If an SSD uses TRIM such as a Mac with TRIM support when it deletes files, I've been told that it is completely unrecoverable. Therefore, is it ever really better protection to physically destroy the SSD to protect one's data?
There are a couple reasons you might still want to physically destroy a drive instead of relying on TRIM:
- The OS may or may not have implemented TRIM correctly. Linux in particular can require a decent amount of configuration to get TRIM to work properly in all cases.
- The SSD may or may not have implemented TRIM correctly or at all. The feature is optional, and due to the significant number of security vulnerabilities in disk firmware relating to encryption, it's probably not prudent to place significant amounts of trust in SSD firmware when it comes to security.
- There may be sensitive regions of the disk, such as filename tables, that tend to get overwritten and don't get TRIM called on them.
- SSDs don't necessarily overwrite data. They contain wear-leveling algorithms that may write data to different places, and it's possible that old data may remain available.
- Physical destruction is guaranteed, and TRIM is not. Destroying the drive is generally cheap and easy and is, in any event, much, much cheaper and easier than dealing with a data breach.
If you'd like to reuse the disk, it's better just to encrypt the entire disk with a strong algorithm (such as AES-256-XTS) and then you can overwrite the segments of the disk with the parameter block by writing zeros to it. Once the parameter block is gone, the key is gone, and the data will be functionally unrecoverable unless the parameter block is backed up. However, this is still subject to the same limitations of wear-leveling algorithms and potential backups, so it carries some risk.
TRIM is not designed to erase data, and very likely does not at all. TRIM is designed to assist in wear leveling, and thus should not trigger extra writes to the TRIMed cell.
The standard says that reading a block that has been TRIMed gives undefined results -- likely, this is zeros, but it could be the original data, at least until the device decides to reallocate and reuse the block.
Even if a device does return zeros after a TRIM, it probably just marked the block as free and didn't actually erase the data in the cells. Data from that is "unrecoverable" in the sense that it can't be recovered by normal means. However, it might be possible to hack the firmware on the device to return all the data from TRIMed cells.