On a traditional hard drive, a deleted file often remains readable for a long time: only its entry in the file system index disappears, and the data stays in place until something overwrites it. On a modern SSD, that assumption no longer holds. Two internal mechanisms, the TRIM command and garbage collection, clean up memory cells in the background, and that cleanup is exactly why so many accidental deletions on SSDs turn out to be permanent. This guide explains what actually happens inside the drive, when a chance remains, and what to do (and avoid) as soon as you notice a loss.
What the TRIM command actually does
Flash memory behaves differently from a magnetic platter. It writes in small units called pages, but it can only erase whole blocks, each made up of many pages. A page cannot simply be overwritten: the block that contains it must be erased first. This constraint is the origin of write amplification, meaning the amount of data physically written to the flash exceeds the amount the operating system asked to write.
By default, the SSD has no idea which files have been deleted. When an operating system deletes a file, it only marks those sectors as free in its own index. From the drive’s point of view, the matching pages still hold data it believes is valid and must preserve, even if that means pointlessly copying it around during its internal housekeeping.
TRIM closes that information gap. After a deletion, the operating system sends the drive a list of address ranges that are no longer needed. The controller now knows it no longer has to keep those pages. It can skip them when moving data around and erase them at its own pace. The benefit is twofold: fewer unnecessary writes, hence less wear, and performance that holds up over time. One technical point is worth remembering: TRIM is a hint given to the drive, not an order to erase immediately. The exact moment the cells are emptied remains up to the controller.
The feature is now everywhere. Windows has supported it on SATA drives since Windows 7 (2009) and on NVMe SSDs since Windows 8.1, Linux since kernel 2.6.33 for ATA drives, and macOS enables it by default on Apple-supplied SSDs. On Windows, NTFS and ReFS support it, while the older FAT, FAT32 and exFAT formats do not. On NVMe, the equivalent is called Deallocate (part of the Dataset Management command).
Garbage collection: erasure on a delay
TRIM does not work alone. The SSD controller constantly runs a housekeeping algorithm called garbage collection. Its job is to gather valid pages scattered across partly used blocks, copy them elsewhere, then erase the freed blocks so they are ready for new writes. This work is typically done during idle periods, when the drive is powered and not under heavy load.
Without TRIM, garbage collection still runs, but it treats every page the operating system has not rewritten as valid. With TRIM, it has far more pages to erase and the cleanup becomes more efficient. The combination of the two keeps an SSD fast over the long term, and it is also what destroys the traces of a deleted file.
Why a deleted file is often unrecoverable
Several effects add up after a deletion on an SSD with TRIM enabled:
- The operating system sends TRIM within a short time, sometimes almost immediately after the deletion and sometimes during a periodic optimization pass.
- Once the pages are declared invalid, the controller has no reason to keep them. It can erase them at any moment, and will do so as soon as the drive is powered and idle.
- Even before the physical erase, the drive is free to stop returning the original content. The ATA specification defines “deterministic” drives whose reads of a trimmed range always return the same value (DRAT) or only zeros (RZAT). In that case the content is already unreachable through a normal read.
In practice, recovery software follows whatever the drive presents to it. It scans addressable sectors, finds old entries in the file system structures, then reads the locations they point to. If the range has been trimmed, the result is zeros or data unrelated to the file. That explains the typical outcomes seen on SSDs: files that cannot be found, or files listed by name that open empty or corrupted. Our article on data recovery software for SSDs goes through these limits in more detail.
The conclusion needs nuance. After a deletion or a format on a recent SSD, recovery is, in the vast majority of cases, severely compromised or impossible, and every extra minute under power gives garbage collection time to finish its work. But “often” does not mean “always”: it all depends on the drive, the file system and timing.
Situations where TRIM plays little or no role
TRIM applies to deletions made while the system is running normally. It has no effect on other types of incidents, and some configurations neutralize it. The table below summarizes the main scenarios as a general guide.
| Situation | Role of TRIM | Recovery outlook |
|---|---|---|
| File deleted or recycle bin emptied on a recent internal SSD | Sent quickly by the operating system | Poor, often nil |
| Quick format or operating system reinstall | Large ranges flagged as free | Very poor |
| SSD no longer detected (controller, firmware or power failure) | No command issued since the failure, as the drive no longer responds | Data sometimes preserved in the chips, laboratory work required |
| FAT, FAT32 or exFAT volume under Windows | Not supported by Windows on these formats | Better odds, to be confirmed case by case |
| External USB enclosure, hardware RAID, some NAS units | Depends on whether each layer passes the command through | Variable, to be assessed after analysis |
RAID deserves a clarification. For TRIM to work on a RAID volume, every layer, from the hardware or software controller up to the file system, must be able to pass the command down to the drives. Depending on the controller, the RAID level and the system, that is sometimes the case and sometimes not. The only way to be certain is to examine the actual configuration. For an affected array, our page on RAID server data recovery describes our approach.
Another common scenario is the SSD that fails with no prior deletion at all. Here the problem lies in the electronics or the firmware, not in an erase. The data is still in the memory chips, and an equipped laboratory can access it, which is beyond the reach of consumer tools. Our SSD data recovery service covers these situations.
What to do as soon as you notice a loss
The top priority is to limit what the SSD can still change on its own.
- Stop all writes: copy nothing, install nothing, close any application that saves files.
- Shut the computer down properly, then disconnect the SSD or the machine rather than leaving it running. Garbage collection works while the drive is powered; with no power, it stops.
- Note the circumstances: what was deleted or formatted, when, on which system, and whether the drive is encrypted (BitLocker, FileVault, LUKS). This information guides the analysis.
- Look elsewhere first: backups, file history, Time Machine, Windows shadow copies, cloud-synced folders, email attachments, other devices.
- If the data matters, hand the drive over as it is to a laboratory that will work on a copy without touching the original media.
What not to do
Some well-meant reflexes wipe out whatever chances remain.
- Keep using the computer “just to see”: every boot writes temporary files and logs, and can trigger new TRIM commands.
- Install recovery software on the affected drive. It writes to the very media it is supposed to analyze.
- Run a disk check, a defragmentation or a drive “optimization”. On Windows, optimizing an SSD precisely means re-sending TRIM over the free areas. On Linux, the fstrim command does the same, and its documentation says a weekly run is usually enough.
- Reinstall the system, factory reset, or run a secure erase hoping to undo the damage.
- Try one tool after another. To understand why formatting an SSD is so delicate, our article on recovering data from a recently formatted SSD lays the groundwork.
- Attempt a chip removal at home or swap components. These operations require specialized equipment and skills that cannot be improvised.
Prevention beats recovery
Since deletion is nearly irreversible on an SSD, data protection starts with an independent backup. The 3-2-1 rule, widely used by backup specialists, calls for three copies of your data on two different types of media, with one copy off site. An automated backup that is checked regularly is worth more than any recovery tool, because it depends neither on the drive’s firmware nor on a deadline.
To learn more about how these drives behave over time, our article on SSD data recovery is a useful complement.
TRIM and garbage collection are real assets for an SSD’s speed and lifespan. The price is that erasure becomes close to final. When facing a loss, good practice comes down to three words: stop, unplug, ask for advice. The sooner the drive is kept powered off after the incident, the more room the analysis has.