An SSD laptop with TRIM enabled had a folder emptied three weeks ago -- what can you still recover?

## Why an SSD changes the answer On a hard disk, deleting a file frees clusters and leaves the bytes in place. On a solid-state drive, the filesystem additionally issues a TRIM command (the ATA name; UNMAP under SCSI/NVMe terminology) telling the drive that a range of logical blocks no longer holds live data. The drive's flash translation layer unmaps those logical blocks from the physical pages behind them, and background garbage collection erases the pages so they can be programmed again. Once unmapped, a read of that logical block returns zeroes on drives that implement deterministic read-after-trim -- which is essentially all modern consumer drives. The practical consequence for an examination is severe: **carving unallocated space is not merely less likely to succeed, it is likely to return nothing at all**, and it can be nothing within seconds of the delete. Time-since-deletion, the variable everyone reaches for on spinning disks, stops being the controlling factor. ## The drive changes itself while you work Two consequences follow that catch people out. First, **a write blocker does not freeze an SSD**. A write blocker prevents the *host* from writing to the source device. It does not stop the drive's own controller, which continues garbage collection whenever the device is powered. So two images of the same drive, taken at different times, can legitimately differ in unallocated space -- and their hashes will differ -- while both are honest images. This is not a chain-of-custody failure; it is a property of the medium, and it should be documented in the notes rather than discovered by a challenger. Second, **image once and work from the copy**. With no second examiner to check the work, contemporaneous notes and a hash of the acquired image are the only record that the analysis was performed on a fixed artefact. ## What survives, and why TRIM applies to blocks the filesystem has released. Filesystem *metadata* structures are not released -- they are live, allocated files that are being rewritten in place. So the artefacts that name a deleted file tend to outlive the file: - **Freed MFT records** that have not yet been reallocated still carry a name, timestamps and a size, even though the cluster runs they point at now read as zeroes. - **Change-journal records** name the file, its parent directory reference and the time of creation, data writes and deletion, subject to the journal's circular rollover. - **The metadata transaction log** can hold recent index entries and attribute values, though its horizon is very short on a busy volume. This is why the achievable outcome is a name, a size and a deletion time with no content behind them -- the exact shape a lot of insider examinations end up in. ## Verify the assumption before you rest on it Do not simply assert that TRIM destroyed the evidence. TRIM does not always reach the drive: some external enclosures and bridge chipsets do not pass it, and certain controller or array configurations historically did not. The volume may also not be the SSD you assume. Check what the storage actually is and whether the pass-through exists, because if TRIM was never issued the ordinary reuse rules apply and carving may still be worthwhile. ## Where to go instead If the question is "what was in the folder", the disk has stopped being the best source. Look for a copy that was never deleted: a file server or shared drive, a backup, version control, an email attachment, a collaboration platform's version history. Look for movement evidence rather than content: removable-media or cloud-sync telemetry showing that files of that name and size left the machine. Each of those is a different source with different limits, and combining them is how the existence claim gets its content. ## Reporting the limitation When the case closes without the content, say so directly, in one sentence, to the people who will act on it. Something to the effect of: the files were named, sized and deleted at a recorded time; their contents could not be recovered from this device because the storage discards freed blocks; and no other copy was located. That is a finished piece of work, not a failure -- provided the limitation is stated rather than glossed over, because the subject of an investigation is entitled to have the boundary of the evidence made explicit, and an examiner who lets "the file existed" drift into "the file contained our design" has produced something worse than nothing.