Hey guys,

currently I have a notebook on my table. This notebook was used by an employee, that has been fired. And on his last day, he deleted (or formatted - don't know yet) the SSD. On a normal drive I would just plug the drive to my Imaging station and run R-Studio. But since it's a laptop I'm to lazy to get the disk out of the machine to plug it to PC-3000. So the question is, can I just boot the laptop to linux and dd the whole SSD into a single file on my storage cluster?

Or will I miss some data because of the wear levelling or some other SSD magic?

Most likely data is gone

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

You should start by researching what T.R.I.M. is, then find out if the OS is capable of supporting it....game over.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

+1.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

I did it, but in my understanding TRIM does not erase the files from the drive. It just mark the data, that it can be overwritten. Or am I wrong?

TRIM's job is to optimize the drive's performance by erasing unused space. Files marked as deleted is unused space.
Can replicate/confirm with practice SSD.

Proper way is to remove drive, set to tech mode and clone.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

Yes, you are. T.R.I.M. is a system in which the OS tells the SSD ranges of sectors where files have been deleted. The SSD then zero fills the sectors during idle periods to prepare the way for new data. It's a system built to overcome the inherent limitation of NAND flash having only the ability to write individual ones, but not individual zeros. So it's got to wipe entire pages and re-write the data to prepare sectors for new data.

Usually it all happens within a few minutes. So unless the SSD was powered off right after the data was deleted, it's gone forever.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Ok, this is new for me. And I don't understand the reason why the drive should overwrite the Data with zeros. Because then you double the count of write cycles and the SSD wears out much faster.

I would think that the trimmed blocks would be erased rather than overwritten.

_________________
A backup a day keeps DR away.

What you're not understanding is, it always has to be zeroed out before it can be re-written because it CAN'T WRITE INDIVIDUAL ZEROS, only ONES!!! So to change any bit to a zero, the whole block must be erased. SSDs can only function this way, it's a limitation of the technology. The point of T.R.I.M. is to do this preparation during idle times and not when you actually need the writes to happen.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Supposing the drive was removed, and connected to a machine/appliance with TRIM disabled, would tech mode still be necessary ? Or, what is the reason for tech mode ? Just to prevent TRIM from running ?

Preventing trim from running.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

The drive does not really write zeros it marks the blocks as "free" and when you try to read it drive checks if such a block is free and returns zeros instead of actual data.
Meanwhile a process inside an SSD called Garbage Collector erases all the blocks marked as "free"

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

Ok. But I'd like to take a shot, so image the disk and find out that it has a bitlocker partition. I'm decrypting the image now, but how does TRIM work on an encrypted drive? Because on a encrypted drive I have no "empty" blocks, they are filled with data, that looks random.

This is currently an interesting topic of discussion.....

In the case of bitlocker, there would be no problem. Bitlocker, unlike TrueCrypt, supports TRIM and would leave empty parts unencrypted. It improves performance and prevents degradation over time, but has other problems.

the drive does not know it is encrypted by Bitlocker, it works on LBA level which is lower level comparing to BitLocker. OS (Windows) commands the TRIM feature to do the job when you delete a file or format a drive.
When TRIM works on Bitlocker-encrypted drives you will see patches of zeros inside. If you don't see many sectors filled with zeros then TRIM didn't work and your data is still there

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

Currently in the SSD sector is a jungle, a real war between the different manufacturers to impose their standards and get their market share...

This results in a multitude of combinations (controller/Firmware/PCB/NANDFlash...) and a certain level of "incompatibilities".

TTRIM was created to improve NAND Flash writing performance and yet (depending on the combination of software and/or SSD driver) it can cause the disc to have poor writing performance and premature wear.....

For example, an SSD with bitlocker (to follow this theme) has the same write performance on a SSD with SANDFORCE controller as on a Samsung SSD (for example)?

Ok, a little update. I decrypted the Bitlocker partition and was able to access the data. I scanned the Image for deleted Files with R-Studio and saw the deleted files. Then I tried to get the data, but most of the files are damaged. I have no zeros in the Data but something what looks like random data in combination with real data. For example I have no Word header but some readable text in the file.

Does anyone has any idea? Why can I still see the File Structure but the data is cactus?

Maybe just a theory, but :

Deleted files were marked in the MFT as deleted, but that changed only the relevant flags in MFT.

The sectors, in turn, were reused by the normal working of the OS / the drive, and so have wrong content in them. Something similar to a disk that was formatted and had windows reinstalled in it.

In SSD (better said, in NAND Flash) it is a little more complex than that, there are more factors involved.

To write/modify a memory block in NAND Flash (with or without TRIM), it must be "empty" if it has valid previous data, first read the data from the block, transfer it to a buffer, make the necessary changes to the data, initialize the block (erase it) and then write the new data to the NAND Flash block from the buffer.......

In addition to this, the algorithms of the different controllers that can also modify the data (compress them) would also come into play.