|
I don't think TRIM usually actually deletes the data, as that would cause unnecessary excess wear, as minimal as it may be. The real problem is that TRIM marks blocks as empty, and that, combined with wear leveling, causes the mappings to get changed. The data you recover from what was the desired data's addresses is actually data from what is essentially other random locations that have been mapped in by the wear leveling mechanism. If you attempt the recovery quickly enough, your data is still likely on the drive, but it's randomly shuffled about in 512 byte or 4 KB chunks. You'd need either intimate knowledge of the drive's internal algorithms and state, or an incredible amount of luck, skill, and patience to find them all and piece them back together, if you can even reach all of the blocks as some of them might have been shuffled off into unaccessible reserve space. I believe there are some drives that will only return blank data on attempts to read TRIMed space before it's been written to again, as that is a sensible security feature, but if you're getting gibberish back instead of zeros it's almost certainly the previous explanation. XK fucked around with this message at 15:16 on Nov 11, 2014 |
#
¿
Nov 11, 2014 15:08
|
|
|
|
| # ¿ Apr 25, 2024 12:02 |
|