(TRIM is a SATA command, UNMAP is its SCSI/SAS analog)

For years speed and capacity have been the most challenging parameters for storage devices. At the same time such devices should remain compact and not power-hungry, which is especially important for laptops and portable storage devices. Such devices should also be affordable to home and small business consumers. Electronic industry has come out with a rational solution: it offers solid-state drives (SSD) as ultra fast storage devices and 2.5" SMR hard drives as high-capacity yet compact and low-power-consuming storage devices. Respectively, SSDs are used primarily as system devices, scratch, and temporary storage devices due to their speed, while 2.5" SMR hard drives are used as high-capacity storages. And when both these types are used together, the overall hybrid system becomes very fast and capacious. Our article "How to Move the Already Installed Windows from an Old HDD to a New SSD Device and Create a Hybrid Data Storage System" explains how to create such a system.

Beside a lot of advantages, such devices have some drawbacks, especially when it comes to accidentally deleted or lost files recovery. In this article we will explain why it's so and what to expect when you recover files from a device with the TRIM/UNMAP command.

We'll start our explanations with some basic principles of their operations.

SSD devices
Most modern computers, even very inexpensive ones, have an SSD as their system storage device (and quite often the only one). Such devices are faster, run silently, consume less power, and more resistant to physical shock when compared to conventional hard disk drives.

There are two types of SSD devices which differ in their form factors: with the old 2.5" one (the same as for conventional HDDs) and a new one M.2, which looks similar to a memory plank.

Fig.1. Two form-factors of SSD storage devices: 2.5" (left) and M.2 (right)
Click image to enlarge

Unfortunately, such devices have also some serious drawbacks, with file recovery being one of them.

SSD Basics
When a file is deleted from a mechanical drive, the OS simply marks the disk area occupied by the file as free, but its data is left on the disk untouched until some new file overwrites it. When a data recovery program accesses the untouched area it gets the old data. That is how file recovery works.

An SSD however, must either use its new cells, or first purge the old data in the occupied cells to store the fresh data. Purging old data in SSDs is quite a slow process. That is why file deletion in an SSD works in the following way: when a user, program, or OS itself deletes a file, the OS issues the TRIM command that informs the SSD that the data is no longer needed. The SSD puts the cells the file occupied to a special pool to be purged later. When any program or OS requests data from those cells, the SSD simply returns garbage or zeros.

Moreover, the device constantly shuffles the data across its cells to level their wear, and only the device itself knows where the file data is stored at any given time. The OS has no control over this process, and furthermore, it has no means to know the actual physical location of the data.

This is why data recovery from SSD devices when the TRIM command is used is extremely difficult, and in most cases impossible.

SSDs are solid state storage devices, like other flash memory types (SD cards, memory sticks, and alike), but not all solid state storage devices are SSDs. R-Studio shows whether the flash device supports the TRIM command in the Features field on the S.M.A.R.T. tab.

Fig.2.TRIM support in SSD devices
Click image to enlarge

Hard drives with the SMR technology
The SMR (Shingled Magnetic Recording) technology is used to overcome the main obstacle for increasing capacity in compact hard drive: limitations for storage density. Unlike conventional hard drives which write data in non-overlapping magnetic tracks parallel to each other, SMR drives write data in partially overlapping tracks allowing for higher track density. Such recording resembles roof shingles, hence the name.

This technology indeed increases hard drive capacity, but when data is to be overwritten or deleted, this operation will affect a part of other overlapping tracks with the corresponding data, too. To save the data on the overlapping tracks, it should be written elsewhere, which makes this operation very slow. To accelerate this process, the same principles as in SSD devices and the same command TRIM are used. The effect to data recovery is the same: when any program or OS requests data from deleted files, the hard drive returns zeros or garbage, making data recovery extremely difficult or impossible.

Usually SMR disks bear a special mark on its case.

Fig.3.Hard drive with the SMR technology
Click image to enlarge

R-Studio shows whether the hard drive supports the TRIM command in the Features field on the S.M.A.R.T. tab.

Fig.4.TRIM support in hard drives with the SMR technology
Click image to enlarge

Storage devices, OSs, and file systems that support the TRIM command
TRIM works when all three components support it: a storage device, operating system, and file system on the TRIM-supported device. Almost all modern SSD devices and 2.5" hard drives large than 1 TB support the TRIM command. As for complex volumes consisting of SSDs and SMR hard drives, it depends. Linux LVM2 and Windows software RAIDs support TRIM, whereas software RAIDs in macOS and most hardware RAID controllers don't.

Virtual disks of virtual machines are a little trickier. The fact that a virtual disk is stored on a TRIM-supported devices doesn't mean anything. For the host OS, this disk is a valid file and all disk operations of its virtual machine is read-write operations for that file. Inside the virtual machine with a virtual TRIM-supported disk, it all depends on the virtualization software. Some just simulate the TRIM command and return garbage without any actual changes on the SSD file, while some change file data.

Major OSs and file systems that support the TRIM command:

How the TRIM command affects data recovery
Deleted files and formatted disks:
Windows and Mac: Almost always impossible. Even raw file recovery cannot help.
Linux: Possible if done before the TRIM command is issued.

Files lost in slightly damaged file systems (recognized by their native OS):
Every OS is gradually repairing such file systems using the TRIM command to delete garbage, invalid file records, and unnecessary files. Data recovery is possible if done fast and on systems with the TRIM command disabled.

Severely damaged file systems (not recognized by their native OS):
Data recovery is possible because the OS cannot repair them and doesn't delete any data.

How to minimize the negative effect of the TRIM command
Some steps can be made to minimize the negative effect of the TRIM command when the data recovery is possible.

• Disable the TRIM command while recovering data. Don't forget to enable it once file recovery is complete.

Windows:
Press Win + X key key combination.
Windows PowerShell will appear:
Enter "fsutil behavior set DisableDeleteNotify 0/1"
(1 to disable, 0 to enable)

macOS:
In Terminal, enter "sudo trimforce disable"
Enter the administrative password, and answer "Y" to several questions.
The computer will automatically restart with TRIM disabled

To enable TRIM back, enter "sudo trimforce enable".

Linux:
Depends on distros and settings. Consult documentation for the particular installation.

Conclusion
Data recovery from TRIM-supporting devices operating on a major modern OS is mostly impossible for deleted files and formatted devices, and very difficult in other cases, at least when only software solutions are used. Anyone claiming otherwise is either incompetent or willfully deceiving their customers. The exception is a very small number of highly advanced data recovery companies with qualified personnel that in some cases can recover data deleted from an SSD device with the enabled TRIM command. Still, such procedure requires physical access to device's internal components and a lot of manual investigation.

This is why proper and regular data backup is especially important for computers with SSD storage devices. R-Drive Image, created by R-TT Inc., is a powerful and adored software for backing up SSDs and another storage devices. You can download its fully functional version and try it for 30 days with no restrictions.