PC-3000 SSD. Beyond TRIM: Recovery of deleted data on Apacer m.2 SATA SSD | Part 2

Hello guys!

This is part 2 of the cycle on TRIMed SSD drives. 

In this article, we will examine how TRIM works on SSDs during partial data deletion. We will walk through the data recovery process using an M.2 SATA drive as an example.

The procedure will be the same for the PCIe NVMe SSDs.

The difference between quick formatting and deleting a certain number of files lies in how many logical blocks are marked as unused, and in how the file system reports this to the SSD.

1. Specific features of the TRIM command when deleting data

When you delete a single file:

1. The file system marks its blocks as free
2. The OS (e.g., Windows or Linux) sends a TRIM command to the SSD
3. The TRIM command includes a list of LBA ranges where the file was located
4. The SSD controller marks the corresponding NAND pages as invalid

Features:

• TRIM applies only to the blocks where the file was located
• The rest of the data on the drive remains unaffected
• Later, garbage collection also clears specific blocks

In other words, deletion = targeted TRIM on specific areas.

2. Specific features of the TRIM command when formatting (Quick format)

During a quick format:

1. The file system is recreated
2. The file allocation tables are cleared
3. The OS sends a TRIM command to the entire partition

For SSDs, this means:

• almost all the partition’s LBAs are marked as invalid
• the drive appears completely empty to the controller

As a result, we see two main differences in how TRIM works:

• Deleting files → TRIM only for the blocks of those files
• Quick format → TRIM for practically the entire partition

Let’s take a look at an Apacer AP120GAST280 SATA M.2 drive based on SM2259XT controller

The solution is demonstrated in PC-3000 version 7.7.21

A user has partially deleted some files from this SSD. The main goal is to recover the lost data.

Let’s connect the drive and follow to Data Extractor. We see the latest version of the file system, where the deleted data is hidden.

First, we need to determine what data has been deleted. To do this, we’ll perform an MFT scan on the NTFS partition and enable the “Show deleted” option.

 

 

 

 

 

 

 

 

 

 

 

 

Now we can see which files and folders have been deleted. At this stage, you can observe empty sectors and the unavailability of the necessary files. The file system still stores information about the location of the files, but the contents of the sectors for these files are filled with zeros.

The procedure for recovering access to lost data starts with steps similar to those for recovering data from any other supported SSD that has internal firmware damage.

To access the data, we need to do the following:

1. Open the list of utilities and select any utility that supports the SM2259XT controller.
   
2. Load the appropriate loader. In most cases, the utility already suggests a loader that is compatible with the current chip modification.
   
3. In this task, the internal firmware differs from existing loaders. In that case, we can manually try applying a loader marked similar to the internal firmware.
   
4. After successfully running the loader and building the translator, create a task in DE based on the active utility.
   
5. In Data Extractor, after scanning the MFT, we encounter a familiar situation: the deleted files are displayed, but the file’s “body” is still filled with zeros.
   
6. The next step will be to create a virtual disk based on the physical location of the sectors on the drive. At this stage, we can already run a RAW recovery and attempt to locate the necessary deleted data.
   
7. But in most cases this isn’t enough – the user needs a file system with file and folder names. So create another virtual drive that includes all versions of the translator.
   
8. Next, go to the Edit menu and run the “Selection versions of metadata” process to automatically select file versions with a non-zero checked size.
   
   
9. Once the process is complete, run an MFT scan and use the “Show deleted” option to display the deleted files
   
   
10. After the versions are entered in automatic mode, the sectors for deleted files are filled with data.
    
11. For convenience, we can also enable the “Headers control” option to check which files are still accessible and which have been partially overwritten with zeros, and their checksums do not match.
    

A red marker may also indicate that the file version was selected incorrectly, and you need to manually check the availability of other versions on the virtual partition.

If you have any questions, please reach out to ACE Lab Technical Support.

Good luck and make all deleted data available again!