The MFT entires however remain unchanged. So, the data outside MFT is zero-filled immediately once TRIM command is issued. Removing one entry would require an entire volume to be reunmbered, which is cost-prohibitve. Because NTFS uses MFT entry numbers internally to address a parent-child relationships. On NTFS, when the file is deleted, its MFT record is marked "free, available for reuse", but never actually relinquished back to the free space. The answer is actually pertty simple - these were NTFS resident files. Interestingly, some traces to specific data remained, and that's one oddity I don't quite understand. Reading the article on NTCompatible as they test data recovery software and fail to recover data from TRIM-enabled SSD (which is pretty much the expected behavior), I see they're a little bit puzzled because some data would still remain even on a TRIM-enabled SSD.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |