SATA M.2 on Forensics: Trim Function Effect on Recovering Permanently Deleted Files

Abstract

The spread of different types of SSD memory in a wide range of devices increases the challenge of cybercrime and forensic investigation. This is due to the features of the memory structure and how the data is recovered under such features. This research paper consists of an experiment to recover permanently deleted files in SATAM.2 SSD memory when- the Trim function is disabled and permitted with various forensic tools such as OSForensics, Autopsy, FTK and AXIOM. The experiment is applied to the NTFS file system under the Windows 11 environment. The research finds that 0% of files are recovered when the Trim function is enabled and 100% of files can be recovered if Trim function is disabled. This makes the recovery process difficult for investigators to find valid evidence. In future work, there is a need for a method that allows investigators to recover files in such conditions, and to apply more experiments to various features under different file system types and operating systems.