TRIM command for SSD - problem for forensics analysis?

Maybe I'm missing something here, but zero'd out or not, the same amount of data gets written to the same area? I cannot see where any speed benefit can be gained at all.

With SSD drives having a finite number of WBF's (write's before failure), surely this process alone will 1/2 the life expectancy. Certainly not a feature I'd like to use!

Maybe I'm missing something here, but zero'd out or not, the same amount of data gets written to the same area? I cannot see where any speed benefit can be gained at all.

With SSD drives having a finite number of WBF's (write's before failure), surely this process alone will 1/2 the life expectancy. Certainly not a feature I'd like to use!

Wardy, things are a little different with SSD drives and how they store data, with the TRIM command actually increasing life expectancy and restoring performance. This excellent piece http//bit.ly/3AODAM is worth reading on the subject.

TRIM is now supported by Windows 7 and Windoes 2008 R2. As I understand it, the implication of the TRIM command on SSDs for computer forensics is as memon says; when a user deletes something it will be gone for good.

TRIM is now supported by Windows 7 and Windoes 2008 R2. As I understand it, the implication of the TRIM command on SSDs for computer forensics is as memon says; when a user deletes something it will be gone for good.

Not quite so sure about that. After all, noone will wipe the block, as that means an extra write. There's probably some kind of internal list of blocks that have been TRIM'd – if one of those blocks are requested, the drive returns zero immediately. But the old block contents may still be there.

Is the TRIM command standardized yet, or is it just a proposed standard? I would expect some kind of MIRT command in a final standard, that is, a command that returns block to the allocated pool, possibly without wiping them. There are, I'm pretty sure ATA commands to manipulate the defect lists (which are purely internal to the drive), so I would expect something similar to appear for TRIM'd blocks.

Not quite so sure about that. After all, noone will wipe the block, as that means an extra write. There's probably some kind of internal list of blocks that have been TRIM'd – if one of those blocks are requested, the drive returns zero immediately. But the old block contents may still be there.

Is the TRIM command standardized yet, or is it just a proposed standard? I would expect some kind of MIRT command in a final standard, that is, a command that returns block to the allocated pool, possibly without wiping them. There are, I'm pretty sure ATA commands to manipulate the defect lists (which are purely internal to the drive), so I would expect something similar to appear for TRIM'd blocks.

If you click on the link in my earlier post, and in particular page 10 of the article it explains things further. TRIM appears to be standardised with, as far as I know, all the main SSD manufacturers enabling it on their drives. It's been part of Linux distributions since December 2008 and is (or soon will be) enabled in Windows 7 and Windows 2008.

Jonathan,

I am familiar with the TRIM command. I've just read the article you gave the link to - very informative. It doesn't state that the TRIM command will extend the longevity of the device, only that it will improve performance.

The improved performance is a bit of a slap in the face though as deleting takes longer. Even so it seems the performance still drops off the more you use the SSD drive.

As I see it, if I don't use TRIM, when I delete a file, no writes are made. When I write a new file, the whole block is copied out and a new one containing my file is written back. So thats 1 write.

If I do use TRIM, and delete a file, There is instantly a read and write to that block to clear it (or a portion of it). Upon writing something which can be placed into that block, the block is again read and written to? That's 2 writes.

Now there is a clause to what I have just said - in that the "unused" area is used as a means to get around this problem. However, that soon gets used up. Regardless, the point I am making is still valid. That now "unallocated" block receives two writes instead of one, whether it's re-used instantly or in the future, thus reducing the life expectancy of the drive (once to wipe it, again in the future to write data back).

EDIT - I forgot to add, I do now realise the speed benefit, I didn't realise the data was written to an unused area.

The durability of SSDs was not my main point - which was about the availability of deleted data - however the fact that the length of warranties offered by SSD manufacturers is much greater than the equivalent mean time before failures offered on hard disk drives tells its own story. Of course some of that is down to SSDs having no moving parts and generating a lot less heat, but wear leveling is not so much of an issue when you've some manufacturers who are confident enough to offer 10 year warranties on their SSDs!

I realised that after D Apologies.

With regards to the 10 year life though, that isn't based upon the max number of writes the drive should be able to handle. It is based upon how long the chips can reliably retain the data.

Accelerated life testing has given a figure of around 10 to 20 years for data retention, dependant upon temperature.

I've seen erase cycles limited to a figure as low as 100,000. If trim effects two writes, you can guarantee a shorter life span. I guess the real issue is what is the drive used for? If it's largely just a storage repository, written to rarely, read from often, it's going to last a long time.

TRIM indicates to the SSD that a block is no longer in use and can be erased. (I don't think it's guaranteed that the SSD will necessarily immediately erase the block.) Note that "erase" on an SSD does not work the same as what you would normally think of as erasing – writing over the block with zeros. It's a separate procedure from writing, and a written block cannot be written again until it's first erased. When a block is written to normally, the block is first erased and then written.

TRIM appears to be standardised with, as far as I know, all the main SSD manufacturers enabling it on their drives.

OK, so you don't know either.

I've only found a proposed standard for ATA8-ACS2 from december 2007 – which seems long enough ago that I thought it might have been ratified recently. But then it is probably still at the proposal stage of the standardization process.