A Samsung SSD in NTFS format - added the physical drive to FTK Imager - except for a few format files that are otherwise invisible on the normal OS like the File slack there's nothing in the root file and the rest of the data is all unallocated space (which shows as random characters and a lot of 0s).
I presume the drive was reformatted.
Is there anything else that can be done to locate any deleted data on this drive given that it is an SSD - I heard some people say there's a reserve part of the memory on SSDs that's not accessible easily that may hold some other data?
Or does FTK Imager really show all there is?
Â
TRIM will try and blank any unused sectors - so deleted files will 'disappear'
You could give file carving a go. If the TRIM command has been sent to the SSD then the internal garbage collection process on the drive will kick in whenever it is powered up irrespective of it being booted via the host device. Write blockers at this point aren't going to be a great deal of use as the GC service will run independently on the drive (although I would still recommend always using a write blocker even if this is the case as you can still overwrite data at this point just from connecting it to a host, albeit minimal). If the drive was encrypted with BitLocker or some other disk encryption and then formatted, then it is highly unlikely you will recover any meaningful data. I would carve the image you created with FTK Imager for all know file types using a tool such as X-Ways just to see what is recoverable.Â
TRIM will try and blank any unused sectors - so deleted files will 'disappear'
Are you quite sure this is the case for external SSDs that are not system managed?
This is a 4TB SSD we are talking about. I have checked and the only way to run TRIM on an external drive like this is to manually go to the Properties and Optimise the disk manually by running TRIM (isn't it?) - the whole process on a 4TB SSD takes no more than 60 seconds. How can a 4TB drive be blanked beyond recovery in 60 seconds?
Or is it another type of TRIM command you are talking about running in a different manner?
