My very first thought:
Nobody can be absolutely sure that something has not happened, so the only acceptable answer to your question would be an example. I'm trying to explain my thoughts on why you are very unlikely to get such an example. My argument is inspired by the Drake equation.
Let me start with some facts that I think we all agree on (more or less, hopefully):
- Recovering data from a wiped SSD can be done (theoretically and practically).
- Doing so is far from being easy, it requires knowledge, ressources, maybe time.
As with any attack, we have three parameters to look at:
- required skill
- required ressources
How are the chances, that law enforcement has skill and ressources available? NSA, Mossad, KGB - sure. An "ordinary" police department? Likely they can do it if they're able to convince someone it's important enough and there's no other way. It's certainly not "routine".
That's where we're talking about motivation. In order to be motivated (enough), the following things must be true:
- Some "suspect" must have stored data on a SSD. (Not a HDD, not a floppy...)
- Somebody - for some reason - decided to wipe that SSD. (This takes a little time and effort and thus should be done before the police rings at your door.)
- The SSD must not have been protected by other means such as strong encryption. (Note, that at this point we have a person who not only knows about wiping a SSD, but actually did so because he knew his secrets might be compromised otherwise. It's certainly possible, though very unlikely, that such a person didn't use encryption in the first place.)
- Law enforcement must either know or at least assume that there's "something" to be found on that particular SSD. (Otherwise they wouldn't look.)
- The crime we're talking about must have been considered "important enough".
- There was no other way the data could be obtained or there was not enough other evidence against the suspect.
So, finally, we're motivated enough. There's still more to consider:
- The whole operation must have been performed successfully.
- The operation must have been documented and made publicly available.
I think if we multiply all those chances, we're getting a chance very, very close to zero, that there will be proof that something like this has ever been successfully done.