2024 Author: Malcolm Clapton | [email protected]. Last modified: 2023-12-17 03:44
In a guest article, Valery Martyshko from Hetman Software shares with Lifehacker readers how to recover files deleted from an external SSD or a regular flash drive, and also tells how to protect your data from unauthorized access using encryption.
There is a generally accepted point of view that it is impossible to recover data on a solid-state drive, that it can only be done on a regular hard drive. But this only applies to embedded media. Files on USB flash drives and external solid state drives (SSDs) are recoverable, which is often perceived as a privacy vulnerability.
But on the other hand, it's good. On such devices, you can recover accidentally deleted files, which, of course, is a useful feature. On the other hand, unauthorized people can take advantage of this to gain access to confidential information.
Why you can't recover deleted files from the built-in SSD
The reason why files can be recovered on a regular built-in hard drive in a computer is very simple. When you delete a file from such a disk, it is by and large not deleted. This data remains on the hard disk, it is simply marked by the system as deleted. The operating system retains information until it needs more disk space to store other data.
It makes no sense for the operating system to instantly clear sectors, as this will make the process of deleting files longer. And writing information to a previously used sector takes the same amount of time as writing information to an empty sector. Due to the large amount of such deleted data, data recovery software can scan the hard drive for unused space and recover information that has not yet been overwritten.
SSD drives work differently. Before any data is written to a flash memory location, the location is cleared first. New drives are initially empty, and recording on them is as fast as possible. On a full disk with many files deleted, the writing process is slower, since each cell must be cleared before it can be written to. This means the SSD will get slower over time. In order to avoid this, TRIM was introduced.
TRIM (English to trim) is an ATA interface command that allows the operating system to notify the solid-state drive about which data blocks are no longer contained in the file system and can be used by the drive for physical deletion.
When the operating system deletes files from the built-in SSD, it calls the TRIM command, and it instantly deletes the sector data. This speeds up the writing process in the future and makes data recovery on such a disk almost impossible.
TRIM only works with built-in drives
So, it is believed that it is impossible to recover files on an SSD. But this is not the case, because there is one very important caveat: TRIM is supported only by built-in (internal) disks. It is not supported by USB or FireWire interfaces. In other words, when you delete a file from a USB flash drive, external SSD, SD memory card or other type of solid state drive, the system simply marks it as deleted and it can be recovered.
This means that you can recover data on any external disks in the same way as on a regular HDD. In fact, such media are even more vulnerable than a conventional built-in HDD - they are easier to steal. They can be left somewhere, borrowed or lost.
Try it yourself
You can try it yourself. Take a USB flash drive, connect it to your computer and copy the files to it. Delete these files and run the program to recover deleted data. Scan your USB flash drive with it, and the program will see all deleted files and offer to restore them.
Quick format won't help
What about formatting? Let's format the flash drive, and nothing will be restored! After all, formatting deletes all files on the media and creates a new file system.
To test this, let's format our flash drive using the default quick format. Yes, indeed, using a quick scan, Hetman Partition Recovery was unable to detect deleted files. But a deeper full analysis was able to find a large number of deleted files that were on the flash drive before it was formatted.
Uncheck the quick formatting box and format it again. After that, the program finds it difficult to find the deleted files.
How to make sure that deleted files can no longer be recovered
Encryption solutions such as TrueCrypt, Microsoft BitLocker, built-in Mac OS or Linux can be used. Then no one will be able to recover deleted files without a key, and this will protect all files on the media, including deleted ones.
But this is only important if the medium is used to store important data. If this is a flash drive for listening to music in a car, then, of course, it is not necessary to encrypt it.
TRIM is a feature that helps you get the most out of your onboard SSD. However, it is not a security feature. Many people think that it guarantees the permanent deletion of data from any solid-state media. This is not the case - you can recover data on any external drive. Be sure to take this into account when deleting confidential or just important data.
Recommended:
How to recover files deleted in iCloud
Here's how to recover files you deleted in iCloud
How to delete files deleted from the "Recycle Bin" so that they cannot be recovered
There are programs that even recover data deleted from the "Recycle Bin". However, you can still delete files permanently. Here's how to do it
Why the computer does not see a USB flash drive or external hard drive and what to do about it
Common reasons why the computer does not see the data storage device, and the simplest ways to solve the problem
How to free up up to 5 gigabytes on iPhone and iPad without deleting anything
Sounds implausible, but there is no deception in the title. We'll show you how to quickly free up memory on your iPhone or iPad without deleting anything
How to recover files deleted from the "Recycle Bin"
Although all operating systems warn that emptying the Recycle Bin is irreversible, in reality it is not. You can recover deleted files using special programs