Wiped SSD Size v Manufacturer Size
I have a SK Hynix 256GB M.2 SSD NVMe PCIe drive that I believed to has been wiped. It was imaged using FTK and when I open it in X-Ways is appears to all unallocated space. When I run a checksum against it I get zeros as expected my problem is just that the size that X-Ways says it is (238 GB or 256,060,514,304 bytes, which is the 256 GB's) does not match the manufacturer size of 256 GB. I think there is an easy reason for this but I'm having a brain fart (if I can say that here) and am not sure why. Thanks for any assistance rendered...
The manufacturer size is 256 GB; what I'm really asking is why does X-Ways report the size as "238 GB or 256,060,514,304 bytes"? This seems confusing because 256,060,514,304 bytes is 256 GBs. It's not saying 238 of 256 GB, which would make more sense. I'm trying to determine if I'm looking at the entire drive.
256,060,514,304 B = 256GB according to the manufacturer which divides by 1000 Bytes to reach their figure.
256,060,514,304 B = 238GB according to X-Ways which divides by 1024 Bytes to reach it's figure.
Maybe if you think of X-Ways as stating it is 238GiB it will make things clearer for you.
The bigger question to me is, if you had access to X-ways, why did you use FTK Imager to create the disk image?
Side note: If the NVMe was wiped (or the data deleted?) then the data was more than likely trimmed. One of the few possibilities for recovering some data would be to use a PC3000 in “Factory Access Mode”.
See - Life after Trim: Using Factory Access Mode for Imaging SSD Drives