dslreports logo
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
6019
share rss forum feed


evanooo

@comcast.net

[hard drive] cant recover deleted files from SSD

I just deleted some files off the SSD by mistake, and i tried 2 recover software Recuva and EaseUS, they both show the files as good but after recovered they dont work. Is there something that works? or is this a SSD problem


koitsu
Premium,MVM
join:2002-07-16
Mountain View, CA
kudos:23

1 recommendation

Issue has absolutely nothing to do with SSDs vs. classic mechanical HDDs. This is purely a filesystem thing.

Writes to the filesystem obviously happened to the drive between the time you deleted the files and the time you attempted to recover them.

Moral of the story: do backups.
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.


evanooo

@comcast.net
reply to evanooo
i tried recover right after erase, so nothing was overwritten
its a drive not used for temp files or anything so it wasnt used
im very sure if it was a mechanical drive i would have recovered files


jap
Premium
join:2003-08-10
038xx
said by evanooo :

i tried recover right after erase, so nothing was overwritten
its a drive not used for temp files or anything so it wasnt used
im very sure if it was a mechanical drive i would have recovered files

The below assumes you are trying to recover data which was stored on an active system partition (OS files live there).

What you're seeing is the result of

+ much less slack space to work with on an SSD
+ SSD speed means OS is tempted to use it more as a RAM extension than if a mechanical drive
= areas marked as available when trash is emptied gets quickly re-used.

Whenever wanting to recover data that was saved inside same partition as that used by the system files one always wants to immediately shut down, pull the drive, and slave it to another machine* to perform the recovery. This makes the drive a passive member of another system and the data you wish to recover won't be overwritten by normal running of the OS and apps.

Without knowing your system and what has been done with it since the trash was emptied it's impossible to guess likelihood that the data you seek has already been overwritten. You'll have to make the assessment of whether it's worth pulling the drive and how disruptive to your life it is to slave to another machine.

Wishing you luck...

_____
* which has been instructed to exclude slaved drive from use by the pagefile


mmainprize

join:2001-12-06
Houghton Lake, MI
Reviews:
·Charter
reply to evanooo
Well the operating system you are on might help.
If you tweaked the system you may have turned off Restore, File History in win 8 , Indexing, prefetch, Recycle Bin, and other thing that are done often on SSD. Did you do these as that might be why you can not recover.
Also some MB/Driver combos work different with SSD's in this area of TRIM. Some will delete the file right away and not leave it to be recovered, other wait until a TRIM command is given to delete the file completely.


koitsu
Premium,MVM
join:2002-07-16
Mountain View, CA
kudos:23
reply to evanooo
said by evanooo :

im very sure if it was a mechanical drive i would have recovered files

I'm sorry to say you misunderstand how the underlying technology works, and this is further justified by you asking the question in the first place. My previous comment stands firm: the issue has nothing to do with SSDs vs. classic MHDDs. The only thing that might impact it is TRIM, where the FTL is told to release an association of an LBA within a specific NAND page, but I would need to confirm this myself (I do not use a Windows OS which offers TRIM natively).
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.


evanooo

@comcast.net
No I dont misunderstand technology! I worked 20 years for a think tank technology company who built more tech than you know! Now you claim to know more after someone else said it might be TRIM !
and no its not a system drive, there's no recycle bin, no temp files, no restore points or whatlike. its cant be that 1000 files were all overwritten within 20 seconds, the SSD destroyed them somehow.


norwegian
Premium
join:2005-02-15
Outback
kudos:1

I think you will have to go with Nand based flash of the SSD does not store data like the magnetic surface of a platter.

This may change some people's idea of what HDD to use for what application. Or back ups will become a basic requirement with SSD's - as crashes and such will wipe active new data back to a previous point of the recorded system.
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke



Hank
Searching for a new Frontier
Premium
join:2002-05-21
Burlington, WV
kudos:3
reply to evanooo
I am a bit confused where these files executable or data files. It appears that you were able to recover the files but you cannot open them? Can you copy the files to a thumb drive and attempt to open them on another system?


mmainprize

join:2001-12-06
Houghton Lake, MI
Reviews:
·Charter
reply to evanooo
Koitus known what he is talking about, he has helped many here with Hard drive questions. He is correct this deals with files system first and then it may have something to do with TRIM if your SSD/Controller/Driver are even capable of using it.

In order for anyone here to really help you, we would need details.
The OS, the Drive make and model, the Mother board and the drivers used, what controller port was the drive connected to Intel, marvell, etc...

What was used to delete the files, Explorer or something else, just the delete key or Shift - Delete. We assume recycle-bin was turned off. Things like this make a differance.

What software was used to try and undelete the files, or see the files.

Shootist
Premium
join:2003-02-10
Decatur, GA
kudos:3

1 recommendation

reply to evanooo
said by evanooo :

and no its not a system drive, there's no recycle bin, no temp files, no restore points or whatlike. its cant be that 1000 files were all overwritten within 20 seconds, the SSD destroyed them somehow.

In Windows there is a Recycle bin on every drive. So you aren't using Windows.
No the SSD did not destroy them. YOU DID when you deleted files you shouldn't have. That is what the DELETE key/command is for, IE to DELETE (IE Get Rid Of) Files.
And that is exactly what it did. Oh Well your 20 years at the Think Tank Tech company was slightly wasted
--
Shooter Ready--Stand By BEEP ********


evanooo

@comcast.net
RTFM Windows allows disable of "recycle bins" on any drive
RTFM When a file is deleted in NTFS, it is marked as deleted within the MFT entry for that file. Marked deleted != concomitant overwriting of data.
its a OCZ vertex3 on intel mobo
like i said i tried Recuva and EaseUS

i just tried several small (10K) txt files and it recovered that, but, files 4MB (jpgs) or 200MB (pdfs) were not, i'm not gonna hex them to see how much info is left because it doesnt matter- at least header and beginning is lost.


koitsu
Premium,MVM
join:2002-07-16
Mountain View, CA
kudos:23

1 edit

1 recommendation

said by evanooo :

Marked deleted != concomitant overwriting of data.

You're correct -- however, guess what SSD-oriented operation gets executed by the kernel on deletion of data (i.e. shrinking of files, deletion of files, and similar operations), under Windows Vista and newer? TRIM (i.e. ATA CDB command 0x06). And you know what TRIM does, yes? If not, here you go:

»en.wikipedia.org/wiki/TRIM#Opera ··· peration
»techgage.com/article/too_trim_wh ··· ossible/

This guy basically sums it up correctly (despite the article author in comment #17 stating "I'm not so sure that's true" -- his understanding of how it works isn't right, while what the guy says in #15 is correct. "Look up table" and "virtual blocks", by the way, refers to the FTL):

»forums.techgage.com/showpost.php ··· count=15

So this refutes my original statement (my first reply) that there's generally no difference between and SSD and an MHDD. I'm quite happy to admit when I'm wrong, and this is one of those cases. So there you go: I was wrong.

The reason I was wrong is explainable as well: 1) I historically have not used OSes that offer TRIM capability (i.e. I use XP for my workstation, with an SSD; my servers have historically used FreeBSD which only semi-recently introduced TRIM support for UFS only), and 2) TRIM behaviour (meaning inside the SSD) actually varies based on SSD brand and firmware version. So what I've historically been familiar with (first-gen SSDs) is different than what's out there today.

However, you also have to keep in mind that just because you delete a file doesn't mean the OS itself, or one of the zillions of other services/daemons running on the system at the same time, doesn't issue a write request to the drive (for an unrelated operation). This happens regardless of drive type (SSD vs. MHDD). The NTFS journalling mechanism comes to mind, for example -- that's done under-the-hood so you wouldn't have any visibility into that happening. The last OS I used where things weren't happening in the background/"behind the scenes" was MS-DOS.

So in summary, I'm sorry for being wrong and getting you all riled up in the process. I do know a lot about storage, but SSDs (even to me) are still new and I am still learning as time goes on. MHDDs are a different story (and you can view my many posts here for justification on that).

HTH in some way.
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.


evanooo

@comcast.net
thanks,
its why i posted here, knew someone had to know something...because it almost never happened with non-system MHDD that i couldn't recover freshly deleted files
and its not an OS drive forgot to mention that

Shootist
Premium
join:2003-02-10
Decatur, GA
kudos:3
reply to evanooo
So not only did you delete files you shouldn't have you also completely turned off the function of the Recycle bin.

I guess the RTFM parts of your reply to me was for your own benefit.
--
Shooter Ready--Stand By BEEP ********


evanooo

@comcast.net
"I just deleted some files" != i put some files in the Recovery Bin.

RTFM, chapter: recycle bin files are not deleted.

file recovery does not mean recover from recycle bin.


norwegian
Premium
join:2005-02-15
Outback
kudos:1
I think what Shootist See Profile is implying is that your own methodology shot yourself.

Not having Recycle Bins as a back up before final deletion of files is like not backing up your sensitive data to back up drives. It will lower storage room required for your system, but the risks are higher - someone with experience would understand the implications.

And now you have been stung by your own tweaks.

Call his reply a rude reply if you want, but facts are facts and permanently deleted files, recycle bin or not, do set a call on the O/S as mentioned to over write the space and recovery is not always possible. As learnt SSD's are not magnetic material. Backups are important at any level.

Costly lesson I guess if those images meant something to you.
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke



mmainprize

join:2001-12-06
Houghton Lake, MI
Reviews:
·Charter

1 edit
reply to evanooo
It is common practice to turn off the Recycle Bin on a SSD drive. Because of the limited writes lifespan, i guess the new SSD drives these tweaks may not be as important. The newer drive have some features built-in.

See here on pages 2,3,4,5 some the common tweaks of an SSD
»thessdreview.com/ssd-guides/opti ··· guide-2/

But once the tweaks are done you have to be careful not to delete what you don't want deleted. But we all make mistakes sometimes.

This gives a detailed info on GC and TRIM on SSD's
»thessdreview.com/daily-news/late ··· -primer/


koitsu
Premium,MVM
join:2002-07-16
Mountain View, CA
kudos:23
I just want to make it clear to some folks, specifically with regards to this "guide" (I haven't gone through it completely yet):

»thessdreview.com/ssd-guides/opti ··· guide-2/

1. Do not disable the Windows pagefile. I repeat: do not. If you have a 2nd disk and you want to move it there and disable the one on your SSD, great. If you want to leave it on your SSD, also great. Just do not disable it.

The Windows kernel will actually utilise the pagefile for things which most people don't realise. Ex: when a driver is loaded into memory on boot, if that driver is no longer used/referenced (after some amount of time; it's adjustable in the Registry), the kernel will actually offload the driver and/or some of its memory space into the pagefile, freeing up system RAM. No pagefile = everything must remain in RAM no matter what.

Here are some other reasons as well.

If your SSD is so small that you're worried about the amount of space the pagefile takes up, then adjust the pagefile size to something smaller (though my advice would be to get a bigger SSD. More capacity = more room for wear levelling to utilise = your NAND pages will last longer). But please do not disable the pagefile entirely.

2. Disabling the Recycle Bin (i.e. when you drag things there they immediately get deleted) does not provide any improvement with regards to SSDs. The article (on page 4) says this complete and total nonsense:

quote:
This will assist in instant activation of trim upon delete for smaller files. ...
TRIM gets used when the I/O subsystem issues such things as file size changes (going from larger to smaller), or on actual file deletions. Whether you disable the Recycle Bin (i.e. files are deleted immediately) or leave the Recycle Bin enabled (i.e. files are truly deleted from the filesystem when you empty the bin), this as absolutely no bearing on SSD life, wear levelling, or performance.

When you drag a file to the Recycle Bin, all Windows does is actually move (not copy!!) the equivalent of the file inode into the subdirectory in the root of the filesystem called RECYCLER (I'm assuming NTFS here; it's called RECYCLED on FAT/FAT32. reference). The file doesn't actually get deleted (i.e. TRIM does not get induced) until you empty the Recycle Bin, hence why the above "guide" advice item is nonsense.

This is why I generally hate "enthusiast" sites, as more often than not they consist of dudes talking about things / giving advice who don't actually have any familiarity with the underlying design or protocols involved. Engineers like myself could spend our entire day, every day, for years, running around to forums/sites and explaining to people why these nonsensical "tips" are often wrong/bad -- and if we did that, we'd never get anything actually done.

I tend to recommend people read sites like stackoverflow.com instead, where "advice" and so on tends to be highly technical and can be ranked -- usually by other technically-inclined individuals. The site is not a "how do I get another 5 fps in Quake" type of site; it's more intended for people who actually want to understand technology, rather than "just fiddle around with things out of boredom".
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.

Gary george

join:2013-02-28
560068
reply to evanooo
Hi..
If you lost your data from ssd hard drive then you can make use of one of the skilled ssd hard drive recovery tool that you can easily get from the internet.

dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
reply to koitsu
FWIW, it's $Recycle.Bin these days (win7).


JeffMD

join:2002-08-16
Edgewater, FL
kudos:1
reply to evanooo
Evanno, since SSD is alot more complex, there is not only a processor but even a good chunk of memory on the drive set aside to let the processor work on managing the drive. This means a lot of tricks and trust that the computer and file system where handling before are now handled by this offloaded processor. That also means accessing behind the scenes like when undeleteing files doesn't work, and the software just does not work.

From a security stand point there is a possible way of recovering data blocks before the trim command hits them and they are gone for good.. but it takes time and a specialist.

dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS
reply to evanooo
Click for full size
Unless you're one of those people who like to turn off "unnecessary" components of the OS, the easiest way to recover deleted files in Windows is to use the previous-versions feature of the file system. Right-click, properties, previous-versions, then open the version you want to.

For a deleted file, of course there's nothing to right-click on, but you just open up the prev-version of the parent directory.

This won't help you with files that were created "today" and then deleted, since volume snapshots are taken daily and not on every file change, but it is still useful.
Expand your moderator at work