1

I am trying to recover deleted files from a SSD using Forensic Explorer. Once the image processing on the SSD had been completed using the write blocker, I opened up AccessData FTK Imager and then I saved the files. Then I opened up Forensic Explorer and I can see where the files that I deleted in recycle bin but cannot retrieve.

Screenshot

Maybe I am coming at this all wrong, I was reading up on SSDs and some say that you can retrieve deleted data and some sites say that you cannot. If anyone has experience with Forensic Explorer or know of an alternative, I would appreciate it.

schroeder
  • 123,438
  • 55
  • 284
  • 319
Ciph3r8
  • 11
  • 3
  • Has TRIM been issued on the device? – forest May 01 '19 at 01:39
  • Thank you very much @forest! I ran the command and saw that it was set as 0. – Ciph3r8 May 02 '19 at 03:06
  • I didn't mean to _run_ a command that executes TRIM. I asked if TRIM had been issued because it wipes all deleted data. If TRIM had been run, then data will not be recoverable. – forest May 02 '19 at 03:28
  • I did not enable trim. I checked and saw it was already enabled. – Ciph3r8 May 02 '19 at 03:58
  • Ah... then yes, the data is most likely gone. – forest May 02 '19 at 03:59
  • 1
    It's a bit ironic though, that whenever we are talking about securely erasing an SSD drive, all kind of tricks are needed and still you can't be quite sure, but when it comes to actually recovering the data, TRIM is enough to make it impossible. Theory vs. practice. :) – Esa Jokinen May 02 '19 at 05:50
  • Thanks. Just those fine details, we did not cover that part yet in class. But not to worry, it is a learning experience. – Ciph3r8 May 03 '19 at 06:07

0 Answers0