1

I am trying to recover deleted files from a SSD using Forensic Explorer. Once the image processing on the SSD had been completed using the write blocker, I opened up AccessData FTK Imager and then I saved the files. Then I opened up Forensic Explorer and I can see where the files that I deleted in recycle bin but cannot retrieve.

Screenshot

Maybe I am coming at this all wrong, I was reading up on SSDs and some say that you can retrieve deleted data and some sites say that you cannot. If anyone has experience with Forensic Explorer or know of an alternative, I would appreciate it.

  • Has TRIM been issued on the device? – forest May 1 at 1:39
  • Thank you very much @forest! I ran the command and saw that it was set as 0. – Ciph3r8 May 2 at 3:06
  • I didn't mean to run a command that executes TRIM. I asked if TRIM had been issued because it wipes all deleted data. If TRIM had been run, then data will not be recoverable. – forest May 2 at 3:28
  • I did not enable trim. I checked and saw it was already enabled. – Ciph3r8 May 2 at 3:58
  • 1
    It's a bit ironic though, that whenever we are talking about securely erasing an SSD drive, all kind of tricks are needed and still you can't be quite sure, but when it comes to actually recovering the data, TRIM is enough to make it impossible. Theory vs. practice. :) – Esa Jokinen May 2 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.