All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 0:42 
Offline

Joined: May 30th, 2014, 0:54
Posts: 125
Location: Universe
I am working on a client SSD in which he has deleted data. Diagnostics shows recovered files are zero filled by SSD Trim firmware so even raw recovery gives nothing. Google search shows only Manufacturer can recover data in his own lab.
Is there any way to retrieve it ? What is your experience in SSD recovery ?


Attachments:
DSS1.JPG
DSS1.JPG [ 173.59 KiB | Viewed 9844 times ]
Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 4:33 
Offline

Joined: October 24th, 2014, 4:57
Posts: 219
Location: Remote Raid Help on planet Earth
If TRIM has finished its job, nobody will help you.

_________________
http://www.alfadatarecovery.com


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 5:05 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2785
Location: Kuwait
Martin wrote:
If TRIM has finished its job, nobody will help you.


+100
don`t waste your time

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 6:59 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
I think the last sentence of your posted picture is quite funny, actually.

+1 to what the others said, if TRIM is finished data is gone.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 7:29 
Offline

Joined: May 30th, 2014, 0:54
Posts: 125
Location: Universe
:( so it is confirmed no one can recover data. Its hard to say to customer when data is very much critical.
Thank you all for shading light.


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 13:52 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1387
Location: isreal
athena wrote:
:( so it is confirmed no one can recover data. Its hard to say to customer when data is very much critical

If data is very critical you make backups frequently


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 28th, 2017, 22:06 
Offline

Joined: May 30th, 2014, 0:54
Posts: 125
Location: Universe
Hi jermy
yes backup is very essential . This disk is of my customer.


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 30th, 2017, 11:59 
Offline

Joined: March 30th, 2017, 11:05
Posts: 2
Location: Italy
Martin wrote:
If TRIM has finished its job, nobody will help you.

Neither the manufacturer?


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 30th, 2017, 12:58 
Offline

Joined: October 24th, 2014, 4:57
Posts: 219
Location: Remote Raid Help on planet Earth
geagle wrote:
Martin wrote:
If TRIM has finished its job, nobody will help you.

Neither the manufacturer?


If drive supports TRIM - yes, despite of brand\manufacturer.

_________________
http://www.alfadatarecovery.com


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 30th, 2017, 17:28 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
going back to the Original post:

"Diagnostics shows recovered files are zero filled by SSD Trim firmware so even raw recovery gives nothing."

what exactly is diagnostics? unless you have read the NAND chip and looked at the dump, you really can't be making assumptions. If you did some sort of logical recovery, R-Studio or GDB on the device, then I would

How were you able to say for sure the zero filled files were because of TRIM?

There are quite a few SSD's that can be recovered and methods same as flash drives. Sandforce, Marvell and some Phison are exceptions. The main factor in making them "worse" to recover is multiple NAND chips, some single NAND chips having 16 or 32 dumps each and the sheer time it takes to process ECC / read dumps.. and storage space.

in flash you cannot talk in general terms. one drive may be a total cow to recover, the next one with same controller/NAND and PCB could be a piece of cake. One thing is for sure though, not knowing when to move on to next case can be a real deciding factor of if you go broke or not.


Top
 Profile  
 
 Post subject: Re: Deleted Data Recovery from SSD impossible ?
PostPosted: March 31st, 2017, 20:15 
Offline

Joined: May 30th, 2014, 0:54
Posts: 125
Location: Universe
Hi HaQue
Thanks for shading light on the subject which might be useful for me and everyone in future.

There is no way to know whether files are zeroes by TRIM . I have only logical / raw recovery as I don't have chip-off tools to directly read Nand nor technology / knowledge to interpret dumps. If opened in hex view files all then show is zeros.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 33 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group