Why can deleted files not be recovered from an SSD?
Because the drive itself erases the blocks. TRIM is a housekeeping instruction that turns a deletion into a real one, usually within minutes — and it is why undelete belongs to the era of mechanical drives.
- Difficulty
- intermediate
- Time
- 20 min
- Read
- 3 min
- Safety
- caution
Short answer
On a mechanical drive, deleting removes the index entry and leaves the data in place until something writes over it — that gap is what undelete exploits. Solid state drives cannot overwrite in place: they must erase a block before reusing it. So the operating system sends a TRIM command telling the drive which blocks are no longer needed, and the drive erases them in the background, usually within minutes. There is then nothing to recover, by any software.
Do this first
This is a genuine, permanent change in what is possible, and it is worth understanding rather than discovering. It also has a useful flip side: it means an SSD you are selling or disposing of is much less likely to be leaking old files.
Safety
Step by step
- Understand what deletion means on a mechanical drive.The file system removes the pointer and marks the space free. The magnetic pattern is untouched, so the data sits there until new data lands on top of it. Recovery software reads the raw surface and reassembles what it finds.
- Understand why flash is different.Flash memory can only be written to a block that has been erased first, and erasing is slow. If the drive waited until the moment of writing, it would be crippled, so it keeps a pool of pre-erased blocks and erases in the background.
- See where TRIM comes in.The drive has no idea which blocks the file system considers free — it only sees numbered blocks. TRIM is the operating system telling it: these blocks no longer hold anything of value. The drive adds them to the queue for erasure and clears them when it is idle, which is often within minutes.
- Accept the consequence.Once erased, the data is not faint, not fragmentary, not behind a paywall. It is not there. No software and no laboratory can retrieve it, because the charge that represented it has been removed from the cells.
- Know the exceptions, and do not count on them.TRIM does not always run: some external SSD enclosures do not pass it through, some older USB connections do not, TRIM is generally not used on drives in certain RAID configurations, and a drive that has been powered off since the deletion has not had the chance. If any of these apply, an immediate attempt is worth making.
- Shut down at once if you want to try.Powering off is the only thing that stops the background erase. Then recover the drive using another computer, ideally with the SSD connected as a secondary drive.
- Distinguish deletion from file system damage.If the SSD's partition table or file system is damaged but nothing was deleted, the data is intact and recovery software has a genuinely good chance. TRIM only removes what the operating system told it was free.
Questions people ask
Does this apply to memory cards and USB sticks?
Usually not, and that is useful. Most cards and cheap USB sticks do not receive or act on TRIM through the reader, so old-style undelete often works well on them. This is why photo recovery from a camera card so often succeeds.
How long do I actually have?
Minutes rather than hours, and there is no guarantee of even that. Treat it as immediate.
Does this mean I do not need to wipe an SSD before selling it?
It reduces the risk considerably but is not a policy. Use the drive's own secure-erase function, or encrypt the drive and then erase, so that anything remaining is unreadable. Physical destruction remains the certain answer for anything sensitive.
Can a laboratory read the individual memory cells?
Reading raw flash chips is a real technique used for physically damaged drives, but it recovers what is present on the chips. If TRIM has erased the cells, there is nothing to read, and modern drives encrypt internally as well, which makes chip-level recovery harder still.
Does emptying the recycle bin trigger this?
Yes. Files sitting in the recycle bin still exist and are fully recoverable; emptying it is the moment the blocks are released and TRIM applies.