TRIM
Definition
A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller can pre-erase them during idle time. On mobile devices, TRIM runs automatically and progressively shrinks the window for deleted-data recovery from unallocated blocks.
- Command Type
- ATA/NVMe command
- Primary Effect
- Enables SSD garbage collection of deleted data
- Recovery Timeline
- Deleted files unrecoverable within seconds to minutes
Common questions
What is TRIM and why does it matter in digital forensics?+
TRIM is a command that tells an SSD which data blocks are no longer needed after file deletion. The SSD's garbage collector then erases them physically. This is critical for forensicists because it means deleted files become unrecoverable within seconds to minutes on modern SSDs, making recovery difficult or impossible compared to older hard drives.
How fast does TRIM actually delete data on an SSD?+
On a healthy SSD with TRIM enabled, deleted files are typically unrecoverable within seconds to minutes after deletion. The exact timing depends on when the SSD's garbage collector runs and erases the physical blocks that TRIM marked as free.
Can you recover deleted files from an SSD if TRIM has run?+
Once TRIM has marked blocks as free and the SSD's garbage collector has erased them, file recovery is usually impossible. The original data is physically gone from the drive. This is very different from traditional hard drives where deleted data can sometimes be carved from unallocated space.
Related terms
- BIOS / UEFI
- Firmware on a flash chip on the motherboard that runs at power-on, initialises hardware, and hands control to a bootloader. UEFI is...
- BitLocker
- Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m...
- Chipset (PCH)
- The motherboard logic that bridges CPU, RAM, PCIe lanes, SATA, USB and the firmware (UEFI/BIOS). On Intel boards the Platform Controller Hub;...
- CMOS Battery
- A small lithium cell (typically CR2032) that keeps the real-time clock and a few firmware settings alive when the system is unplugged....
- Deletion vs Erasure
- Deletion marks the file entry as free; content blocks remain until overwritten. Erasure (shred, sdelete, secure-erase) overwrites the blocks before unlinking. The...
- File-Based Encryption (FBE)
- An Android encryption model introduced in Android 7.0 in which each file is encrypted with a separate key derived from the user...
- File Carving
- Recovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem...
- NAND Flash Erase Block
- The minimum unit that can be electrically erased in NAND flash memory. Erase blocks are larger than write pages (often 256 KB...
- NAND Flash Wear Leveling
- The SSD controller's policy of spreading writes across physical blocks so no single block wears out first. The side effect for forensics...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- SQLite Free Page
- A database page that SQLite has placed on an internal free-page list after a row deletion. The page retains its original content...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
Explained in these topics
- Computer Hardware Fundamentals for Forensic ExaminersAn ATA / NVMe command that tells an SSD which logical blocks the file system considers free, so the controller can erase them in the background. TRIM is why a...
- Data Recovery and File Carving: Deleted, Hidden, EncryptedATA/SCSI command that tells an SSD which logical blocks are no longer in use. The SSD's garbage collector can then physically erase them. TRIM is why deleted d...
- Deleted Data Recovery on Mobile DevicesA command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller can pre-erase them during idle time...