dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
18
share rss forum feed


evanooo

@comcast.net
reply to evanooo

Re: [hard drive] cant recover deleted files from SSD

i tried recover right after erase, so nothing was overwritten
its a drive not used for temp files or anything so it wasnt used
im very sure if it was a mechanical drive i would have recovered files


jap
Premium
join:2003-08-10
038xx
said by evanooo :

i tried recover right after erase, so nothing was overwritten
its a drive not used for temp files or anything so it wasnt used
im very sure if it was a mechanical drive i would have recovered files

The below assumes you are trying to recover data which was stored on an active system partition (OS files live there).

What you're seeing is the result of

+ much less slack space to work with on an SSD
+ SSD speed means OS is tempted to use it more as a RAM extension than if a mechanical drive
= areas marked as available when trash is emptied gets quickly re-used.

Whenever wanting to recover data that was saved inside same partition as that used by the system files one always wants to immediately shut down, pull the drive, and slave it to another machine* to perform the recovery. This makes the drive a passive member of another system and the data you wish to recover won't be overwritten by normal running of the OS and apps.

Without knowing your system and what has been done with it since the trash was emptied it's impossible to guess likelihood that the data you seek has already been overwritten. You'll have to make the assessment of whether it's worth pulling the drive and how disruptive to your life it is to slave to another machine.

Wishing you luck...

_____
* which has been instructed to exclude slaved drive from use by the pagefile


koitsu
Premium,MVM
join:2002-07-16
Mountain View, CA
kudos:23
reply to evanooo
said by evanooo :

im very sure if it was a mechanical drive i would have recovered files

I'm sorry to say you misunderstand how the underlying technology works, and this is further justified by you asking the question in the first place. My previous comment stands firm: the issue has nothing to do with SSDs vs. classic MHDDs. The only thing that might impact it is TRIM, where the FTL is told to release an association of an LBA within a specific NAND page, but I would need to confirm this myself (I do not use a Windows OS which offers TRIM natively).
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.


evanooo

@comcast.net
No I dont misunderstand technology! I worked 20 years for a think tank technology company who built more tech than you know! Now you claim to know more after someone else said it might be TRIM !
and no its not a system drive, there's no recycle bin, no temp files, no restore points or whatlike. its cant be that 1000 files were all overwritten within 20 seconds, the SSD destroyed them somehow.


norwegian
Premium
join:2005-02-15
Outback

I think you will have to go with Nand based flash of the SSD does not store data like the magnetic surface of a platter.

This may change some people's idea of what HDD to use for what application. Or back ups will become a basic requirement with SSD's - as crashes and such will wipe active new data back to a previous point of the recorded system.
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke



Hank
Searching for a new Frontier
Premium
join:2002-05-21
Burlington, WV
kudos:3
reply to evanooo
I am a bit confused where these files executable or data files. It appears that you were able to recover the files but you cannot open them? Can you copy the files to a thumb drive and attempt to open them on another system?


mmainprize

join:2001-12-06
Houghton Lake, MI
Reviews:
·Charter
reply to evanooo
Koitus known what he is talking about, he has helped many here with Hard drive questions. He is correct this deals with files system first and then it may have something to do with TRIM if your SSD/Controller/Driver are even capable of using it.

In order for anyone here to really help you, we would need details.
The OS, the Drive make and model, the Mother board and the drivers used, what controller port was the drive connected to Intel, marvell, etc...

What was used to delete the files, Explorer or something else, just the delete key or Shift - Delete. We assume recycle-bin was turned off. Things like this make a differance.

What software was used to try and undelete the files, or see the files.

Shootist
Premium
join:2003-02-10
Decatur, GA
kudos:3

1 recommendation

reply to evanooo
said by evanooo :

and no its not a system drive, there's no recycle bin, no temp files, no restore points or whatlike. its cant be that 1000 files were all overwritten within 20 seconds, the SSD destroyed them somehow.

In Windows there is a Recycle bin on every drive. So you aren't using Windows.
No the SSD did not destroy them. YOU DID when you deleted files you shouldn't have. That is what the DELETE key/command is for, IE to DELETE (IE Get Rid Of) Files.
And that is exactly what it did. Oh Well your 20 years at the Think Tank Tech company was slightly wasted
--
Shooter Ready--Stand By BEEP ********


evanooo

@comcast.net
RTFM Windows allows disable of "recycle bins" on any drive
RTFM When a file is deleted in NTFS, it is marked as deleted within the MFT entry for that file. Marked deleted != concomitant overwriting of data.
its a OCZ vertex3 on intel mobo
like i said i tried Recuva and EaseUS

i just tried several small (10K) txt files and it recovered that, but, files 4MB (jpgs) or 200MB (pdfs) were not, i'm not gonna hex them to see how much info is left because it doesnt matter- at least header and beginning is lost.


koitsu
Premium,MVM
join:2002-07-16
Mountain View, CA
kudos:23

1 edit

1 recommendation

said by evanooo :

Marked deleted != concomitant overwriting of data.

You're correct -- however, guess what SSD-oriented operation gets executed by the kernel on deletion of data (i.e. shrinking of files, deletion of files, and similar operations), under Windows Vista and newer? TRIM (i.e. ATA CDB command 0x06). And you know what TRIM does, yes? If not, here you go:

»en.wikipedia.org/wiki/TRIM#Operation
»techgage.com/article/too_trim_wh···ossible/

This guy basically sums it up correctly (despite the article author in comment #17 stating "I'm not so sure that's true" -- his understanding of how it works isn't right, while what the guy says in #15 is correct. "Look up table" and "virtual blocks", by the way, refers to the FTL):

»forums.techgage.com/showpost.php···count=15

So this refutes my original statement (my first reply) that there's generally no difference between and SSD and an MHDD. I'm quite happy to admit when I'm wrong, and this is one of those cases. So there you go: I was wrong.

The reason I was wrong is explainable as well: 1) I historically have not used OSes that offer TRIM capability (i.e. I use XP for my workstation, with an SSD; my servers have historically used FreeBSD which only semi-recently introduced TRIM support for UFS only), and 2) TRIM behaviour (meaning inside the SSD) actually varies based on SSD brand and firmware version. So what I've historically been familiar with (first-gen SSDs) is different than what's out there today.

However, you also have to keep in mind that just because you delete a file doesn't mean the OS itself, or one of the zillions of other services/daemons running on the system at the same time, doesn't issue a write request to the drive (for an unrelated operation). This happens regardless of drive type (SSD vs. MHDD). The NTFS journalling mechanism comes to mind, for example -- that's done under-the-hood so you wouldn't have any visibility into that happening. The last OS I used where things weren't happening in the background/"behind the scenes" was MS-DOS.

So in summary, I'm sorry for being wrong and getting you all riled up in the process. I do know a lot about storage, but SSDs (even to me) are still new and I am still learning as time goes on. MHDDs are a different story (and you can view my many posts here for justification on that).

HTH in some way.
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.


evanooo

@comcast.net
thanks,
its why i posted here, knew someone had to know something...because it almost never happened with non-system MHDD that i couldn't recover freshly deleted files
and its not an OS drive forgot to mention that

Shootist
Premium
join:2003-02-10
Decatur, GA
kudos:3
reply to evanooo
So not only did you delete files you shouldn't have you also completely turned off the function of the Recycle bin.

I guess the RTFM parts of your reply to me was for your own benefit.
--
Shooter Ready--Stand By BEEP ********


evanooo

@comcast.net
"I just deleted some files" != i put some files in the Recovery Bin.

RTFM, chapter: recycle bin files are not deleted.

file recovery does not mean recover from recycle bin.


norwegian
Premium
join:2005-02-15
Outback
I think what Shootist See Profile is implying is that your own methodology shot yourself.

Not having Recycle Bins as a back up before final deletion of files is like not backing up your sensitive data to back up drives. It will lower storage room required for your system, but the risks are higher - someone with experience would understand the implications.

And now you have been stung by your own tweaks.

Call his reply a rude reply if you want, but facts are facts and permanently deleted files, recycle bin or not, do set a call on the O/S as mentioned to over write the space and recovery is not always possible. As learnt SSD's are not magnetic material. Backups are important at any level.

Costly lesson I guess if those images meant something to you.
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke