I’ve recovered many SD cards and HDDs using ddrescue, TestDisk and PhotoRec but not many SSDs.
Some guy I know messed up while installing Windows, he deleted all partitions failing to notice one of those is on a second SSD. Once all partitions were deleted he realized the mistake since Disk Management presented him with an option to make new partitions on two disks.
He powered the system off immediately and called me.
My understanding is OS issues Trim after deleting files, which notifies SSD garbage collection to free up blocks to make future writes faster.
What I don’t know is if Disk Management issues Trim after deleting the partition(s)? If it does it’s a pretty much a ticking time bomb and garbage collection will soon wipe all blocks (if not already)?
If not, is there any point in trying to make a ddrescue image than trying TestDisk to recover partition metadata?
Is there a way to prevent garbage collection from running? Will SSD still delete unmapped blocks on a firmware level?
What’s the best approach here, attempt to recover the partition itself as fast as possible - basicly trying to outrun garbage collection, or take the time to make a ddrescue image to have something to fallback to?
First of all, he did not delete files. He only deleted the partition. Second, no TRIM is not always running. And even if there was a TRIM happening afterwards, that does not mean that files got overwritten by TRIM moving stuff around.
Same as with normal HDD. It is nice to recover from a clone and leave the original alone.
I don’t know what Windows does when you delete a partition, but my guess is it just rewrites the partitioning data. I.e. it probably doesn’t immediately touch any of the actual data on the partition.
So yeah, a ddrescue image sounds like a (very) good idea. (Unless the data is extremely important; valuable enough to call for professional data recovery. If so, don’t do anything at all before turning the SSD in.)
I don’t have any specific knowledge about SSD firmware, but I’ve written a bunch of “embedded” software. If it was me, once a trim had been issued for a block I would no longer read it from flash if a read was issued. Instead I would just return zeros. So I’d think that if the blocks of the partition has actually been trimmed, your only hope is to do advanced/professional data recovery who’d try to access data by desoldering the chips and reading them directly. Which would also require specific knowledge about mapping tables and such on that specific SSD. And you’d need to be lucky enough that the blocks hadn’t been actually erased by the firmware yet.
I don’t know if TRIM was issued adter deleting a partition; my guess is that this is only done when the equivalent of diskpart’s CLEAR command is run (to delete all partitions at once).
Try ddrescue; the worst that can happen is that it fails.
Deleting a partition in Disk Management does not instantly TRIM the entire SSD. TRIM is issued by the file system, and once the partition is gone there’s no mounted file system to trigger it. What can happen later is Windows’ scheduled “retrim” maintenance, which may send TRIM hints for unallocated space if the drive stays connected and online. That’s why the smartest move is to keep the SSD powered off until you’re ready, then connect it read-only and image it immediately. You can’t truly stop firmware garbage collection forever, but without TRIM it’s usually slow and incomplete. Recovering the partition metadata from an image is safer than working on the live SSD, and you’re not really “outrunning” GC so much as minimizing how much information you give the drive to clean up.
Thanks everyone for your insights, I’ve managed to make a dd image - it only took 7 minutes. After imaging, testdisk recoverd the NTFS partition.
It turned out that the data was their Steam drive - so I’m a bit pissed off right now. But on the other hand I’ll take it as a learning experience.
Thanks again everyone for your time, I’m curious to recreate the situation and see how long it takes for data to become unrecoverable. Maybe a (fun) weekend project.