Question about SSD formatting filled with 1s

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
starburst
Posts: 1
Joined: 15 Aug 2018, 16:11

Question about SSD formatting filled with 1s

#1 Post by starburst »

I attempted to recover a SSD used to shoot video, was able to recover priceless videos in the past using photorec, thanks a lot for that!! But this one I got seems unrecoverable and I wanted to makes sure that is the case since nothing of interest showed up on this one (a few xml and plist that's it).

The SSD was empty when I got it, they forgot to backup before formatting the card.

Anyway, I thought I would backup the SSD image using testdisk and give the SSD back and when I inspected the image.dd (120GB) into a hex editor I saw that it was pretty much at 99.9% filled with 1s (0xFFFF). Is that common for formatting software to fill the disk with 1s? I guess whoever used that card last didn't do a quick format and actually went full on erase everything and it filled the whole disk with 1s.

Could that be the case or did I used the wrong option in testdisk to save the image?

The card is a Sony XQD which seems to be using exFAT as the filesystem.

I think I know the answer is probably going to be, yes nothing is recoverable, but I would've expected 0s and not 1s, so just want to makes sure.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Question about SSD formatting filled with 1s

#2 Post by cgrenier »

When the SSD has been formatted, a trim operation has probably been issued. It informs a solid-state drive (SSD) which blocks of data are no longer considered in use and can be wiped internally.
Unfortunately no data can be recovered after that by software. To be more accurate, some data recovery company can open the SSD and bypass the flash controller to access old data and recover lost files. It's usually destructive for the SSD and an expensive service.

Locked