Deleted Data Recovery on Solid-State Drives by Software Based Methods

Solid-state drives (SSD) are becoming more and more preferable for consumer and corporate needs in comparison with traditional hard disk drives (HDD). Lack of moving parts and NAND memory employment provides hi-level performance and reliability of SSDs. However, NAND memory demands complex algorithms of behavior from SSD controller which are not quite standardized. Therefore, SSDs from different manufactures can have significant peculiarities in realization of SSD key technologies such as TRIM or deallocate support, wear-leveling and garbage collection technology. In addition, SSDs produce some sophisticated difficulties in forensic data recovery. In this research we analyzed the behavior of SSDs with enabled TRIM of deallocate after a single file deletion. In normal case SSD will clear the blocks with irrelevant data in several seconds. However, it depends on manufacturer if it acts in the same way. In some cases, software-based data recovery methods can be implemented even if the storage medium works with TRIM ON command. Our research work leads to the conclusion that TRIM ON command does not clear blocks with irrelevant data in each case and these data can be restored by software based data recovery methods.