Recovered files contain only zeros / Pics and Vids deleted

[Shilu]

Dear community,

I accidentally deleted my folder containing all pics and videos (125 GB). Since it is that big it was not moved to the recycle bin but permanently deleted instead.

Over the past 2 days I used pretty much every software that is available to recover the file but I haven't been successful to recover not even one of the files.

Recuva restored all files with original file names, size and date but none of the files could be opened (I restored the file to an external HDD)
GetDataBack for NTFS finds the MFT entry would every file including clusters and sectors information but when you preview the file it contains only zeros.

I also did an experiment and copied a picture to another partition of the SSD and deleted it by moving it into the recycle bin and afterwards permanently. When it was in the recycle bin it could still be restored by GetDataBack for NTFS but as soon as you delete it from the recycle bin it only contains zeros.

I first thought that Windows 8 might have learned a secure delete by overwriting everything with zeros when you delete permanently but the deletion process of 125 GB was completed way to fast to actually overwrite the space.

I really hope that someone in this community can help me since I'm running out of ideas and panic hits me that I will never see these pictures again.

Thank you so much!
Niklas

[samurai7]

From your post I'm assuming that you deleted those files from SSD drive? If yes, then chance to recover your data is very poor if not impossible :/.

If you are using SDD with Windows 7/8 then OS have option TRIM. It's automatically on in Win 7/8. In short way it's a method to delete files on SSD drive. On normal drive when you deleted file it's only marked as deleted, but on SDD with TRIM it's deleted, unrecoverable.

[Shilu]

Thank you for your reply!

Your answer confirms my most recent findings. R-Studio has an integrated hexdecimal viewer and binary data of all files is zero. Since I know in which order I initially copied the files, I did a little experiment and saved a word document on the drive. Now looking at the binary data of the first deleted file shows that some of the zeros at this position were overwritten with the data of the word file.

It seems like that TRIM + SSD is a very safe way to delete files which is generally good but sucks for me in this case. I'm surprised that 125GB of data was overwritten with zeros that quickly lol.

[samurai7]

Thank you for your reply!
It seems like that TRIM + SSD is a very safe way to delete files which is generally good but sucks for me in this case. I'm surprised that 125GB of data was overwritten with zeros that quickly lol.

TRIM works that way. When you delete file it's immediately deleted.

[Shilu]

If anyone is interested in background information on TRIM and Deterministic Zeros after TRIM (DZAT) I just found this article in a Forensic Journal

http://articles.forensicfocus.com/2014/ ... xclusions/

It pretty much says that there is no way to access the data after DZAT triggered through TRIM has overwritten the sectors.