Hello, i'm building a forensic workstation but i have a problem with SSD unallocated space and carving. I read that there is two type of TRIM but the information about it is ambigous and unaccurate. I would like to know some answers about this
-1 Which is the exactly difference between DRAT and DZAT??
-2 If i delete a file the TRIM is executed but…. if the garbage collector has not been executed, could i recover those files?
-3 I understood that when you delete a file the TRIM is activated but… does the TRIM places in that area the zeros or deterministic info? or does it change the reading execution and you read zeros when, in the real device, there are the info previous to erase.
-4 If TRIM only changes read execution, could i recover with hardware duplicator the info from a ssd if the garbage collector has not been executed?
Sorry for my english and if the questions are stupid. Thank you for your time.
See here but may first study Part 1 and Part 2 (this is Part 3)
https://