The Effect of TRIM Function on Data Recovery from SSD Solid-State Drives

The Effect of TRIM Function on Data Recovery from SSD Solid-State Drives | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article The Effect of TRIM Function on Data Recovery from SSD Solid-State Drives Aliya Zhetpisbayeva, Ibraheem Shayea, Azamat Baibussinov This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7419937/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract The need for developing computer forensics has emerged due to the growing number of crimes involving advanced digital systems for unauthorized access. In this regard, digital forensics will always be an advanced field as court cases involving computer technology become more widespread. This research paper presents a detailed study of the fundamental method of using SSD drives for computer forensics. Solid-state drives (SSDs) have replaced traditional spinning disk hard drives and have become the standard for storing data in devices. Today, SSD drives are widely used in desktop computers and laptops. SDDs use flash memory therefore they are highly reliable. This study analyzes the allocated and unallocated storage space on SSD with the TRIM function. One of the key problems is the built-in SSD data self-destruction mechanism, which makes it difficult to recover deleted files. In this research paper, we will consider a method that could reduce the impact of all the features described. The result of the study may contribute to the development of more reliable tools in forensic investigations. Computer expertise Flash memory Solid state drive (SSD) Digital Forensics Data recovery Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 1. Introduction The relevance of the study is due to the growing role of solid-state drives use by users, which has an impact on forensic investigations for the purpose of data recovery. Solid- state drives (SSDs) are a type of secondary memory widely used in modern computing devices. The main difference between SSDs and traditional hard disk drives (HDDs) is that by their design: SSDs have no moving mechanical parts. Therefore, SSDs are faster, quieter, and more resistant to physical impacts since they do not have mechani- cal components. However, these architectural features create significant difficulties for digital forensics, particularly when recovering deleted data. The methods for storing, managing, and deleting information differ between HDDs and SSDs. Since previously developed for hard drives, they are often less effective or even completely inapplicable when working with solid-state drives. SSD architecture is based primarily on NAND flash memory. Over the years, the development of NAND flash memory has increased performance and reliability, and reduced manufacturing costs. These improvements have allowed SSDs to increase their capacity, which has accelerated their adoption in various fields of application. For example, from regular computers to high-performance enterprise servers. SSDs use their own data management process, which is different from hard disk drives (HDDs), in which data is stored on magnetic tape and overwritten directly. Before writing new data, an SSD must first erase existing data from the memory cells. Because of the erase-before-write mechanism, write operations can be slower than read operations if free space on the disk is limited. To solve this problem, modern operating systems and SSD controllers use a special command, TRIM. The TRIM command tells the SSD which data blocks are no longer in use and can be erased in advance, thereby increasing the write speed. And this extends the life of the drive.The TRIM utility provides increased performance SSDs and also has a major impact on digital forensics The main problems associated with SSDs in digital forensics are the lack of stan- dards across manufacturers, as different SSD controllers have different firmware, which limits the applicability of universal recovery methods.Another problem with SSD data recovery is that wear leveling algorithms can move data blocks unpredictably, making forensic analysis more difficult. This paper evaluates the impact of the TRIM command on the ability to recover deleted data on solid-state drives. The study includes a comparative analysis under two conditions: with TRIM enabled and with TRIM disabled. By analyzing the dif- ferences in recoverable data in these two scenarios, the study aims to gain a deeper understanding of the impact of SSD technology on modern digital forensics and offer recommendations on potential data preservation and recovery strategies during forensic investigations. 2. Background This section provides a detailed analysis of flash memory in solid-state drives (SSDs), how the TRIM command works, and SSD vulnerabilities. Flash memory stores data in cells that are controlled by the controller, so it requires an erase operation before it can be rewritten. The TRIM utility tells the SSD which blocks are unused, which affects performance but complicates data recovery. SSD vulnerabilities include lack of stan- dardization, different internal processes, and firmware flaws, all of which complicate forensic analysis. 3. Literature Review A. Flash-memory in SSD In Flash memory data is deleted at the block level. The data that is stored in flash memory must be deleted first so that it can be overwritten again into the memory that is commonly used in modern solid-state drives. It has been established that devices that use flash memory erase data and overwrite data at the byte level on the block level. In modern SSD solid-state drives, there are two types of flash memory, which are referred to as NAND and NOR. Table I shows the differences between them in the architecture of NAND and NOR flash memory. On the Table №1 shows the difference between NAND and NOR which are types of flash memory. However, SSD is mainly based on NAND because it has advantages such as lower price and is suitable for storing large data [1]. B. Principle of TRIM The TRIM command performs a process in which flash memory controllers delete data from a block sector that has been marked as deleted, freeing up space for new data records. Figure 1 shows the structure and principle of the TRIM command. This command allows the operating system to notify the SSD drive about what data has become invalid after it has been deleted. During the deletion process, the operating system marks the corresponding sectors as free for writing new data. The operating system also sends the SSD TRIM command, informing you that certain data blocks are no longer valid. Due to this, the SSD drive does not move data from these files during garbage collection. This reduces the number of write operations, reduces wear on the flash memory, and extends the life of the device. The SSD’s response to the TRIM command depends on the controller and the firmware [2]. In general, TRIM is an ATA interface command. When the operating system deletes the file, it can then send a TRIM command to the SSD and mark the corresponding LBAs as ”unused”. This allows the SSD drive to physically clear the memory areas that are associated with deleted files. As already mentioned, unlike a traditional hard drive, it is impos- sible to directly overwrite data on an SSD first you need to clear the occupied area. If TRIM is not used, the file system does not inform the SSD that certain logical blocks have been deleted. When using TRIM, there is no guarantee that the data will be completely deleted, and the file system does not receive a notification when the process is completed. There are three possible SSD behaviors when reading data after TRIM:return of non-deterministic data (including possible remnants of a deleted file);returning a fixed data template;Returning only zero values. It is important to note that the value returned during reading may not correspond to the actual contents of the physical memory. C. SSD vulnerabilities The key components of a solid-state drive are, to a large extent, the controller and data storage memory. Figure 2 shows a detailed representation of the architecture of a solid-state drive and how modern SDDs will have functions such as flash memory, garbage collector, wear leveling, and a controller known as a block manager, which are located separately rather than compactly on a single magnetic disk, as in traditional hard drives. Solid-state drives (SSDs) mark deleted data as invalid. Nevertheless, they do not necessarily have to be erased im- mediately. This is due to the features of NAND flash memory, where deleted files remain in flash cells until the garbage collection or overwriting mechanism is performed. If the data has not been previously encrypted, it is possible that it can be recovered. Using full-disk encryption on an SSD is one of the most effective ways to protect data, as it prevents the possibility of recovering deleted information. However, this complicates the task of computer forensics. Because even if there is deleted data, it becomes almost impossible to decrypt it without a key [3]. Based on the study, vulnerabilities can occur in both hard- ware and software components. Consequently, malicious SSD- related software can occur at the operating system level and in the drive’s firmware. Earlier, it was mentioned that the TRIM command is created by the operating system and processed by the SSD firmware. A rootkit attack aimed at the operating system can block the execution of TRIM commands for SSDs [4]. There are well-documented examples of rootkits that can intercept or modify system commands. The probability of such attacks is high enough, which forces SSD manufacturers to implement protection mechanisms, such as a digital signa- ture, to verify the integrity of the firmware. Malware can be masked or hidden from detection at the operating system level and in the SSD firmware. In the field of computer forensics, data recovery, and solid-state drives are difficult. Because SSDs use mechanisms that are not present in traditional hard drives. Many SSD drives’ firmware implements encryption, TRIM, and the associated garbage collection process. These mechanisms make data recovery more complex. An important aspect is that the execution of TRIM and subsequent garbage collection can lead to the deletion of data without recovery. 4. Methodology This section explains how researchers determine whether is a hard disk drive, a solid- state drive, or a hybrid drive before executing the TRIM command [5]. TRIM’s functionality can be affected by various factors, such as the type of operating sys- tem, disk formats, and the cable connected to the SSD. This section provides detailed information about the various experiments and steps to perform these tests, as well as the results [6]. The TRIM command is one of the important components to always maintain the performance of solid-state drives (SSDs). This function allows the SSD system interface to know which data blocks should no longer be used, optimizing storage management, and reducing unnecessary write operations [7]. However, TRIM support varies depending on the operating system, disk format, and connection type. For optimal SSD performance, it is recommended to use a TRIM-supported operat- ing system and compatible file system.Using non-compatible file systems or interfaces can hinder the benefits of TRIM, potentially reducing the lifespan and efficiency of an SSD over time.In this study, the data collection method was performed using the live forensics method to analyze non-volatile data on an SSD (see Figure 3).In this study, an experiment is being conducted to test TRIM support by various operating systems and analyze the possibility of recovering deleted files when TRIM is turned on and off. The stages of the study include the study and analysis of digital data obtained during the experiment. To test the operation of TRIM, the file deletion command is executed on various operating systems, after which an attempt is made to restore them. The experiment is conducted on a test computer on which TRIM is enabled or disabled, then the results are analyzed on the investigator’s computer [8]. Before starting the analysis, the source data and hash values of the files are recorded to ensure the integrity and authenticity of the results. Comparing the hash values before and after deletion allows you to determine whether the data has been permanently deleted or needs to be restored. Copies of the studied data are also used to preserve the authenticity of the experiment. The figure above shows the stages of examination and analysis employed in this research: 1)Preparation: During the preparation phase, a repository was created for the data that needed to be restored. This study used the Portable FTK Imager tool to create a disk image. The experiment was conducted with the TRIM function on and off on an NVMe SSD to test the effect of TRIM on data recovery capability [9]. 2) Extraction: At this stage, data was extracted from the created disk image. Files that were previously deleted were identified and restored. In addition, the characteristics of the file structure, information about deleted data, file names and their checksums (md5 hash) were recorded.3) Analysis: At the final stage, the extraction results were analyzed, which makes it possible to evaluate the effec- tiveness of file recovery depending on the TRIM state. The study helped determine which tools are most suitable for data recovery with different TRIM settings [10]. Stage 1: 1. Download the new version of Windows 7 Professional SP1 to the NVMe SSD drive. 2. Copy the keyword files to the SSD drive. 3. Delete the files and turn off the computer immediately. 4. Copy the SSD to the hard drive in the duplicator program (optional).Compare the SSD and hard disk hashes 5. Connect the SSD to the write blocker and generate a hash. 6. Use the file recovery utility to search keywords. 7. If successful, wait 1 hour, take the hash and compare, and try the search again. In step 1, we can expect TRIM functions to make files unrecoverable. The figure above shows the output screen. Similarly, in step 2, the TRIM function is disabled so that files can be restored. Stage 2: 1. Download the new Windows 7 Professional Service Pack 1 to the NVMe SSD. 2. Copy the keyword files to the SSD. 3. Disable the TRIM function.Set the disable delete notify mode to 1. 4. Delete the files and turn off the computer immediately. 5. Copy the SSD to the hard disk in the duplicator program (optional).Compare the SSD and hard disk hashes 6. Connect the SSD to write blocker and generate a hash. 7. Use the file recovery utility to search for keywords. 8. If successful, wait 1 hour, take the hash and compare, try the search again. At this stage 2, we can expect that the disabled TRIM state will make the files available for recovery.As shown in the image above, we deleted about 380 files and then turned off the computer to get the hashes. We found an important aspect. This is that all about 370 deleted files were fully recovered by Recuva with TRIM enabled. They were available as thousands of file fragments. Of these, 368 were the original files, 13 files were renamed without changes However, 3 files out of 384 files were keeping the original content but renamed. But when we disabled TRIM by repeating the same process on a Windows computer, we were able to get the same 378 files, of which 381 were the original files, 0 were renamed but unchanged, and three files were renamed with the original contents of the filename. Stage 3: 1. Download the new version of Linux version 2.6.28 on SVP200S3/60G SSD drive. 2. Determine if TRIM is supported using the following command: sudo hdparm -I /dev/sda | grep "TRIM supported" An output should be displayed with the message: “TRIM is supported for data set management (8 block limit)”, otherwise, your SSD drive does not support TRIM. Stage 4: 1. Create a disk image with Ubuntu versions 15.10 and 14.04.3 and follow the steps below: (a) Download the new Ubuntu version and use the SVP200S3/60G SSD drive. (b) Identify each Ubuntu version before proceeding with the following steps. (c) For Ubuntu 14.10 and later versions, use: $ tail -n1 /etc/cron.weekly/fstrim /sbin/fstrim --all || true For Ubuntu 14.0 and earlier versions, fstream is not avail- able, so you must use the command below: /usr/share/doc/hdparm/contrib/wiper.sh.gz 5. Results At this stage on the Figure 10, the analysis of the acquisition results was performed using Portable FTK Imager to examine the impact of the TRIM function on file recovery. The analysis focused on identifying signature values of deleted files under two conditions: with TRIM disabled and TRIM enabled.When TRIM was disabled, as shown in Figure 10 (a), the file signature remained intact, indicating that the deleted file could still be read and recovered. However, when TRIM was enabled, as shown in Figure 11 (b), the file signature was either damaged or modified, making file recovery impossible. These results demonstrate the significant impact of TRIM on digital forensics, as enabling TRIM can permanently erase data, reducing the chances of successful recovery. 6. Conclusion The development of data storage technologies from classic hard drives (HDD) to modern solid-state drives (SSD) has significantly changed the methods of saving, iden- tifying and restoring deleted files. Enabling the TRIM function plays a key role in this process, as it allows the operating system to tell the SSD which data blocks are no longer in use and can be cleaned up immediately. Our research has shown that TRIM support varies depending on the operating system, file system, and connec- tion interfaces. The experiments have demonstrated that enabling TRIM significantly reduces the likelihood of successful recovery of deleted data, since the drive performs an immediate memory release, removing traces of information. At the same time, disabling TRIM leaves data available before it is overwritten, which allows you to partially restore information using specialized software. It was also revealed that the operation of the SSD controller in Garbage Collection mode can additionally affect data deletion, even when the TRIM function is turned off. However, this process does not always guarantee the complete erasure of information. Thus, the TRIM function plays a crucial role in the irre- versible deletion of data from an SSD, and its presence or absence can significantly affect the capabilities of forensic analysis and information recovery. Modern drives, even with- out TRIM, can independently manage memory cleanup, but the speed and efficiency of this process depend on the specific model and algorithms of the controller. Declarations Author Contribution All authors had an impact to the work. Acknowledgement This study was carried out with the financial support of the Committee of Science of the Ministry of Science and Higher Education of the Republic of Kazakhstan under Contract №388/PTF-24-26 dated 01.10.2024 under the scientific project IRN BR24993232 “Development of innovative technologies for conducting digital forensic investigations using intelligent software - hardware complexes”. References Solodov D, Solodov I (2023) Data recovery in a case of fire-damaged Hard Disk Drives and Solid-State Drives, Forensic Science International: Reports, vol. 3, no. 2, article 100199, Jul. https://doi.org/10.1016/j.fsir.2021.100199 Luković V, Jovanović Ž, Ðurašević Pešović S, Pešović U, Ðorđe- vić B (2025) Solid-State Drive Failure Prediction Using Anomaly Detection. Elec- tronics 14(7). https://doi.org/10.3390/electronics14071433 Frimpong T, Mawuli L, Missah Y, Ussiph N, Ahene E (Sep. 2023) Cold Boot Attack on Encrypted Containers for Forensic Investigations. KSII Trans Internet Inf Syst 16(9):3068–3085. https://doi.org/10.3837/tiis.2022.09.013 Chou Y et al (2023) Why and How to Increase SSD Performance Transparency, Proc. ACM. https://doi.org/10.1145/3317550.3321430 Tianyu Ren Y, Du J, Cui Y, Lv Q, Li CJ, Xue (2025) Device-Level Optimization Techniques for Solid-State Drives: A Survey, arXiv:2507.10573 [cs.AR], Jul. 10. https://doi.org/10.48550/arXiv.2507. 10573 Seth S (Jan. 2023) Application of Solid-State Drive to User Experience and User Satisfaction: Literature Review Study. Dinasti Int J Edu- cation Manage Social Sci 4(2):158–167. https://doi.org/10.31933/dijemss.v4i2.1527 Kumar M (2024) Solid state drive forensics analysis—Challenges and recommen- dations, Concurrency and Computation: Practice and Experience, vol. 33, no. 24, Jun. article e6442. https://doi.org/10.1002/cpe.6442 Jalil H et al (2023) SSD Forensic Evidence Generation and Forensic Research on Solid State Drives Using TRIM Analysis, Proc. IEEE ICCWS. https://doi.org/10.1109/ICCWS53234.2021.9702989 Sun Y, Chen H, Wang M (2023) A Survey on SSD Forensic Analysis Techniques. Concurrency Computation: Pract Experience. https://doi.org/10.1002/cpe.6442 Chankyu Koh J, Kang T, Kim SW, Han (2024) IEEE Access 12 154 455–154 466, Jan. https://doi.org/10.1109/ACCESS.2024.3482368 Temporal-Contextual Attention Network for Solid-State Drive Failure Prediction in Data Centers Owens Walker T, Justin III, Blanco A, Rakvic R, Vanleer A, Brown D, Shey J, Sinsley GL, Hau T, Ngo RW, Ives Classifying Proprietary Firmware on a Solid-State Drive Using Idle-State Current-Draw Mea- surements, IEEE Access, 8, pp. 31869–31881, Dec. 2019 (published Feb 2023). https://doi.org/10.1109/ACCESS.2020.2973605 Abu Hweidi RF, Jazzar M, Eleyan A, Bejaoui T SATA M.2 on Forensics: Trim Function Effect on Recovering Permanently Deleted Files, in (2023) Inter- national Conference on Smart Applications, Communications and Networking (SmartNets) , Jul. 25, 2023. https://doi.org/10.1109/ACCESS.2020.2973605 Lange T, Naor J, Yadgar G (2025) Optimal SSD Management with Predictions, Proceedings of the ACM on Measurement and Analysis of Computing Systems , vol. 9, no. 2, article 30, May 29. https://doi.org/10.1145/3727122 Microsoft (2023) Support and functionality of the TRIM command in Windows. Microsoft Docs Zhang X, Bhimani J, Pei S, Lee E, Lee S, Seong YJ, Kim EJ, Choi C, Nam EH, Choi J Bryan S. Kim**,Storage Abstractions for SSDs: The Past, Present, and Future,ACM Transactions on Storage, vol. 21, no. 1, article 1:1–1:44, Feb. 17, 2025. https: //doi.org/10.1145/3708992 Prophet SSD Failure Analysis and Prediction Guided by Flash Reliability Characteristics in Data Centers, published May 2025 in IEEE Trans Comput. https://doi.org/10.1109/TC.2025.3566871 Tables Tables 1 to 4 are available in the Supplementary Files section. Additional Declarations No competing interests reported. Supplementary Files Tables.docx Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7419937","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":524185560,"identity":"bcc02398-f716-4d95-94cf-64c13bc1f752","order_by":0,"name":"Aliya Zhetpisbayeva","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABTUlEQVRIie3RQUsCQRQH8BcT4+XJXmeZcL/CSLAYRX6ViQW9KARCCIUJwnqRvG74Kbx0XllYLwteB/IQBHvqoAQiJNHuakUN3oP2fxlmhh/vzRuAPHn+YCgYcboisO1BaXeRbQWArxEDoAYgv8kxAMkI20fM7pbAJ7nobgnsJcKH8Gm5nh9Zo17Mlu55fTicTV4vbyodKPQeGEQdnRz0y56MUcxD27x3naanHMK9MGkMwysGiuqEUI4yQMGkzTEiza4iwJEmhDVsBgv8Tao+pXyTEMurr/gmuq1bs4C84XtCrJeUML0KUg4JAdWwObQDKXyH8qKbVsGEKKGRAKk5qKVviVong/a0PFaOfVq8Y6aLtVZFRlIj02HM1mfzqjXqj9VaXFul2eT5EVcdwygEY7UItYntPiGb/uHPtrNRaTW+khGy2HufJ0+ePP86H1JkaojJanX9AAAAAElFTkSuQmCC","orcid":"","institution":"Astana IT University","correspondingAuthor":true,"prefix":"","firstName":"Aliya","middleName":"","lastName":"Zhetpisbayeva","suffix":""},{"id":524185561,"identity":"0e3e24a2-8bf4-495d-b9ed-f0f24ce683e7","order_by":1,"name":"Ibraheem Shayea","email":"","orcid":"","institution":"Istanbul Technical University","correspondingAuthor":false,"prefix":"","firstName":"Ibraheem","middleName":"","lastName":"Shayea","suffix":""},{"id":524185562,"identity":"1bcdcdd0-2576-4c32-a7bd-9c686e4ab586","order_by":2,"name":"Azamat Baibussinov","email":"","orcid":"","institution":"National Defense University of the Republic of Kazakhstan","correspondingAuthor":false,"prefix":"","firstName":"Azamat","middleName":"","lastName":"Baibussinov","suffix":""}],"badges":[],"createdAt":"2025-08-20 18:08:19","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7419937/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7419937/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":92843353,"identity":"caf91245-e2d4-497c-8908-356d87e55fd4","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":672653,"visible":true,"origin":"","legend":"","description":"","filename":"WS225Springerfixed.docx","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/5b0249346fb8bf3c44634bcd.docx"},{"id":92845237,"identity":"31fcc9ec-c0f1-471a-bd1a-115d13f70b92","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4738,"visible":true,"origin":"","legend":"","description":"","filename":"0ce98f0a45494e3e8ae0aea17f3545a1.json","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/faf6c8639fcf0b044ef74557.json"},{"id":92843349,"identity":"d95b2b06-ed52-43d1-ae02-47b64868a928","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"xml","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":65503,"visible":true,"origin":"","legend":"","description":"","filename":"0ce98f0a45494e3e8ae0aea17f3545a11enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/17c47d79e3d2060c8070f026.xml"},{"id":92843352,"identity":"bde65b28-7927-4d10-bb71-b1d1fa7c210b","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"eps","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":381,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage2.eps","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/2bd8b5b62c48260ba4b47d56.eps"},{"id":92845234,"identity":"e34692dd-43a1-43b1-9d4d-ed51a1bca1f5","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"jpeg","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1074,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/19597f4e67e378d597672834.jpeg"},{"id":92845238,"identity":"b2795e99-0978-4313-a5ad-8aea41254df1","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"jpeg","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4110,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage10.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/a214d42af9fb16362a2a575a.jpeg"},{"id":92846857,"identity":"c113ba1d-7a94-4b7d-88f4-a7a6683a81de","added_by":"auto","created_at":"2025-10-06 09:42:16","extension":"jpeg","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":46200,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage11.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/7bf6fecd0825ffd14acd72c2.jpeg"},{"id":92845732,"identity":"2aa5f71f-bc43-401c-8ed7-adca984fd95e","added_by":"auto","created_at":"2025-10-06 09:34:15","extension":"jpeg","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":34401,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage12.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/c707b78691f499d589c45d4f.jpeg"},{"id":92845250,"identity":"ad41cbc0-48a0-4d82-a4f3-e0bed252091a","added_by":"auto","created_at":"2025-10-06 09:26:16","extension":"jpeg","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":2851,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage13.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/331eae64c67a0d99b7187f96.jpeg"},{"id":92843378,"identity":"c387aacb-5599-4b27-9a03-e779c822883e","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1074,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/f739694c2b822d7221383022.jpeg"},{"id":92843363,"identity":"db5dcc83-d225-4913-a8e8-efda40e84640","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":35662,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage15.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/05a213125a91ba6511fa2f47.jpeg"},{"id":92843373,"identity":"ff32b146-3dcc-4c1f-ab31-b58715065989","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":36040,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage16.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/0b7945eee26b7b36d7d0ebba.jpeg"},{"id":92845734,"identity":"b997a3a6-10c8-4ae7-bbba-9006ab886a3b","added_by":"auto","created_at":"2025-10-06 09:34:16","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":45461,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage17.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/05016c4c63e2fbae6883f296.png"},{"id":92843362,"identity":"32fbca6b-8ad2-487e-bf97-4ee28fdca52f","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":70093,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage18.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/283529c6daf1801c5d7775ba.jpeg"},{"id":92843380,"identity":"82d34714-36ef-4792-93e4-ff367f1d724e","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"jpeg","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":90807,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage19.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/7c7ee0afb0c62dfd4ce5a85d.jpeg"},{"id":92843366,"identity":"3133a793-dc91-4aa1-9395-6de707a8f981","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":26182,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage2.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/d3850e3ff7ea75a1f87be611.jpeg"},{"id":92843382,"identity":"e4438018-6aff-44cb-bd1f-401b4940566b","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"jpeg","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":93353,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage20.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/d4bf8fa74ad47bc9553538ad.jpeg"},{"id":92843367,"identity":"8bc46421-466e-4645-9336-4f9ca0369d8d","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":57159,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage21.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/5cc47eaa24e7eccca2fb2652.jpeg"},{"id":92843368,"identity":"8e0c8e4f-1b08-4618-9841-b3672beafbe7","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":96902,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage22.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/3c9c559041ffbd9479131c28.jpeg"},{"id":92843381,"identity":"5b7c7258-3d52-4535-bbb5-33682ed2eb3f","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"jpeg","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":99604,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage23.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e13c906347a5d1b3df80750b.jpeg"},{"id":92845258,"identity":"7a28d325-3048-49b9-8898-8a23a9f32ea3","added_by":"auto","created_at":"2025-10-06 09:26:17","extension":"jpeg","order_by":21,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1074,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/8571fac187672e4778ff1f32.jpeg"},{"id":92843397,"identity":"911753e9-a4c8-4233-a7f9-9b5ab3b0b9a1","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"jpeg","order_by":22,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":191844,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage4.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e5a141340f53d7f8c37e5219.jpeg"},{"id":92843371,"identity":"9f46f5a6-a11a-4804-a18c-81d158bdc58e","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"png","order_by":23,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":31262,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/fd571a9ff41c1952f94b8be8.png"},{"id":92845242,"identity":"89d77c1c-57cf-46c6-b034-6edba7cabe69","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"jpeg","order_by":24,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":3151,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage6.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/a95ca67604e665d49502d057.jpeg"},{"id":92845740,"identity":"4ec7f456-6610-4ffa-ab80-91cad5114af2","added_by":"auto","created_at":"2025-10-06 09:34:17","extension":"jpeg","order_by":25,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":3349,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage7.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/ceef8c942055b390bab7cc78.jpeg"},{"id":92847280,"identity":"9aade4f7-ea0d-4708-b05d-773bef802eec","added_by":"auto","created_at":"2025-10-06 09:50:16","extension":"jpeg","order_by":26,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4714,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage8.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/a3001bb1b6047293f5b64e9e.jpeg"},{"id":92843372,"identity":"800b86dd-c232-44f4-a010-74fb6bb9da5d","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":27,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":3867,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage9.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/84eba14256ce6be472038c1c.jpeg"},{"id":92843387,"identity":"a37a0f45-d830-41f8-a815-807d5f89a354","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":28,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":935,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/8387fba27142f41ce2df91a5.png"},{"id":92845255,"identity":"4db69ee4-da96-42c5-8a72-a76a51ddbee1","added_by":"auto","created_at":"2025-10-06 09:26:17","extension":"png","order_by":29,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":974,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage10.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/8a91fc554a4d5145005aa945.png"},{"id":92843376,"identity":"f169732d-0e72-4a6a-b1ef-be1c001acb9f","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"png","order_by":30,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":9047,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage11.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e5f4d6d27ffae371843670e7.png"},{"id":92843396,"identity":"47b58eb5-d18c-4a64-b8c6-9061689ac123","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":31,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":7317,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage12.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/3c35b773d98581c12a49fbf1.png"},{"id":92845739,"identity":"3892e26a-190a-423f-9fb5-f6d7763c3b75","added_by":"auto","created_at":"2025-10-06 09:34:17","extension":"png","order_by":32,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":971,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage13.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/292239aef84a37e0a967a114.png"},{"id":92843374,"identity":"9f6bf03f-759e-4b8b-8470-cd0fe033c47b","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"png","order_by":33,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":935,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/2b4cd7d967b5ccab26101e91.png"},{"id":92845257,"identity":"ef606072-7d5f-4d26-b0ec-f812224ee887","added_by":"auto","created_at":"2025-10-06 09:26:17","extension":"png","order_by":34,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":34313,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage15.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e2a1f8a8cd71beebea86addc.png"},{"id":92843401,"identity":"ca74b34c-6fbe-4eb0-b7ee-3a03e4983b2b","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":35,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":12152,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage16.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/f5b29978b059e2bb4b9ab5b4.png"},{"id":92843389,"identity":"e4466396-66f6-4c2d-a702-2c565a2038f8","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":36,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":16582,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage17.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/877a5c02d15620f0998442d0.png"},{"id":92843379,"identity":"010bf320-45b0-401f-9080-75f6f0bf90bb","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":37,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":39424,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage18.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/f566860383b94606b1c3ea14.png"},{"id":92845243,"identity":"20e4ae32-ce69-4afd-aaaa-3592e7689bfa","added_by":"auto","created_at":"2025-10-06 09:26:16","extension":"png","order_by":38,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":59429,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage19.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/50ef859979d4d14fcd2f0df2.png"},{"id":92843404,"identity":"9a721f88-9d72-4a42-8ce3-c64a95768e05","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":39,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5089,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/a14f649fd4f6bdc3fb7fdfbe.png"},{"id":92843385,"identity":"8df00478-db82-4ffc-8085-0cb847bb47e2","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":40,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":37302,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage20.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/14bb3a2406e92e664ee76406.png"},{"id":92846855,"identity":"ba550f9f-faf0-4143-8b20-fc6ee61dcbde","added_by":"auto","created_at":"2025-10-06 09:42:16","extension":"png","order_by":41,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":32464,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage21.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/21ab80d8040c3aca2dd22cda.png"},{"id":92843402,"identity":"37f37be6-31e7-4d7a-ba93-91fa39291f5f","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":42,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":37730,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage22.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e7eebfd3bf85df4de6be6d65.png"},{"id":92843393,"identity":"781f043f-d935-447e-a225-d83cd03ffef5","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":43,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":100005,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage23.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/9c82c6db3f82986d9c252888.png"},{"id":92845260,"identity":"815ca1f4-6be5-4176-9e71-2af925b0f9c8","added_by":"auto","created_at":"2025-10-06 09:26:17","extension":"png","order_by":44,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":935,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/c90088961cee0345e5106946.png"},{"id":92843391,"identity":"0ec8b0a0-737c-4739-846d-4047300b06b1","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":45,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":36452,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/8f5e60000974c3fd515e4539.png"},{"id":92843405,"identity":"8cb02f36-bb2d-4cb3-88c4-0cb7215b3ed2","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"png","order_by":46,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":13787,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e66dced3cd8a37e693e42434.png"},{"id":92845246,"identity":"c9c8e312-2fb9-479c-b19d-188293227078","added_by":"auto","created_at":"2025-10-06 09:26:16","extension":"png","order_by":47,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":988,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/b7f1e905b626245c58271f8b.png"},{"id":92845254,"identity":"b5816f57-05d2-41cc-9378-f02b042fd18a","added_by":"auto","created_at":"2025-10-06 09:26:17","extension":"png","order_by":48,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":964,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/bf912e25633acceaa6326153.png"},{"id":92845737,"identity":"df3f3056-db6d-4b62-9fb8-9a01c8554224","added_by":"auto","created_at":"2025-10-06 09:34:16","extension":"png","order_by":49,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1081,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/bc9935d6ddcac3328aa97fa0.png"},{"id":92843407,"identity":"a97ee2d8-8a25-488e-8993-a8f8444a7906","added_by":"auto","created_at":"2025-10-06 09:18:17","extension":"png","order_by":50,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":997,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/9197a5a46bfc939871979efc.png"},{"id":92845252,"identity":"df44e1d4-6dc0-442b-966f-e181246814e1","added_by":"auto","created_at":"2025-10-06 09:26:17","extension":"xml","order_by":51,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":61733,"visible":true,"origin":"","legend":"","description":"","filename":"0ce98f0a45494e3e8ae0aea17f3545a11structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/d621b2cd9815d9a5542126a2.xml"},{"id":92843403,"identity":"23b20ab0-e0f3-428b-98f3-ae20b508b55a","added_by":"auto","created_at":"2025-10-06 09:18:16","extension":"html","order_by":52,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":76500,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/f6935490366a053be1cb08c1.html"},{"id":92845233,"identity":"13c9b637-fcb4-4619-a8fb-b7ab366c6beb","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":30306,"visible":true,"origin":"","legend":"\u003cp\u003eStructure of principle of TRIM\u003c/p\u003e","description":"","filename":"image1.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/4bc90494ab6d0cad20e72081.png"},{"id":92843347,"identity":"b4f8c7f4-bab1-4a84-bb49-dba28cebcadc","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":31262,"visible":true,"origin":"","legend":"\u003cp\u003eSSD solid-state drive architecture\u003c/p\u003e","description":"","filename":"image2.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/79aa4a4177b0cb81a23a985a.png"},{"id":92845733,"identity":"8f911296-b5d2-4993-98c4-ca617e366638","added_by":"auto","created_at":"2025-10-06 09:34:15","extension":"jpeg","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":35662,"visible":true,"origin":"","legend":"\u003cp\u003eMethod of checking TRIM command\u003c/p\u003e","description":"","filename":"image3.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/178a1aa078967a136d8e950d.jpeg"},{"id":92845235,"identity":"36a86fb7-244d-4fd5-83d0-e822d1624b68","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":15885,"visible":true,"origin":"","legend":"\u003cp\u003eMethod of checking TRIM command\u003c/p\u003e","description":"","filename":"image4.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/ab565a03de78399aa4221020.png"},{"id":92843348,"identity":"829fb708-cee3-4ff8-8e78-dfa62a85186c","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":45461,"visible":true,"origin":"","legend":"\u003cp\u003eSSD Live Forensics method\u003c/p\u003e","description":"","filename":"image5.png","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/90c79ecfe5119211d9303978.png"},{"id":92845239,"identity":"2abec38a-a12b-407b-a3f6-abcda30d5146","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"jpeg","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":70093,"visible":true,"origin":"","legend":"\u003cp\u003eEnabling TRIM on a Windows 7 computer and getting a hash\u003c/p\u003e","description":"","filename":"image6.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/bf4410740006e03c494d02ee.jpeg"},{"id":92843355,"identity":"d21db11d-084d-44d3-81a0-c1f2cda29781","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":7,"title":"Figure 7","display":"","copyAsset":false,"role":"figure","size":90807,"visible":true,"origin":"","legend":"\u003cp\u003eDisabling TRIM on a Windows 7 computer and getting a hash\u003c/p\u003e","description":"","filename":"image7.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/33abec322b6d5a62b31b8a6b.jpeg"},{"id":92843360,"identity":"d329e135-eab7-4df2-96ce-089984b25403","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":8,"title":"Figure 8","display":"","copyAsset":false,"role":"figure","size":93353,"visible":true,"origin":"","legend":"\u003cp\u003eComparison of Recuva files recovered after using TRIM functions in Windows\u003c/p\u003e","description":"","filename":"image8.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/4733c24b8f1c0dd142c71f6c.jpeg"},{"id":92845240,"identity":"06ec464f-e834-4f03-b61c-88af861ff7f9","added_by":"auto","created_at":"2025-10-06 09:26:15","extension":"jpeg","order_by":9,"title":"Figure 9","display":"","copyAsset":false,"role":"figure","size":57159,"visible":true,"origin":"","legend":"\u003cp\u003eTRIM command on Linux (Ubuntu)\u003c/p\u003e","description":"","filename":"image9.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/0547cef45a19b0723b76b1e7.jpeg"},{"id":92843369,"identity":"6876939f-2a30-4957-86cd-77091e0f86d1","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":10,"title":"Figure 10","display":"","copyAsset":false,"role":"figure","size":96902,"visible":true,"origin":"","legend":"\u003cp\u003eAnalysis Stage (a) Odd Label TRIM Disabled, (b) Even Label TRIM Enabled\u003c/p\u003e","description":"","filename":"image10.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/f78c236530b134a7c9df4bf4.jpeg"},{"id":92843364,"identity":"449f136b-fa24-499f-b2b6-81ba442e9b47","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"jpeg","order_by":11,"title":"Figure 11","display":"","copyAsset":false,"role":"figure","size":99604,"visible":true,"origin":"","legend":"\u003cp\u003eList of Analysis and Recovery of Odd Label TRIM Disabled\u003c/p\u003e","description":"","filename":"image11.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/e91605bbba9cdab24c49dc4d.jpeg"},{"id":101392976,"identity":"996b0910-540d-4524-a7c1-d1926ad19e02","added_by":"auto","created_at":"2026-01-29 08:43:25","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1065882,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/340236da-c38a-444c-b043-e3924fb287b8.pdf"},{"id":92843345,"identity":"7769b4d9-ca47-4bb9-913b-1bb919bc07e7","added_by":"auto","created_at":"2025-10-06 09:18:15","extension":"docx","order_by":1,"title":"","display":"","copyAsset":false,"role":"supplement","size":31174,"visible":true,"origin":"","legend":"","description":"","filename":"Tables.docx","url":"https://assets-eu.researchsquare.com/files/rs-7419937/v1/3797c4c0add8a5fc20e0a5a6.docx"}],"financialInterests":"No competing interests reported.","formattedTitle":"The Effect of TRIM Function on Data Recovery from SSD Solid-State Drives","fulltext":[{"header":"1. Introduction","content":"\u003cp\u003e\u003cdiv class=\"BlockQuote\"\u003e\u003cp\u003eThe relevance of the study is due to the growing role of solid-state drives use by users, which has an impact on forensic investigations for the purpose of data recovery. Solid- state drives (SSDs) are a type of secondary memory widely used in modern computing devices. The main difference between SSDs and traditional hard disk drives (HDDs) is that by their design: SSDs have no moving mechanical parts. Therefore, SSDs are faster, quieter, and more resistant to physical impacts since they do not have mechani- cal components. However, these architectural features create significant difficulties for digital forensics, particularly when recovering deleted data. The methods for storing, managing, and deleting information differ between HDDs and SSDs. Since previously developed for hard drives, they are often less effective or even completely inapplicable when working with solid-state drives.\u003c/p\u003e\u003cp\u003eSSD architecture is based primarily on NAND flash memory. Over the years, the development of NAND flash memory has increased performance and reliability, and reduced manufacturing costs. These improvements have allowed SSDs to increase their capacity, which has accelerated their adoption in various fields of application. For example, from regular computers to high-performance enterprise servers.\u003c/p\u003e\u003cp\u003eSSDs use their own data management process, which is different from hard disk drives (HDDs), in which data is stored on magnetic tape and overwritten directly. Before writing new data, an SSD must first erase existing data from the memory cells. Because of the erase-before-write mechanism, write operations can be slower than read operations if free space on the disk is limited. To solve this problem, modern operating systems and SSD controllers use a special command, TRIM. The TRIM command tells the SSD which data blocks are no longer in use and can be erased in advance, thereby increasing the write speed. And this extends the life of the drive.The TRIM utility provides increased performance SSDs and also has a major impact on digital forensics\u003c/p\u003e\u003cp\u003eThe main problems associated with SSDs in digital forensics are the lack of stan- dards across manufacturers, as different SSD controllers have different firmware, which limits the applicability of universal recovery methods.Another problem with SSD data recovery is that wear leveling algorithms can move data blocks unpredictably, making forensic analysis more difficult.\u003c/p\u003e\u003cp\u003eThis paper evaluates the impact of the TRIM command on the ability to recover deleted data on solid-state drives. The study includes a comparative analysis under two conditions: with TRIM enabled and with TRIM disabled. By analyzing the dif- ferences in recoverable data in these two scenarios, the study aims to gain a deeper understanding of the impact of SSD technology on modern digital forensics and offer recommendations on potential data preservation and recovery strategies during forensic investigations.\u003c/p\u003e\u003c/div\u003e\u003c/p\u003e"},{"header":"2. Background","content":"\u003cp\u003eThis section provides a detailed analysis of flash memory in solid-state drives (SSDs), how the TRIM command works, and SSD vulnerabilities. Flash memory stores data in cells that are controlled by the controller, so it requires an erase operation before it can be rewritten. The TRIM utility tells the SSD which blocks are unused, which affects performance but complicates data recovery. SSD vulnerabilities include lack of stan- dardization, different internal processes, and firmware flaws, all of which complicate forensic analysis.\u003c/p\u003e"},{"header":"3. Literature Review","content":"\u003ch2\u003eA. Flash-memory\u0026nbsp;in\u0026nbsp;SSD\u003c/h2\u003e\n\u003cp\u003eIn Flash memory data is deleted at the block level. The data that is stored in flash memory must be deleted first so that it can be overwritten again into the memory that is commonly used in modern solid-state drives. It has been established that devices that use flash memory erase data and overwrite data at the byte level on the block level. In modern SSD solid-state drives, there are two types of flash memory, which are referred to as NAND and NOR. Table I shows the differences between them in the architecture of NAND and NOR flash memory. On the Table №1 shows the difference between NAND and NOR which are types of flash memory. However, SSD is mainly based on NAND because it has advantages such as lower price and is suitable for storing large data [1].\u003c/p\u003e\n\u003ch2\u003eB. Principle of\u0026nbsp;TRIM\u003c/h2\u003e\n\u003cp\u003eThe TRIM command performs a process in which flash memory controllers delete data from a block sector that has been marked as deleted, freeing up space for new data records. Figure 1 shows the structure and principle of the TRIM command. This command allows the operating system to notify the SSD drive about what data has become invalid after it has been deleted. During the deletion process, the operating system marks the corresponding sectors as free for writing new data. The operating system also sends the SSD TRIM command, informing you that certain data blocks are no longer valid. Due to this, the SSD drive does not move data from these files during garbage collection. This reduces the number of write operations, reduces wear on the flash memory, and extends the life of the device. The SSD\u0026rsquo;s response to the TRIM command depends on the controller and the firmware [2]. In general, TRIM is an ATA interface command. When the operating system deletes the file, it can then send a TRIM command to the SSD and mark the corresponding LBAs as \u0026rdquo;unused\u0026rdquo;. This allows the SSD drive to physically clear the memory areas that are associated with deleted files. As already mentioned, unlike a traditional hard drive, it is impos- sible to directly overwrite data on an SSD first you need to clear the occupied area. If TRIM is not used, the file system does not inform the SSD that certain logical blocks have been deleted. When using TRIM, there is no guarantee that the data will be completely deleted, and the file system does not receive a notification when the process is completed. There are three possible SSD behaviors when reading data after TRIM:return of non-deterministic data (including possible remnants of a deleted file);returning a fixed data template;Returning only zero values. It is important to note that the value returned during reading may not correspond to the actual contents of the physical memory.\u003c/p\u003e\n\u003ch2\u003eC. \u0026nbsp;SSD vulnerabilities\u003c/h2\u003e\n\u003cp\u003eThe key components of a solid-state drive are, to a large extent, the controller and data storage memory. Figure 2 shows a detailed representation of the architecture of a solid-state drive and how modern SDDs will have functions such as flash memory, garbage collector, wear leveling, and a controller known as a block manager, which are located separately rather than compactly on a single magnetic disk, as in traditional hard drives. Solid-state drives (SSDs) mark deleted data as invalid. Nevertheless, they do not necessarily have to be erased im- mediately. This is due to the features of NAND flash memory, where deleted files remain in flash cells until the garbage collection or overwriting mechanism is performed. If the data has not been previously encrypted, it is possible that it can be recovered. Using full-disk encryption on an SSD is one of the most effective ways to protect data, as it prevents the possibility of recovering deleted information. However, this complicates the task of computer forensics. Because even if there is deleted data, it becomes almost impossible to decrypt it without a key [3]. Based on the study, vulnerabilities can occur in both hard- ware and software components. Consequently, malicious SSD- related software can occur at the operating system level and in the drive\u0026rsquo;s firmware. Earlier, it was mentioned that the TRIM command is created by the operating system and processed by the SSD firmware. A rootkit attack aimed at the operating system can block the execution of TRIM commands for SSDs [4]. There are well-documented examples of rootkits that can intercept or modify system commands. The probability of such attacks is high enough, which forces SSD manufacturers to implement protection mechanisms, such as a digital signa- ture, to verify the integrity of the firmware. Malware can be masked or hidden from detection at the operating system level and in the SSD firmware. In the field of computer forensics, data recovery, and solid-state drives are difficult. Because SSDs use mechanisms that are not present in traditional hard drives. Many SSD drives\u0026rsquo; firmware implements encryption, TRIM, and the associated garbage collection process. These mechanisms make data recovery more complex. An important aspect is that the execution of TRIM and subsequent garbage collection can lead to the deletion of data without recovery.\u003c/p\u003e"},{"header":"4. Methodology","content":"\u003cp\u003eThis section explains how researchers determine whether is a hard disk drive, a solid- state drive, or a hybrid drive before executing the TRIM command [5]. TRIM\u0026rsquo;s functionality can be affected by various factors, such as the type of operating sys- tem, disk formats, and the cable connected to the SSD. This section provides detailed information about the various experiments and steps to perform these tests, as well as the results [6]. The TRIM command is one of the important components to always maintain the performance of solid-state drives (SSDs). This function allows the SSD system interface to know which data blocks should no longer be used, optimizing storage management, and reducing unnecessary write operations [7]. However, TRIM support varies depending on the operating system, disk format, and connection type.\u003c/p\u003e\n\u003cp\u003eFor optimal SSD performance, it is recommended to use a TRIM-supported operat- ing system and compatible file system.Using non-compatible file systems or interfaces can hinder the benefits of TRIM, potentially reducing the lifespan and efficiency of an SSD over time.In this study, the data collection method was performed using the live forensics method to analyze non-volatile data on an SSD (see Figure 3).In this study, an experiment is being conducted to test TRIM support by various operating systems and analyze the possibility of recovering deleted files when TRIM is turned on and off. The stages of the study include the study and analysis of digital data obtained during the experiment. To test the operation of TRIM, the file deletion command is executed on various operating systems, after which an attempt is made to restore them. The experiment is conducted on a test computer on which TRIM is enabled or disabled, then the results are analyzed on the investigator\u0026rsquo;s computer [8]. Before starting the analysis, the source data and hash values of the files are recorded to ensure the integrity and authenticity of the results. Comparing the hash values before and after deletion allows you to determine whether the data has been permanently deleted or needs to be restored. Copies of the studied data are also used to preserve the authenticity of the experiment. The figure above shows the stages of examination and analysis employed in this research: 1)Preparation: During the preparation phase, a repository was created for the data that needed to be restored. This study used the Portable FTK Imager tool to create a disk image. The experiment was conducted with the TRIM function on and off on an NVMe SSD to test the effect of TRIM on data recovery capability [9]. 2) Extraction: At this stage, data was extracted from the created disk image. Files that were previously deleted were identified and restored. In addition, the characteristics of the file structure, information about deleted data, file names and their checksums (md5 hash) were recorded.3) Analysis: At the final stage, the extraction results were analyzed, which makes it possible to evaluate the effec- tiveness of file recovery depending on the TRIM state. The study helped determine which tools are most suitable for data recovery with different TRIM settings [10].\u003c/p\u003e\n\u003ch2\u003eStage\u0026nbsp;1:\u003c/h2\u003e\n\u003cp\u003e1. Download the new version of Windows 7 Professional SP1 to the NVMe SSD drive.\u003c/p\u003e\n\u003cp\u003e2. Copy the keyword files to the SSD drive.\u003c/p\u003e\n\u003cp\u003e3. Delete the files and turn off the computer immediately.\u003c/p\u003e\n\u003cp\u003e4. Copy the SSD to the hard drive in the duplicator program (optional).Compare the SSD and hard disk hashes\u003c/p\u003e\n\u003cp\u003e5. Connect the SSD to the write blocker and generate a hash.\u003c/p\u003e\n\u003cp\u003e6. Use the file recovery utility to search keywords.\u003c/p\u003e\n\u003cp\u003e7. If successful, wait 1 hour, take the hash and compare, and try the search again.\u003c/p\u003e\n\u003cp\u003eIn step 1, we can expect TRIM functions to make files unrecoverable. The figure above shows the output screen. Similarly, in step 2, the TRIM function is disabled so that files can be restored.\u003c/p\u003e\n\u003ch2\u003eStage\u0026nbsp;2:\u003c/h2\u003e\n\u003cp\u003e1. Download the new Windows 7 Professional Service Pack 1 to the NVMe SSD.\u003c/p\u003e\n\u003cp\u003e2. Copy the keyword files to the SSD.\u003c/p\u003e\n\u003cp\u003e3. Disable the TRIM function.Set the disable delete notify mode to 1.\u003c/p\u003e\n\u003cp\u003e4. Delete the files and turn off the computer immediately.\u003c/p\u003e\n\u003cp\u003e5. Copy the SSD to the hard disk in the duplicator program (optional).Compare the SSD and hard disk hashes\u003c/p\u003e\n\u003cp\u003e6. Connect the SSD to write blocker and generate a hash.\u003c/p\u003e\n\u003cp\u003e7. Use the file recovery utility to search for keywords.\u003c/p\u003e\n\u003cp\u003e8. If successful, wait 1 hour, take the hash and compare, try the search again.\u003c/p\u003e\n\u003cp\u003eAt this stage 2, we can expect that the disabled TRIM state will make the files available for recovery.As shown in the image above, we deleted about 380 files and then turned off the computer to get the hashes. We found an important aspect. This is that all about 370 deleted files were fully recovered by Recuva with TRIM enabled. They were available as thousands of file fragments. Of these, 368 were the original files, 13 files were renamed without changes However, 3 files out of 384 files were keeping the original content but renamed. But when we disabled TRIM by repeating the same process on a Windows computer, we were able to get the same 378 files, of which 381 were the original files, 0 were renamed but unchanged, and three files were renamed with the original contents of the filename.\u003c/p\u003e\n\u003ch2\u003eStage\u0026nbsp;3:\u003c/h2\u003e\n\u003cp\u003e1. Download the\u0026nbsp;new\u0026nbsp;version\u0026nbsp;of\u0026nbsp;Linux\u0026nbsp;version\u0026nbsp;2.6.28\u0026nbsp;on\u0026nbsp;SVP200S3/60G\u0026nbsp;SSD\u0026nbsp;drive.\u003c/p\u003e\n\u003cp\u003e2. Determine if TRIM is supported using the following command:\u003c/p\u003e\n\u003cp\u003esudo hdparm -I /dev/sda | grep \u0026quot;TRIM supported\u0026quot;\u003c/p\u003e\n\u003cp\u003eAn output should be displayed with the message: \u0026ldquo;TRIM is supported for data set management (8 block limit)\u0026rdquo;, otherwise, your SSD drive does not support TRIM.\u003c/p\u003e\n\u003ch2\u003eStage\u0026nbsp;4:\u003c/h2\u003e\n\u003cp\u003e1. Create a disk image with Ubuntu versions 15.10 and 14.04.3 and follow the steps below:\u003c/p\u003e\n\u003cp\u003e(a) Download\u0026nbsp;the\u0026nbsp;new\u0026nbsp;Ubuntu\u0026nbsp;version\u0026nbsp;and\u0026nbsp;use\u0026nbsp;the\u0026nbsp;SVP200S3/60G\u0026nbsp;SSD\u0026nbsp;drive.\u003c/p\u003e\n\u003cp\u003e(b) Identify each Ubuntu version before proceeding with the following steps.\u003c/p\u003e\n\u003cp\u003e(c) For Ubuntu 14.10 and later versions, use:\u003c/p\u003e\n\u003cp\u003e$\u0026nbsp;tail -n1 /etc/cron.weekly/fstrim\u003c/p\u003e\n\u003cp\u003e/sbin/fstrim --all || true\u003c/p\u003e\n\u003cp\u003eFor Ubuntu 14.0 and earlier versions, fstream is not avail- able, so you must use the command below: /usr/share/doc/hdparm/contrib/wiper.sh.gz\u003c/p\u003e"},{"header":"5. Results","content":"\u003cp\u003eAt this stage on the Figure 10, the analysis of the acquisition results was performed using Portable FTK Imager to examine the impact of the TRIM function on file recovery. The analysis focused on identifying signature values of deleted files under two conditions: with TRIM disabled and TRIM enabled.When TRIM was disabled, as shown in Figure 10 (a), the file signature remained intact, indicating that the deleted file could still be read and recovered. However, when TRIM was enabled, as shown in Figure 11 (b), the file signature was either damaged or modified, making file recovery impossible. These results demonstrate the significant impact of TRIM on digital forensics, as enabling TRIM can permanently erase data, reducing the chances of successful recovery.\u003c/p\u003e"},{"header":"6. Conclusion","content":"\u003cp\u003eThe development of data storage technologies from classic hard drives (HDD) to modern solid-state drives (SSD) has significantly changed the methods of saving, iden- tifying and restoring deleted files. Enabling the TRIM function plays a key role in this process, as it allows the operating system to tell the SSD which data blocks are no longer in use and can be cleaned up immediately. Our research has shown that TRIM support varies depending on the operating system, file system, and connec- tion interfaces. The experiments have demonstrated that enabling TRIM significantly reduces the likelihood of successful recovery of deleted data, since the drive performs an immediate memory release, removing traces of information. At the same time, disabling TRIM leaves data available before it is overwritten, which allows you to partially restore information using specialized software. It was also revealed that the operation of the SSD controller in Garbage Collection mode can additionally affect data deletion, even when the TRIM function is turned off. However, this process does not always guarantee the complete erasure of information. Thus, the TRIM function plays a crucial role in the irre- versible deletion of data from an SSD, and its presence or absence can significantly affect the capabilities of forensic analysis and information recovery. Modern drives, even with- out TRIM, can independently manage memory cleanup, but the speed and efficiency of this process depend on the specific model and algorithms of the controller.\u003c/p\u003e"},{"header":"Declarations","content":"\u003ch2\u003eAuthor Contribution\u003c/h2\u003e\u003cp\u003eAll authors had an impact to the work.\u003c/p\u003e\u003ch2\u003eAcknowledgement\u003c/h2\u003e\u003cp\u003eThis study was carried out with the financial support of the Committee of Science of the Ministry of Science and Higher Education of the Republic of Kazakhstan under Contract №388/PTF-24-26 dated 01.10.2024 under the scientific project IRN BR24993232 \u0026ldquo;Development of innovative technologies for conducting digital forensic investigations using intelligent software - hardware complexes\u0026rdquo;.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\u003cli\u003e\u003cspan\u003eSolodov D, Solodov I (2023) Data recovery in a case of fire-damaged Hard Disk Drives and Solid-State Drives, Forensic Science International: Reports, vol. 3, no. 2, article 100199, Jul. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1016/j.fsir.2021.100199\u003c/span\u003e\u003cspan address=\"10.1016/j.fsir.2021.100199\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eLuković V, Jovanović Ž, \u0026ETH;urašević Pešović S, Pešović U, \u0026ETH;orđe- vić B (2025) Solid-State Drive Failure Prediction Using Anomaly Detection. Elec- tronics 14(7). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.3390/electronics14071433\u003c/span\u003e\u003cspan address=\"10.3390/electronics14071433\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eFrimpong T, Mawuli L, Missah Y, Ussiph N, Ahene E (Sep. 2023) Cold Boot Attack on Encrypted Containers for Forensic Investigations. KSII Trans Internet Inf Syst 16(9):3068\u0026ndash;3085. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.3837/tiis.2022.09.013\u003c/span\u003e\u003cspan address=\"10.3837/tiis.2022.09.013\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eChou Y et al (2023) Why and How to Increase SSD Performance Transparency, Proc. ACM. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1145/3317550.3321430\u003c/span\u003e\u003cspan address=\"10.1145/3317550.3321430\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eTianyu Ren Y, Du J, Cui Y, Lv Q, Li CJ, Xue (2025) Device-Level Optimization Techniques for Solid-State Drives: A Survey, arXiv:2507.10573 [cs.AR], Jul. 10. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.48550/arXiv.2507. 10573\u003c/span\u003e\u003cspan address=\"10.48550/arXiv.2507. 10573\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eSeth S (Jan. 2023) Application of Solid-State Drive to User Experience and User Satisfaction: Literature Review Study. Dinasti Int J Edu- cation Manage Social Sci 4(2):158\u0026ndash;167. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.31933/dijemss.v4i2.1527\u003c/span\u003e\u003cspan address=\"10.31933/dijemss.v4i2.1527\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eKumar M (2024) Solid state drive forensics analysis\u0026mdash;Challenges and recommen- dations, Concurrency and Computation: Practice and Experience, vol. 33, no. 24, Jun. article e6442. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1002/cpe.6442\u003c/span\u003e\u003cspan address=\"10.1002/cpe.6442\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eJalil H et al (2023) SSD Forensic Evidence Generation and Forensic Research on Solid State Drives Using TRIM Analysis, Proc. IEEE ICCWS. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/ICCWS53234.2021.9702989\u003c/span\u003e\u003cspan address=\"10.1109/ICCWS53234.2021.9702989\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eSun Y, Chen H, Wang M (2023) A Survey on SSD Forensic Analysis Techniques. Concurrency Computation: Pract Experience. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1002/cpe.6442\u003c/span\u003e\u003cspan address=\"10.1002/cpe.6442\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eChankyu Koh J, Kang T, Kim SW, Han (2024) IEEE Access 12 154 455\u0026ndash;154 466, Jan. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/ACCESS.2024.3482368\u003c/span\u003e\u003cspan address=\"10.1109/ACCESS.2024.3482368\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003eTemporal-Contextual Attention Network for Solid-State Drive Failure Prediction in Data Centers\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eOwens Walker T, Justin III, Blanco A, Rakvic R, Vanleer A, Brown D, Shey J, Sinsley GL, Hau T, Ngo RW, Ives Classifying Proprietary Firmware on a Solid-State Drive Using Idle-State Current-Draw Mea- surements, IEEE Access, 8, pp. 31869\u0026ndash;31881, Dec. 2019 (published Feb 2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/ACCESS.2020.2973605\u003c/span\u003e\u003cspan address=\"10.1109/ACCESS.2020.2973605\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eAbu Hweidi RF, Jazzar M, Eleyan A, Bejaoui T SATA M.2 on Forensics: Trim Function Effect on Recovering Permanently Deleted Files, in (2023) \u003cem\u003eInter- national Conference on Smart Applications, Communications and Networking (SmartNets)\u003c/em\u003e, Jul. 25, 2023. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/ACCESS.2020.2973605\u003c/span\u003e\u003cspan address=\"10.1109/ACCESS.2020.2973605\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eLange T, Naor J, Yadgar G (2025) Optimal SSD Management with Predictions, \u003cem\u003eProceedings of the ACM on Measurement and Analysis of Computing Systems\u003c/em\u003e, vol. 9, no. 2, article 30, May 29. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1145/3727122\u003c/span\u003e\u003cspan address=\"10.1145/3727122\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eMicrosoft (2023) Support and functionality of the TRIM command in Windows. Microsoft Docs\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eZhang X, Bhimani J, Pei S, Lee E, Lee S, Seong YJ, Kim EJ, Choi C, Nam EH, Choi J Bryan S. Kim**,Storage Abstractions for SSDs: The Past, Present, and Future,ACM Transactions on Storage, vol. 21, no. 1, article 1:1\u0026ndash;1:44, Feb. 17, 2025. https: \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e//doi.org/10.1145/3708992\u003c/span\u003e\u003cspan address=\"//10.1145/3708992\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eProphet SSD Failure Analysis and Prediction Guided by Flash Reliability Characteristics in Data Centers, published May 2025 in IEEE Trans Comput. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/TC.2025.3566871\u003c/span\u003e\u003cspan address=\"10.1109/TC.2025.3566871\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"},{"header":"Tables","content":"\u003cp\u003eTables 1 to 4 are available in the Supplementary Files section.\u003c/p\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Computer expertise, Flash memory, Solid state drive (SSD), Digital Forensics, Data recovery","lastPublishedDoi":"10.21203/rs.3.rs-7419937/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7419937/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe need for developing computer forensics has emerged due to the growing number of crimes involving advanced digital systems for unauthorized access. In this regard, digital forensics will always be an advanced field as court cases involving computer technology become more widespread. This research paper presents a detailed study of the fundamental method of using SSD drives for computer forensics. Solid-state drives (SSDs) have replaced traditional spinning disk hard drives and have become the standard for storing data in devices. Today, SSD drives are widely used in desktop computers and laptops. SDDs use flash memory therefore they are highly reliable. This study analyzes the allocated and unallocated storage space on SSD with the TRIM function. One of the key problems is the built-in SSD data self-destruction mechanism, which makes it difficult to recover deleted files. In this research paper, we will consider a method that could reduce the impact of all the features described. The result of the study may contribute to the development of more reliable tools in forensic investigations.\u003c/p\u003e","manuscriptTitle":"The Effect of TRIM Function on Data Recovery from SSD Solid-State Drives","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-10-06 09:18:10","doi":"10.21203/rs.3.rs-7419937/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"7ffd3b33-a50e-4a11-8150-5be67dc08a8c","owner":[],"postedDate":"October 6th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-01-29T08:41:29+00:00","versionOfRecord":[],"versionCreatedAt":"2025-10-06 09:18:10","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7419937","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7419937","identity":"rs-7419937","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}