What Is The SSD TRIM Command?

Understanding TRIM and Its Impact on Data Storage and Recovery

Solid-state drives (SSDs) and mobile devices rely on chip-based non-volatile flash memory (Flash Drives) that retains data even when powered off. Unlike traditional magnetic hard drives, these storage devices use a technology called TRIM to maintain performance and extend their operational lifespan.

TL;DR: The TRIM function, when combined with the SSD's built-in garbage collection, introduced new challenges for data recovery and digital forensics. Unlike magnetic drives, which retain deleted data until overwritten, Flash Drives actively manage and clean up deleted data. Advanced data recovery techniques, such as factory access mode, offer a novel approach to accessing data previously accessible only through labour-intensive methods, such as chip-off analysis.

Why Was TRIM Introduced?

Flash drives handle data deletion very differently from traditional hard drives. On a magnetic spinning drive, deleted data typically remains in place until it is overwritten. On Flash drives, however, overwriting existing data is more complex due to how flash memory works internally, often resulting in a phenomenon known as write amplification, which reduces performance and shortens drive lifespan.

To address this, TRIM was introduced. The TRIM command informs a Flash drive which blocks of data are no longer in use and can be erased internally. This allows the drive to prepare empty blocks in advance, improving write efficiency and preventing performance degradation over time.

Flash drives also contain additional storage capacity that is not user-addressable. This space is used for wear levelling, performance optimisation, and longevity. Data that is deleted and marked by TRIM may be moved into this non-addressable space, making traditional recovery methods ineffective.

How TRIM Works

When a file is deleted, the operating system sends a TRIM command to the Flash drive, identifying the data blocks that are no longer required. Once TRIM is executed and combined with the drive’s garbage collection process, these blocks can be reused without needing a prior erase cycle. This enhances both performance and drive longevity.

Different SSD manufacturers implement TRIM in slightly different ways, which can affect how aggressively data is removed and how recovery is impacted.

Data Storage and Deletion on Flash Drives

Unlike magnetic hard drives, which store data sequentially, Flash drives distribute data across multiple NAND chips simultaneously. This parallel storage method makes SSDs significantly faster. However, when data is deleted, it is often immediately marked for trimming. The garbage collection process then clears these blocks in the background.

As a result, deleted data may be permanently erased shortly after deletion, rather than remaining recoverable until overwritten. This presents serious challenges for data recovery and digital forensic investigations.

TRIM Implementation and Support

The effectiveness of TRIM depends on both the operating system and the physical storage device. Modern operating systems such as Windows, macOS, and Linux support TRIM. Some RAID configurations also support TRIM, although compatibility varies depending on the controller and RAID type.

Data Recovery and Forensic Challenges

Historically, extracting deleted data from SSDs often required chip-off analysis, a labour-intensive and time-consuming method. However, modern SSDs introduce additional complexities, including:

TRIM-enabled block erasure
Built-in hardware encryption
Integrated controller and memory chips
Distributed data storage across NAND cells

These factors significantly reduce the likelihood of recovering deleted data using conventional data recovery tools and techniques.

Advanced Data Recovery Possibilities

Despite these challenges, some solid-state devices support a feature known as Factory Access Mode (or factory mode). This provides an alternative method for accessing data that is not accessible through normal drive operations.

By preventing the Flash Drive from booting normally and using specialised tools (such as ACELab PC-3000), data recovery technicians can sometimes access the drive in a raw state. This can suppress background processes such as garbage collection, preserving potential evidence and, in some instances, allowing access to data that would otherwise be erased by TRIM.

Disadvantages of TRIM from a Recovery Perspective

When TRIM is enabled, the drive actively erases deleted data, significantly reducing the chance of successful recovery. If TRIM is disabled, deleted blocks are not immediately wiped, increasing the likelihood that deleted files can still be recovered - provided they have not yet been overwritten.

How to Check If TRIM Is Enabled or Disabled on Windows:

- Press the Windows key + X and select "Windows PowerShell (Admin)" or "Command Prompt (Admin)."
- Type "fsutil behavior query disabledeletenotify" and press Enter.
- If the result is "0," TRIM is enabled. If the result is "1," TRIM is disabled.

How to Disable or Enable TRIM on Windows

- To disable TRIM, type "fsutil behavior set disabledeletenotify 1" and press Enter.|
- To enable TRIM, type "fsutil behavior set disabledeletenotify 0" and press Enter.