Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
TRIM is handled internally by the SSD controller. There aren't any standard ATA commands to obtain this information, and if there are vendor specific commands it's unlikely they are documented.
A simplified example of TRIM:
- The OS writes some data to the disk at location 0. At this point, the OS can read the data back whenever it needs to.
- The OS no longer needs this sector, so it marks it as unused with the TRIM command. The OS can no longer read the data back, the drive controller won't return it.
- If you were able to inspect the memory chips (and make sense of their contents) the data would still be present at this point.
- The drive is now free to erase the data as part of internal maintenance. This process is slow, and can only be done a limited number of times.
- If you were able to inspect the memory chips this information would now be gone.
Control of step 4 is entirely internal to the disk. It may happen nearly immediately, it may be some minutes (or longer) until the drive conducts background operations. This will be vendor and likely drive specific. However, from the operating system the data is unavailable immediately after step 2.
It's important to note that TRIM is a block level command and does not relate to files. The OS doesn't delete one file using TRIM, it deletes an entire disk block. When this happens will depend on the type of filesystem and the OS. Depending on how the filesystem stores data it may take considerable time before a whole block is ready to be erased. Therefore it's still possible to obtain fragments of files, deleted files, old versions of data from an SSD.
The OS could of course read all sectors starting at 0, ending at the last one. However, only current data will be read. Any sectors that have been released to the disk with TRIM will not be returned and are effectively lost.
Does this mean disk forensics is dead? Absolutely not. There is still plenty of useful evidence in file system structures, sectors which have not been overwritten etc.