SSD Secure file delition

CCleaner for Windows
1

Dear community,
I have hours spend on google, some other forums and so on. But I don’t find my answers about ccleaner.
I am using ccleaner for many years and I am happy with this program.

I use an SSD with Windows 10 from 2018 with TRIM.
I delete some files and put them in the garbage. After that I run ccleaner with everything is possible to delete.

So here are my questions:
Under Options / Settings I can choose “Secure file deletion (Slower)” and “Normal file deletion (Faster)”.

I use:
• Secure file deletion with 1 Pass
• Wipe Alternate Data Streams
• Wipe Cluster Tips
o Wipe Free Space drives
• Wipe MFT Free Space.
After cleaning the PC automatically shut down by ccleaner.

So, what is the different of Normal and Secure file deletion?
Is it equal to ATA secure erase command?
Can my deleted files with professional tools recovered?
Is the Over-provisioning space even overwriting?
Is Ccleaner activate TRIM-command?

Many questions, but I am thinking, that here are some staff people who can answer my questions :blush:

Kind regards
Patrick

2

There is no need whatsoever to ‘Secure Delete’ files from a SSD, or to drive wipe a SSD.

Doing either will actually shorten the overall life of your SSD by using up the number of ‘writes’ that are possible.
All SSDs have a limit of how may writes can be done, OK it’s millions but if you do an unnecessary ‘secure pass’ to overwrite every deleted file then that’s using up your drive life.

(PS. That’s also why you shouldn’t Defrag SSDs either, doing so is unnecessary and just uses up their write life. SSD’s are meant to be fragmented, the wear levelling does it).

You let the SSD’s built in Trim, Garbage Collection, and Wear Levelling take care of things for you.

They move files around the drive all the time, to spread the write usage all around the drive (wear levelling).
Which means that there is no record of where the deleted files were, and so no way to recover them.

File recovery of deleted files from an SSD is virtually impossible*, it’s just the way that SSD technology works.

Over in the Recuva forum we frequently get posts from people who have accedentally deleted files from an SSD and find that they simply cannot be recovered.
We have to tell them that it’s just the way SSD’s work, you cannot recover deleted files from them.

*Virtually imposible because recovery of deleted files may just be possible for a short time from an external, USB connected, SSD. That’s because TRIM cannot normally be issued over USB and so although Garbage Collection will still happen it doesn’t happen as frequently.

Note that you may be able to recover the non-deleted files from a crashed SSD, if you are very careful after the crash and remove the drive before retarting the machine.
That’s because they will not have been TRIMmed or Garbage Collected so may still be recoverable with care.

Don’t worry about the Overprovisioning space.
That is there mainly for use by garbage collect and wear levelling, files are not stored there (except very breifly when being moved about by wear levelling).

3

Good morning nukecad,

Thank you very much for your quick and detailed answer. Now I am a little more relaxed. I’m sorry that I have to ask again. But what is the exact difference between “Secure file deletion (Slower)” and “Normal file deletion (Faster)”?
As I understand it, once the recycle bin has been emptied, is the data no longer recoverable with forensic tools?

Best regards
Patrick

4

Good morning nukecad,

Thank you very much for your quick and detailed answer. Now I am a little more relaxed. I’m sorry that I have to ask again. But what is the exact difference between “Secure file deletion (Slower)” and “Normal file deletion (Faster)”?
As I understand it, once the recycle bin has been emptied, is the data no longer recoverable with forensic tools?

Best regards
Patrick

5

The difference between ‘Normal’ and ‘Secure’ deletion is nothing at all to do with the Recycle Bin.
The bin is just a chance for you to change your mind about deleting something completely.

When you delete a file with a ‘normal’ delete that marks the file in the Windows Master File Table (MFT) table as being deleted. So the MFT now has that area of the drive showing as being ‘availble’ to write new data to.
With older technology drives (HDDs, USB sticks, SD cards, etc) the data that the deleted file contained is still on the drive, until something else overwrites it. - Which is how recovery software such as Recuva can still get it back.

When you delete a file with a ‘secure’ delete then an extra step is added, making the delete take longer to do, and the area of the drive where the deleted files data was gets overwritten with new data, usually random Xs and Os or 1s and 0s. (The number of ‘passes’ you can often specify is how many times it does an overwrite. One pass is sufficent and has been for a couple of decades now, doing more passes is simply wasting time).
So if recovery sofware looks where the deleted file was on the drive all it can find is that meaningless junk.

With SSDs though the data from a deleted file does not remain on the drive, the space that was taken by that data can’t just be marked as being ‘free’ it has to be wiped before anything else can be written there.
That’s what Trim, and Garbage Collection do (wear levelling) and it means that recovery software has minimal to zero chance of recovering deleted files from a SSD.

There are some important thing that means when using an SSD drive in your computer, which most people are now:

  • You need to make regular backups of your files (and/or your whole system), because if you delete it by mistake. or lose it some other way, then recovery software is not going to be able to get it back from a SSD.
  • You don’t need secure deletion or drive wiping on an SSD, doing that is just wasting time and shortening your drive life.
  • You don’t need to defragment an SSD, doing that is just wasting time and shortening your drive life.
1 Like