How TRIM Affects SSD Data Recovery

No Data, No Fee

Guarantee

2.49M+

Subscribers

4.9

1,837+ Google Reviews

Since 2008

Established

Repairs on Video

Full Transparency

As Featured In

BBC News CBC News ABC Australia Wall Street Journal Business Insider Vice Fast Company 404 Media

What Is TRIM and Why Does It Exist?

TRIM is an ATA command (DATA SET MANAGEMENT for SATA, DEALLOCATE for NVMe) that the operating system sends to the SSD controller when files are deleted. It identifies which logical block addresses no longer contain valid data so the controller can erase the underlying NAND cells during idle time.

TRIM (ATA Data Set Management): The SATA protocol command that tells the SSD controller which LBAs are no longer in use. Supported on all modern SATA SSDs and enabled by default in Windows 7+, macOS 10.10.4+, and Linux kernel 2.6.33+.
UNMAP (SCSI/NVMe Deallocate): The equivalent command for NVMe and SCSI-attached SSDs. Functionally identical to TRIM: it notifies the controller that specific blocks can be erased. NVMe Deallocate is part of the Dataset Management command set.
Garbage Collection (GC): The controller's internal background process that physically erases NAND blocks marked as invalid by TRIM. GC consolidates valid pages into clean blocks and erases the stale ones. This is the step that actually destroys data; TRIM only marks it for destruction.
DisableDeleteNotify: The Windows registry flag that controls whether the OS sends TRIM commands to the drive. Setting DisableDeleteNotify = 1 via fsutil prevents the OS from issuing TRIM, preserving deleted data on the NAND until the blocks are overwritten by new writes.

SSDs need TRIM because of how NAND flash works. Unlike magnetic hard drives, an SSD cannot overwrite a cell in place. It must erase an entire block (typically 256KB to 4MB) before writing new data to any page within that block. Without TRIM, the controller does not know which pages contain deleted data, so it must read-modify-write entire blocks when new data arrives. TRIM lets the controller pre-erase blocks during idle time, which maintains write performance over the life of the drive.

Why TRIM Makes SSD Recovery Different from HDD Recovery

On a hard drive, deleting a file removes the directory entry but leaves the magnetic data on the platters until new data overwrites it. On an SSD with TRIM enabled, deleting a file triggers the controller to electrically erase the underlying NAND cells. The data does not wait to be overwritten; it is actively destroyed.

Behavior	HDD (Magnetic)	SSD with TRIM	SSD without TRIM
File deletion	Directory entry removed; data stays on platters	TRIM sent; blocks marked for erasure	Directory entry removed; data stays on NAND
Physical erasure timing	Only when new data overwrites the same sectors	During next garbage collection cycle (seconds to minutes)	Only when controller needs the block for new writes
Recovery window	Hours to months (until overwritten)	Seconds to minutes (until GC runs)	Hours to months (similar to HDD)
Software recovery viable?	Yes, if sectors not overwritten	Almost never; cells are zeroed	Possible if blocks not reused

This is why data recovery software cannot reliably recover deleted files from SSDs the way it can from hard drives. The physical cells have been zeroed. There is nothing left for the software to read.

When Is TRIM-Deleted Data Still Recoverable?

TRIM and garbage collection are separate operations. TRIM marks blocks as invalid; GC erases them. If anything interrupts that sequence, the data may survive on the NAND.

01
Power loss before garbage collection
If the SSD loses power after TRIM was issued but before GC erased the blocks, the data is physically intact. The controller marked the blocks as stale in its FTL, but the NAND cells still hold the original charge states. PC-3000 can read raw NAND pages and recover data from blocks that the controller considers invalid.
02
Firmware failure freezing the controller
When SSD firmware corrupts, the controller stops processing commands, including garbage collection. A drive stuck in firmware safe mode (SATAFIRM S11, BSY state, or 0 bytes capacity) has not run GC since the failure. TRIMmed blocks that the OS deleted before the firmware crashed may still contain data.
03
USB enclosures blocking TRIM passthrough
Many USB-to-SATA and USB-to-NVMe bridge chips (ASMedia ASM235CM, JMicron JMS578, Realtek RTL9210B) do not pass TRIM commands through to the drive. If the SSD was used in an external enclosure that blocks TRIM, deleted files remain on the NAND indefinitely. The controller never received the invalidation command, and standard recovery tools may work in this scenario.
04
TRIM disabled in the operating system
If DisableDeleteNotify was set to 1 on Windows, or the discard mount option was not enabled on Linux, TRIM was never sent. Deleted data persists on the NAND until the controller overwrites those blocks with new data during normal write operations.

How to Disable TRIM on Windows

Disabling TRIM prevents the OS from telling the SSD to erase deleted blocks. This preserves deleted data on the NAND until the controller reuses those blocks for new writes. Disable TRIM before deleting files if you anticipate needing recovery later.

Open an elevated Command Prompt or Terminal (right-click Start, select "Terminal (Admin)").
Check current TRIM status: fsutil behavior query DisableDeleteNotify
If DisableDeleteNotify = 0, TRIM is enabled. Disable it: fsutil behavior set DisableDeleteNotify 1
For NVMe drives, also run: fsutil behavior set DisableDeleteNotify NTFS 1
Verify: fsutil behavior query DisableDeleteNotify should now show 1.

On macOS, TRIM is enabled by default for Apple-branded SSDs and can be enabled for third-party drives via trimforce enable. There is no supported method to disable TRIM on macOS without disabling SIP. On Linux, TRIM runs only if the file system is mounted with the discard option or if fstrim is scheduled via cron/systemd timer.

How Much Does SSD Data Recovery Cost?

SATA SSD recovery: $200–$1,500. NVMe SSD recovery: $200–$2,500. The price depends on the failure type, not on whether TRIM was involved. Free evaluation, firm quote before any paid work. No data recovered means no charge.

If your SSD failed due to firmware corruption, power loss, or controller failure, the question is whether garbage collection ran before the failure stopped the controller. We determine this during the free evaluation by examining the NAND contents directly with the PC-3000. If the data survived, we image it. If GC already erased the target blocks, we report that honestly. No attempt fees.

Rush service available for an additional +$100 rush fee to move to the front of the queue. Call (512) 212-9111 for a free evaluation.

How TRIM Works at the NAND Level

NAND flash stores data by trapping electrons in floating gate transistors. Each cell holds a charge level that encodes one or more bits (SLC = 1 bit, TLC = 3 bits, QLC = 4 bits). Erasing a cell removes the trapped electrons, resetting the cell to an empty state. This erasure is irreversible at the data level.

NAND flash has an asymmetric write/erase constraint. Writes happen at the page level (typically 4KB to 16KB). Erases happen at the block level (typically 256KB to 4MB, containing 64 to 256 pages). You cannot erase a single page; the entire block must be erased at once. This is why garbage collection exists: the controller must consolidate all valid pages from a partially-stale block into a clean block, then erase the entire stale block.

When the OS deletes a file and sends TRIM, the controller updates its Flash Translation Layer to mark those LBAs as invalid. The physical pages still contain data at this point. During the next garbage collection cycle, the controller reads all valid pages from blocks containing stale data, writes them to a free block, and erases the original block. After the erase completes, those NAND cells read as all-ones (0xFF). The data is gone.

Some SSD controllers implement "deterministic zeroing" per the NVMe specification: after TRIM, reads to those LBAs return all zeros even before GC runs. This means even raw reads at the host interface show zeroed data. The actual NAND cells may still hold the original data until GC, but accessing them requires bypassing the controller entirely with hardware tools.

Why Recovery Software Fails After TRIM

Recovery software reads sectors through the OS storage driver. After TRIM, the controller returns zeros for those sectors, even if the physical NAND has not been erased yet. Software cannot distinguish between a TRIMmed block and a block that was never written to. Both read as zeros.

Tools like Disk Drill, R-Studio, Recoverit, and TestDisk all operate above the SSD controller. They send standard read commands through the SATA or NVMe interface. The controller intercepts these reads and, for TRIMmed LBAs, returns zeros before the software ever touches the NAND. The data may physically exist on the flash, but the controller refuses to expose it through normal host commands.

The PC-3000 bypasses the controller's host interface entirely. It communicates with the controller using vendor-specific diagnostic commands that access raw NAND pages, ignoring the FTL's validity markings. If the physical cells have not been erased by GC, PC-3000 can read the original page data regardless of the controller's TRIM status table.

Frequently Asked Questions

Can you recover data from an SSD after TRIM has run?

Once the SSD controller completes garbage collection on TRIMmed blocks, the NAND cells are electrically erased and zeroed. No lab, no tool, no technique can reconstruct data from a zeroed cell. Recovery depends on whether garbage collection has executed. If the drive lost power or suffered a firmware failure before GC ran, the data may still be physically present on the NAND. SATA SSD recovery starts at From $250. Free evaluation, no data = no charge.

How long does it take for TRIM to erase data?

TRIM itself is instant; it marks blocks as invalid in the controller's mapping table. The actual erasure happens during garbage collection, which runs in the background when the controller has idle time. On some drives, GC begins within seconds of TRIM. On others, it may take minutes or hours depending on workload and firmware scheduling. The gap between TRIM and GC is the only recovery window.

Does disabling TRIM help with data recovery?

If you disable TRIM before deleting files, the controller does not receive the invalidation command. Deleted files remain physically intact on the NAND until the controller overwrites them with new data. This makes SSD recovery similar to HDD recovery: the data persists until the physical blocks are reused. On Windows, run 'fsutil behavior set DisableDeleteNotify 1' in an elevated command prompt to disable TRIM on SATA drives.

Is TRIM the same as Secure Erase?

No. TRIM marks specific logical blocks as no longer needed, and the controller erases them during garbage collection. Secure Erase is a drive-level ATA command that wipes every cell on the entire drive in one operation, including reserved and over-provisioned areas. TRIM is selective and incremental; Secure Erase is total and immediate. Both result in unrecoverable data, but TRIM only affects the blocks the OS reported as deleted.

Does TRIM work on external USB SSDs?

It depends on the USB bridge chip. Many USB-to-SATA and USB-to-NVMe enclosures do not pass TRIM commands through to the drive. If your external SSD is connected via a bridge that blocks TRIM, deleted files remain on the NAND until overwritten by new data. This means external SSDs connected through USB often retain deleted data longer than internal drives where TRIM is active.