all?
Because a controller that is no longer working can no longer clean up either. Such cases are technically more demanding, but the data is often still fully present.
We will take a look at your storage device.
The Economy diagnosis is free of charge. You find out what is possible before anything costs money — and what it would cost is put in writing beforehand.
Wasserweg 8–10 · 60594 Frankfurt am Main