SSD is formatted twice and filled twice. Can i recover old deleted data?











up vote
2
down vote

favorite












I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.



First the drive had a Windows 7 installed.



Then it was formatted twice with windows installer. After each format the space was filled with random video files.



Considering that when we delete something from a drive, only the index is deleted, the actual data is removed when new information is overwritten in that section of the drive.



The drive is an SSD.



Is there any possibility to find the old data?










share|improve this question
























  • Too many variables to answer: the only answer is "maybe"
    – schroeder
    7 hours ago










  • Possible duplicate of Is it enough to only wipe a flash drive once?
    – forest
    3 hours ago















up vote
2
down vote

favorite












I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.



First the drive had a Windows 7 installed.



Then it was formatted twice with windows installer. After each format the space was filled with random video files.



Considering that when we delete something from a drive, only the index is deleted, the actual data is removed when new information is overwritten in that section of the drive.



The drive is an SSD.



Is there any possibility to find the old data?










share|improve this question
























  • Too many variables to answer: the only answer is "maybe"
    – schroeder
    7 hours ago










  • Possible duplicate of Is it enough to only wipe a flash drive once?
    – forest
    3 hours ago













up vote
2
down vote

favorite









up vote
2
down vote

favorite











I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.



First the drive had a Windows 7 installed.



Then it was formatted twice with windows installer. After each format the space was filled with random video files.



Considering that when we delete something from a drive, only the index is deleted, the actual data is removed when new information is overwritten in that section of the drive.



The drive is an SSD.



Is there any possibility to find the old data?










share|improve this question















I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.



First the drive had a Windows 7 installed.



Then it was formatted twice with windows installer. After each format the space was filled with random video files.



Considering that when we delete something from a drive, only the index is deleted, the actual data is removed when new information is overwritten in that section of the drive.



The drive is an SSD.



Is there any possibility to find the old data?







data-recovery






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 3 hours ago









forest

29.3k1490104




29.3k1490104










asked 8 hours ago









Vini7

561413




561413












  • Too many variables to answer: the only answer is "maybe"
    – schroeder
    7 hours ago










  • Possible duplicate of Is it enough to only wipe a flash drive once?
    – forest
    3 hours ago


















  • Too many variables to answer: the only answer is "maybe"
    – schroeder
    7 hours ago










  • Possible duplicate of Is it enough to only wipe a flash drive once?
    – forest
    3 hours ago
















Too many variables to answer: the only answer is "maybe"
– schroeder
7 hours ago




Too many variables to answer: the only answer is "maybe"
– schroeder
7 hours ago












Possible duplicate of Is it enough to only wipe a flash drive once?
– forest
3 hours ago




Possible duplicate of Is it enough to only wipe a flash drive once?
– forest
3 hours ago










4 Answers
4






active

oldest

votes

















up vote
4
down vote













Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say



No, you cannot recover any data from that disk.



This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.





If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?".
There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …).
But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.





Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.






share|improve this answer





















  • -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
    – forest
    3 hours ago












  • @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
    – John Deters
    27 mins ago










  • @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
    – forest
    7 mins ago




















up vote
0
down vote













Is Data Remanence a Myth?



This is great coverage of the underlying question -- is data recoverable after a wipe. And while the preponderance of answers agree to be "no", the source documentation does also asert this but acquieses that bits of information are potentially recoverable.



So the answer to your question is "no", you cannot recover whole video files after a byte-by-byte overwrite. However, if the drive is known to contain text based data of significant interest where fragments may be enough to piece together a provactive picture, the answer becomes less definite. But, in those cases, you'd be talking in the realm of corporate espionage by the biggest companies in the world and/or nation-states.






share|improve this answer




























    up vote
    0
    down vote













    You said the hard drive is SSD. This is enough information to answer with a resounding no - even with a single pass write. Let me explain why ...



    With an SSD when you delete a file the operating system sends a TRIM command to the SSD and the SSD will delete said file completely. This happens immediately. Why? Because it's faster for the SSD/OS to work this way.



    You can read more about it here. Provided the OS issues the TRIM command and the SSD acts upon it then a 1 pass write is enough.



    Any more than that and you're just going to burn your SSD out quicker.






    share|improve this answer




























      up vote
      -1
      down vote













      It depends on what you mean when you say “filled with random video files”.



      If the drive was completely filled to capacity with new data, it is highly unlikely to be retrievable.



      If the drive was filled to 50% of capacity with new data, the chances are better, but not great.






      share|improve this answer





















      • Filled completely ☹
        – Vini7
        7 hours ago






      • 1




        Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
        – BlueWizard
        7 hours ago











      Your Answer








      StackExchange.ready(function() {
      var channelOptions = {
      tags: "".split(" "),
      id: "162"
      };
      initTagRenderer("".split(" "), "".split(" "), channelOptions);

      StackExchange.using("externalEditor", function() {
      // Have to fire editor after snippets, if snippets enabled
      if (StackExchange.settings.snippets.snippetsEnabled) {
      StackExchange.using("snippets", function() {
      createEditor();
      });
      }
      else {
      createEditor();
      }
      });

      function createEditor() {
      StackExchange.prepareEditor({
      heartbeatType: 'answer',
      convertImagesToLinks: false,
      noModals: true,
      showLowRepImageUploadWarning: true,
      reputationToPostImages: null,
      bindNavPrevention: true,
      postfix: "",
      imageUploader: {
      brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
      contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
      allowUrls: true
      },
      noCode: true, onDemand: true,
      discardSelector: ".discard-answer"
      ,immediatelyShowMarkdownHelp:true
      });


      }
      });














      draft saved

      draft discarded


















      StackExchange.ready(
      function () {
      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f199637%2fssd-is-formatted-twice-and-filled-twice-can-i-recover-old-deleted-data%23new-answer', 'question_page');
      }
      );

      Post as a guest















      Required, but never shown

























      4 Answers
      4






      active

      oldest

      votes








      4 Answers
      4






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes








      up vote
      4
      down vote













      Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say



      No, you cannot recover any data from that disk.



      This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.





      If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?".
      There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …).
      But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.





      Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.






      share|improve this answer





















      • -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
        – forest
        3 hours ago












      • @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
        – John Deters
        27 mins ago










      • @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
        – forest
        7 mins ago

















      up vote
      4
      down vote













      Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say



      No, you cannot recover any data from that disk.



      This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.





      If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?".
      There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …).
      But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.





      Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.






      share|improve this answer





















      • -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
        – forest
        3 hours ago












      • @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
        – John Deters
        27 mins ago










      • @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
        – forest
        7 mins ago















      up vote
      4
      down vote










      up vote
      4
      down vote









      Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say



      No, you cannot recover any data from that disk.



      This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.





      If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?".
      There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …).
      But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.





      Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.






      share|improve this answer












      Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say



      No, you cannot recover any data from that disk.



      This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.





      If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?".
      There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …).
      But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.





      Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.







      share|improve this answer












      share|improve this answer



      share|improve this answer










      answered 7 hours ago









      BlueWizard

      22918




      22918












      • -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
        – forest
        3 hours ago












      • @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
        – John Deters
        27 mins ago










      • @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
        – forest
        7 mins ago




















      • -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
        – forest
        3 hours ago












      • @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
        – John Deters
        27 mins ago










      • @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
        – forest
        7 mins ago


















      -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
      – forest
      3 hours ago






      -1 This is wrong. Overprovisioning space makes it such that even full overwrites of an SSD will not actually wipe everything, as previous data will survive in regions that are not accessible to the OS.
      – forest
      3 hours ago














      @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
      – John Deters
      27 mins ago




      @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block.
      – John Deters
      27 mins ago












      @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
      – forest
      7 mins ago






      @JohnDeters You're thinking of wear leveling. Overprovisioning space actually holds a significant fraction of all storage, not just a single block. I recall one seminal paper showed a non-negligible chance of recovery of multiple blocks even after more than 10 complete wipes of the block device.
      – forest
      7 mins ago














      up vote
      0
      down vote













      Is Data Remanence a Myth?



      This is great coverage of the underlying question -- is data recoverable after a wipe. And while the preponderance of answers agree to be "no", the source documentation does also asert this but acquieses that bits of information are potentially recoverable.



      So the answer to your question is "no", you cannot recover whole video files after a byte-by-byte overwrite. However, if the drive is known to contain text based data of significant interest where fragments may be enough to piece together a provactive picture, the answer becomes less definite. But, in those cases, you'd be talking in the realm of corporate espionage by the biggest companies in the world and/or nation-states.






      share|improve this answer

























        up vote
        0
        down vote













        Is Data Remanence a Myth?



        This is great coverage of the underlying question -- is data recoverable after a wipe. And while the preponderance of answers agree to be "no", the source documentation does also asert this but acquieses that bits of information are potentially recoverable.



        So the answer to your question is "no", you cannot recover whole video files after a byte-by-byte overwrite. However, if the drive is known to contain text based data of significant interest where fragments may be enough to piece together a provactive picture, the answer becomes less definite. But, in those cases, you'd be talking in the realm of corporate espionage by the biggest companies in the world and/or nation-states.






        share|improve this answer























          up vote
          0
          down vote










          up vote
          0
          down vote









          Is Data Remanence a Myth?



          This is great coverage of the underlying question -- is data recoverable after a wipe. And while the preponderance of answers agree to be "no", the source documentation does also asert this but acquieses that bits of information are potentially recoverable.



          So the answer to your question is "no", you cannot recover whole video files after a byte-by-byte overwrite. However, if the drive is known to contain text based data of significant interest where fragments may be enough to piece together a provactive picture, the answer becomes less definite. But, in those cases, you'd be talking in the realm of corporate espionage by the biggest companies in the world and/or nation-states.






          share|improve this answer












          Is Data Remanence a Myth?



          This is great coverage of the underlying question -- is data recoverable after a wipe. And while the preponderance of answers agree to be "no", the source documentation does also asert this but acquieses that bits of information are potentially recoverable.



          So the answer to your question is "no", you cannot recover whole video files after a byte-by-byte overwrite. However, if the drive is known to contain text based data of significant interest where fragments may be enough to piece together a provactive picture, the answer becomes less definite. But, in those cases, you'd be talking in the realm of corporate espionage by the biggest companies in the world and/or nation-states.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered 6 hours ago









          thepip3r

          36718




          36718






















              up vote
              0
              down vote













              You said the hard drive is SSD. This is enough information to answer with a resounding no - even with a single pass write. Let me explain why ...



              With an SSD when you delete a file the operating system sends a TRIM command to the SSD and the SSD will delete said file completely. This happens immediately. Why? Because it's faster for the SSD/OS to work this way.



              You can read more about it here. Provided the OS issues the TRIM command and the SSD acts upon it then a 1 pass write is enough.



              Any more than that and you're just going to burn your SSD out quicker.






              share|improve this answer

























                up vote
                0
                down vote













                You said the hard drive is SSD. This is enough information to answer with a resounding no - even with a single pass write. Let me explain why ...



                With an SSD when you delete a file the operating system sends a TRIM command to the SSD and the SSD will delete said file completely. This happens immediately. Why? Because it's faster for the SSD/OS to work this way.



                You can read more about it here. Provided the OS issues the TRIM command and the SSD acts upon it then a 1 pass write is enough.



                Any more than that and you're just going to burn your SSD out quicker.






                share|improve this answer























                  up vote
                  0
                  down vote










                  up vote
                  0
                  down vote









                  You said the hard drive is SSD. This is enough information to answer with a resounding no - even with a single pass write. Let me explain why ...



                  With an SSD when you delete a file the operating system sends a TRIM command to the SSD and the SSD will delete said file completely. This happens immediately. Why? Because it's faster for the SSD/OS to work this way.



                  You can read more about it here. Provided the OS issues the TRIM command and the SSD acts upon it then a 1 pass write is enough.



                  Any more than that and you're just going to burn your SSD out quicker.






                  share|improve this answer












                  You said the hard drive is SSD. This is enough information to answer with a resounding no - even with a single pass write. Let me explain why ...



                  With an SSD when you delete a file the operating system sends a TRIM command to the SSD and the SSD will delete said file completely. This happens immediately. Why? Because it's faster for the SSD/OS to work this way.



                  You can read more about it here. Provided the OS issues the TRIM command and the SSD acts upon it then a 1 pass write is enough.



                  Any more than that and you're just going to burn your SSD out quicker.







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered 4 hours ago









                  BugHunterUK

                  1858




                  1858






















                      up vote
                      -1
                      down vote













                      It depends on what you mean when you say “filled with random video files”.



                      If the drive was completely filled to capacity with new data, it is highly unlikely to be retrievable.



                      If the drive was filled to 50% of capacity with new data, the chances are better, but not great.






                      share|improve this answer





















                      • Filled completely ☹
                        – Vini7
                        7 hours ago






                      • 1




                        Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
                        – BlueWizard
                        7 hours ago















                      up vote
                      -1
                      down vote













                      It depends on what you mean when you say “filled with random video files”.



                      If the drive was completely filled to capacity with new data, it is highly unlikely to be retrievable.



                      If the drive was filled to 50% of capacity with new data, the chances are better, but not great.






                      share|improve this answer





















                      • Filled completely ☹
                        – Vini7
                        7 hours ago






                      • 1




                        Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
                        – BlueWizard
                        7 hours ago













                      up vote
                      -1
                      down vote










                      up vote
                      -1
                      down vote









                      It depends on what you mean when you say “filled with random video files”.



                      If the drive was completely filled to capacity with new data, it is highly unlikely to be retrievable.



                      If the drive was filled to 50% of capacity with new data, the chances are better, but not great.






                      share|improve this answer












                      It depends on what you mean when you say “filled with random video files”.



                      If the drive was completely filled to capacity with new data, it is highly unlikely to be retrievable.



                      If the drive was filled to 50% of capacity with new data, the chances are better, but not great.







                      share|improve this answer












                      share|improve this answer



                      share|improve this answer










                      answered 7 hours ago









                      Don Simon

                      13617




                      13617












                      • Filled completely ☹
                        – Vini7
                        7 hours ago






                      • 1




                        Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
                        – BlueWizard
                        7 hours ago


















                      • Filled completely ☹
                        – Vini7
                        7 hours ago






                      • 1




                        Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
                        – BlueWizard
                        7 hours ago
















                      Filled completely ☹
                      – Vini7
                      7 hours ago




                      Filled completely ☹
                      – Vini7
                      7 hours ago




                      1




                      1




                      Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
                      – BlueWizard
                      7 hours ago




                      Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so.
                      – BlueWizard
                      7 hours ago


















                      draft saved

                      draft discarded




















































                      Thanks for contributing an answer to Information Security Stack Exchange!


                      • Please be sure to answer the question. Provide details and share your research!

                      But avoid



                      • Asking for help, clarification, or responding to other answers.

                      • Making statements based on opinion; back them up with references or personal experience.


                      To learn more, see our tips on writing great answers.





                      Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                      Please pay close attention to the following guidance:


                      • Please be sure to answer the question. Provide details and share your research!

                      But avoid



                      • Asking for help, clarification, or responding to other answers.

                      • Making statements based on opinion; back them up with references or personal experience.


                      To learn more, see our tips on writing great answers.




                      draft saved


                      draft discarded














                      StackExchange.ready(
                      function () {
                      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f199637%2fssd-is-formatted-twice-and-filled-twice-can-i-recover-old-deleted-data%23new-answer', 'question_page');
                      }
                      );

                      Post as a guest















                      Required, but never shown





















































                      Required, but never shown














                      Required, but never shown












                      Required, but never shown







                      Required, but never shown

































                      Required, but never shown














                      Required, but never shown












                      Required, but never shown







                      Required, but never shown







                      Popular posts from this blog

                      What visual should I use to simply compare current year value vs last year in Power BI desktop

                      Alexandru Averescu

                      Trompette piccolo