I occasionally see people reference the difficulty of deleting data from an Solid State Disk. Because of the nature of SSDs (wear leveling, etc), simply writing to the same sector of the disk doesn't guarantee that it's deleted.

But modern operating systems support the ATA Trim command, which informs the SSD that the sector is no longer used by the operating system.

Does the trim command actually delete the data on the disk, or do you have to wait for the disk to do "garbage collection". If so, how long do you have to wait before the data has been cleared?

  • 1
    Short answer: the "trim" command target is to improve SSD performance on erasing scheme, not to securely erase data. – dan Jan 7 '16 at 7:44
  • Addendum to short answer: despite TRIM not being designed to secure erase data, it does an exceptional job of doing so. Nothing short of de-soldering the flash chips out of the drive AND physically opening the flash chip, exposing the raw silicon, so you can bypass the flash chip's signal levels to 0 or 1 and replace it with probability outputs instead you have no chance of recovering anything that has had TRIM run on it. Seeing as modern OSes run TRIM all the time, your deleted data is GONE after several minutes of idle for SSD garbage collection. – BeowulfNode42 Mar 31 '19 at 16:49

The trim command does not delete the data but simply marks a block of data as currently unused by the OS. It will probably return the block as zero if asked by the OS (although I don't know if this is guaranteed) but internally the data might be still there and could be extracted when accessing the flash storage directly, which is usually not possible by the OS but can often be done by computer forensic experts. When (and if at all) the block gets reused, i.e. overwritten with new data fully depends on the logic in the flash controller and how much data get written at all and how much this block was written already. Since a block of flash will wear out after too much writes the controllers usually prefers to write "fresher" blocks first and thus it can take a long time before a block gets reused for writing.

| improve this answer | |
  • 1
    My understanding if that to re-write to an SSD sector, it has to be first erased before being written to. One of the points of the trim command is to mark the sector ready to be erased, (and hopefully eventually actually erase the sector). So the question is really about how often firmware actually erases sectors that have been trimmed. – Steve Sether Jan 7 '16 at 3:29
  • 1
    @SteveSether: It is true that a flash segment has to be erased before any writes can be done to it but flash segments don't map 1:1 to OS blocks. Thus I think it depends on the firmware on the SSD drive and where the freed block is internally relative to existing free blocks (i.e. which flash segment). The OS has no control when this will be erased and I don't think that you can get any kind of guarantees when and if at all the blocks gets erased. – Steffen Ullrich Jan 7 '16 at 5:39
  • 1
    A block on SSD won't be erased "if asked by the OS". The OS doesn't have control on the SSD allocation scheme. A block on SSD will be erased based upon the internal SSD scheme. This scheme will erase consecutive set of blocks (128 or 512kB at a time), to make them ready for the next write. It is this SSD internal scheduling which determines when old data is securely erased. – dan Jan 7 '16 at 7:41
  • @SteffenUllrich depending on the internal implementation of the SSD, blocks marked with trim may also be immediately or periodically erased by the SSD garbage collection mechanism. – Enos D'Andrea Apr 11 '18 at 6:00
  • 1
    @EnosD'Andrea - According to an article published by BelkaSoft (belkasoft.com/download/info/SSD%20Forensics%202012.pdf), it suggests that TRIM deletes data permanently and cannot be recovered. – Motivated Jan 7 '19 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.