Solid State Drives (SSDs) have become increasingly popular in computers and other devices over the past decade. Unlike traditional hard disk drives (HDDs) that use spinning magnetic disks, SSDs use microchips to store data. This gives SSDs some advantages over HDDs, such as faster read/write speeds, better durability, and lower power consumption. However, there are some unique aspects to how SSDs handle file storage and deletion compared to HDDs.
How Files Are Stored on SSDs
When a file is first saved or copied onto an SSD, it goes through these steps:
- The file is broken up into smaller chunks of data called “pages” (usually 4KB in size).
- The pages are written into empty blocks on the SSD memory chips.
- A table called the Flash Translation Layer (FTL) maps the file data to the physical block addresses where the pages are stored.
The FTL enables the SSD controller to read and write data without having to know the exact physical location of every page on the drive. The FTL is one of the main differences between SSD storage and HDD storage. HDDs rely on the operating system to map files to disk sectors rather than using their own mapping systems.
What Happens When a File is Deleted on an SSD
When a file is deleted on an SSD, the drive does not immediately erase the file’s data pages from the memory blocks. Instead, it marks the file’s pages as invalid in the FTL mapping table. This is done by resetting the logical block addresses that reference those data pages. The physical pages containing the actual file data are not wiped at this point.
This method of “deleting” files by resetting file maps, rather than erasing the data right away, helps improve performance on SSDs. It is much faster to reset page addresses in the FTL than it is to fully erase multiple pages spread across many memory blocks.
Why Deleted Files Are Recoverable from SSDs
Because the data pages are not wiped instantly when a file is deleted, an SSD will continue to retain the file’s contents in its memory cells until new data is written to those pages. This makes it possible for data recovery software to scan the drive and rebuild deleted files by examining the still-intact data pages that are no longer mapped by the FTL.
In fact, as long as no new data has been written to the SSD, short of a full drive reformat, the deleted file’s content will remain recoverable by forensic tools. This applies not just to individual file deletions, but even to full drive reformatting and repartitioning. The only way to completely obliterate a file or wipe an SSD drive is to write new data until every memory block has been overwritten at least once.
Garbage Collection and Wear Leveling
Although data pages from deleted files are not erased immediately, the SSD drive will eventually need to wipe these pages cleanly in order to free up storage space for new writes. SSD controllers handle this cleanup process with two internal maintenance routines called garbage collection and wear leveling.
Garbage Collection
The garbage collection process consolidates data by rewriting valid pages from partially filled blocks to completely empty blocks. This frees up the partially filled blocks to be erased and reused. Garbage collection will typically wipe deleted file data pages after they have been consolidated and copied during this process.
Wear Leveling
Wear leveling ensures that writes get evenly distributed across all the memory blocks on the SSD over time. This prevents excessive use and wear on a small number of heavily utilized blocks. During wear leveling operations, pages holding deleted file data may be relocated and overwritten with new data. Wear leveling also erases blocks once they become sufficiently empty from invalid page consolidations.
By combining garbage collection, wear leveling, and new incoming write requests, SSD controllers will eventually overwrite all deleted file pages with new data. But this overwrite process is not instant, and may take days or weeks depending on SSD usage patterns.
Trim Operations Release Unused Blocks Quickly
To speed up the process of wiping deleted pages and making their blocks available for rewrite, SSDs support an optional command called TRIM. The TRIM command allows the operating system to notify the SSD which logical block address ranges are no longer in use due to file deletions or drive formatting.
The SSD will then mark the pages associated with those address ranges as invalid in its FTL mapping table. This enables the controller to erase and reuse those blocks more quickly during its next garbage collection cycle.
Issuing TRIM commands periodically, or whenever a file is deleted, helps maintain high write performance on SSDs over time. Without TRIMs, the accumulating pages tagged as deleted can slow down the rate that new writes can be accepted and cause early fragmentation issues.
Secure Erase Wipes All Data Completely
While simply deleting files or formatting an SSD does not securely erase data, there are methods to completely reset an SSD to a factory-like wiped state. The ATA Secure Erase command provides an internal drive command for obliterating all data by erasing all memory blocks. This will reset the drive to its start-of-life performance level.
Secure Erase commands may not be supported on some consumer SSDs but are implemented on most enterprise SSD drives. The command may also require connecting the SSD directly via SATA or SAS interface rather than through an external USB enclosure.
Physically Destroying an SSD Destroys All Data
If absolute data destruction is required, physically destroying the NAND flash chips will guarantee that no data can ever be recovered from an SSD. Unlike HDD platters which can retain magnetic data remnants after physical destruction, the memory cells in SSD chips completely lose voltage and all data when the chips are destroyed.
Deleted Files May Persist for Weeks Before Overwrite
In summary, deleted files and unused blocks on SSDs are not immediately wiped. The original data may remain intact and recoverable for days or weeks until the blocks are reused. But eventually the SSD will overwrite all deleted data remnants during its internal garbage collection and wear leveling processes. Using the TRIM command and Secure Erase function can accelerate deleted data removal by releasing unused logical blocks for reuse sooner.
| Storage Drive Type | Time Until Deleted File Overwrite |
|---|---|
| Hard Disk Drive (HDD) | Days to Years |
| Solid State Drive (SSD) | Hours to Weeks |
Conclusion
In summary, here is what happens when a file is deleted on an SSD:
- File system marks the file’s data pages as invalid in the mapping table.
- Original data remains intact in the physical memory blocks.
- The freed up logical blocks can be TRIMed to expedite reuse.
- Over time, garbage collection and wear leveling will physically overwrite the invalid pages.
- Secure Erase can forcibly wipe all deleted file remnants quickly.
- Destroying the SSD chips erases all data permanently.
So while deleted files do not vanish instantly from SSDs, solid state drives will render deleted data unrecoverable more rapidly than traditional hard disk drives. Understanding how SSD garbage collection works can help users maintain peak drive performance and manage data security.
