Page 1 of 1

SSD - DR after Windows recovery / reinstallation

Posted: January 29th, 2020, 6:21
by maddin
Hello,

a client use the windows recovery to reset / reinstall the system and he lost all his data. I had quite some of that cases in the past. On a HDD I could use r-Studio or UFS and I would find at least a good portion of the data. Now I have a SSD and I did the same and there was not one file which I could find.

Is there a new function in Windows which wipe the drive when reinstalling windows or is that a thing of the SSDs?

I heard that some of them use something like a encryption to spread the data evenly across the drive - so a generation of a new key would turn all old data into garbage. Could that be the case?

Re: SSD - DR after Windows recovery / reinstallation

Posted: January 29th, 2020, 6:30
by melvin
This function is called TRIM. All the data is gone, sorry.

Re: SSD - DR after Windows recovery / reinstallation

Posted: January 29th, 2020, 6:47
by maddin
OK - thanks for the info. I will google that and have a look how that works.

Re: SSD - DR after Windows recovery / reinstallation

Posted: January 29th, 2020, 7:31
by HaQue
It works very well. Forensic and data recovery people love it! Less files to sift through...

encryption could possibly account for this behaviour as well

Re: SSD - DR after Windows recovery / reinstallation

Posted: January 29th, 2020, 17:08
by underdeath21
if client did reinstall it depend if client did quick or full format.no way you get any data back if client did any full format

Re: SSD - DR after Windows recovery / reinstallation

Posted: January 29th, 2020, 17:08
by underdeath21
if client did reinstall it depends if client did quick or full format.no way you get any data back if client did any full format