Warning For NVMe SSDs With Deleted Data

Your quick response to an SSD with data loss could now make the difference between a successful or failed data recovery.

The Short Version

If you have an SSD with missing or deleted data, you must power off the device as fast (and safely) as possible to retain the data. You shouldn’t power the drive again after that. Even just powered up and idle, the SSD will run background processes to start cleaning out sectors marked as deleted. Like a snake eating its own tail, you’ll be destroying the data as you attempt to recover it. ♾️

The Long Version

Modern consumer SSDs use a combination of cheap multi¹-layered flash storage chips, and smart software to spread out the written data over the whole device. Known as wear levelling, these algorithms are intended to prevent frequently used sectors from wearing out prematurely.

For context, on a traditional² hard disk, every time you request a sector, the same sector gets shown³. If a sector had old data inside, you could recover it until the data was replaced with something else. This is the basis of all traditional wisdom about deleted files not really being deleted. However, on a wear-levelled SSD you can never be so sure. The first time you save a file, it will get written to one sector from the pool. Once you delete the file stored there, if you request the same sector, the SSD will shuffle the pack and give you a fresh new sector from somewhere else. This drastically reduces the opportunity to recover deleted files.

There is an additional problem when you add TRIM into the mix. When carrying out certain disk tasks like emptying the recycle bin or reformatting, the operating system also sends a TRIM command. This lets the SSD know which sectors are no longer in use. From this moment, you have a matter of seconds or minutes to power off the device before it starts erasing those blocks of data.

A Solution

If you power off your disk in time, we have tools that allow us to load custom firmware on many brands of SSD. This firmware runs temporarily on the SSD RAM before the normal SSD tasks can start. This blocks the SSD from making any further changes to the stored data. If caught early, this can be enough to allow us to extract the missing files.

If not caught early, there is still more we can do. We can attempt to rebuild maps of sectors that were recently TRIMmed, and add these back to our clone drive. This is less than perfect, as usually some of that data has already gone. In many cases some data is better than nothing!

For a long time, we had to treat SSDs much the same as hard drives. Now we have specific tools and procedures in place to make sure we can still extract the maximum possible data from them.

If you’ve lost data from any device, get in touch as soon as possible. We never want to see people losing data, so we’ll always advise the best way forward.

Footnotes:

1. TLC = Triple Layer, QLC = Quad Layer, V-NAND = 5 Layer etc ↩︎
2. Until SMR drives at least 🤦‍♂️ ↩︎
3. Sometimes bad sectors get replaced with spares, but you know what I mean. ↩︎