2

Today I was doing some tests with two SSDs — SanDisk SDSSDHII240G and Samsung SSD 830 Series — my question is how to safely delete SSDs so that no data can be recovered.

The first test was a quick format in Windows. After that I run two recovery programs, Recuva and Testdisk. None of the two tools were able to recover any files. Both SSDs were connected via USB adapter (Samsung SSD and SandDisk SSD).

I was surprised by that as usually with normal HDDs its possible to recover data. Does this mean, that a quick format of SSDs is enough to safely delete them?

enter image description here

enter image description here

enter image description here

enter image description here

The disks:

  • SanDisk SDSSDHII240G
  • Samsung SSD 830 Series

enter image description here

DA.
  • 123

2 Answers2

3

I would have expected that the standard tools for data recovery would work, when the drive was formatted with quick format.

For HDDs this would be mostly true as "quick format" only overwrites a few sectors and leaves the rest unchanged.

For SSDs, however, the format procedure usually sends TRIM (discard) commands for the entire partition, informing the SSD's wear-leveling system that those areas can be freely overwritten whenever new data comes in.

TRIM is mainly informative, but in most SSDs it will actually cause the disk's firmware to immediately unmap those sectors and start returning "zero" data when reading them. Even if the original data is still physically there on the flash memory, it is no longer mapped to the logical sectors anymore; the OS now sees an empty partition.

This means that only specialists who know how to bypass the disk's firmware might have a chance at the data... but I suspect that even then, they won't know which flash memory areas used to correspond to which logical sectors, as the OS told the SSD to throw that metadata away.

However, I wouldn't trust this as a "secure" method. This behavior is something specific to SSDs, and then not all SSDs (it's up to the manufacturer to decide how they implement TRIM), and finally not all format tools. (Formatting (i.e. creating a new filesystem) does not require the OS to issue a discard – it only does so as an optimization.) There might be SATA drivers which don't support TRIM, or USB adapters which pretend to support it but don't pass it through, or SSDs which still continue to return the original data for a short while.

You should use a tool which sends the actual "secure erase" commands that are part of the ATA and NVMe standards – it should be equally as fast if it works by throwing away the encryption key.

grawity
  • 501,077
0

No, a quick format is not enough to prevent data from being recovered. Just because a recovery program cannot recover the data, that doesnt mean the data is not recoverable. Unless properly overwritten, some or even all, of the data is still on the drive. Additionally, with wear leveling and overprovisioning, it is possible even writing over the "whole" disk is will still leave data. You will need to download the proper disk management/wiping tool from the manufacturer to truly wipe all the data on a SSD.

Keltari
  • 75,447