Can I recover files from a formatted ssd?

BobHarris wrote:

…Now an external SSD is less likely to be encrypted (it can be, but I would bet most users do not bother). However, Mac NVMe storage in an Apple Silicon Mac is always encrypted, even if the user does not enable FileVault. Recovering data from those NVMe chips would be more of a challange.

And that’s all assuming Apple didn’t do something smart, like re-generate the data encryption key.

No, there’s no realistic way to recover the data. As you noted an SSD operates much differently than a mechanical hard disk drive. That difference is while a mechanical hard drive leaves the information in place and just marks the sectors for overwrite, an SSD clears everything to a writeable state thus eliminating all possibility of finding any residual data.

Above is correct.

All SSD data is permanently gone, with no possibility of recovery.

Reformatting an SSD erases all sectors.

You have unfortunately become the latest among us to learn the necessity of backups. Most of us learn this lesson the hard way, too: by losing our data.

MacDataSaviour wrote:

Oh, come on. Overwriting absolutely applies to SSDs, it just works differently than on traditional hard drives. Wear leveling doesn’t magically prevent data from being written over; it just spreads writes across memory cells. If SSDs didn’t overwrite data when needed, they’d be useless after a few saves.

If your claim were true and SSDs erased everything instantly, data recovery services wouldn’t even bother with SSDs. Yet here we are, with companies making a living off SSD recovery. So no, the data doesn’t just disappear the moment you hit delete.

And let’s clear something up, formatting or erasing an SSD doesn’t instantly vaporize all data into thin air. TRIM marks blocks as available, but until they’re actually overwritten, the data is still there and can be recovered with the right tools. That’s why SSD forensic recovery exists.

Data is not “overwritten” on an SSD. The storage locations must be reset for them to be writeable again. The drive will take some finite amount of time to reset them. If they have not been reset, the data may be recoverable.

So, it can be recoverable if the drive controller hasn’t reset the storage. If the drive was immediately powered down, then it is possible that the data is recoverable.

Storage space on a SSD cannot be “overwritten.” It must be reset to writeable, clearing whatever was in that area, before it is available for writing. Once that is done, the data is gone. I guess you can believe that process is “overwriting” if you ignore the existence of the reset process.

macOS provides backup software with Time Machine, but there are also third party options such as Carbon Copy Cloner.

These two Apple articles present the use of Time Machine a bit differently:

Back up your Mac with Time Machine - Apple Support

Back up your files with Time Machine on Mac - Apple Support

Carbon Copy Cloner (free trial period):

https://bombich.com/

You have unfortunately become the latest among us to learn the necessity of backups. Most of us learn this lesson the hard way, too: by losing our data.

It's really tough to recover files after formatting the SSD, because of the trim command function. However, there is a good chance that it can be recovered if the data is not overwritten. Try using any free data recovery software to check if they are available for recovery. 

MacDataSaviour wrote:

It's really tough to recover files after formatting the SSD, because of the trim command function. However, there is a good chance that it can be recovered if the data is not overwritten. Try using any free data recovery software to check if they are available for recovery. 

“Overwriting” is a concept of hard disks, not on SSDs.

Not with wear leveling, as is ubiquitous with SSDs.

Just as soon as the storage is reformatted, the whole thing is erased. Or just as fast as the SSD can erase it. (SSDs must erase storage before it can be reused, primarily because reading and writing to an SSD is fast, but erasing is slow. And erasing has to happen before the sector can be rewritten, so the SSD gets to work erasing everything just as fast as it can.)

There is no data here.

Oh, come on. Overwriting absolutely applies to SSDs, it just works differently than on traditional hard drives. Wear leveling doesn’t magically prevent data from being written over; it just spreads writes across memory cells. If SSDs didn’t overwrite data when needed, they’d be useless after a few saves.

If your claim were true and SSDs erased everything instantly, data recovery services wouldn’t even bother with SSDs. Yet here we are, with companies making a living off SSD recovery. So no, the data doesn’t just disappear the moment you hit delete.

And let’s clear something up, formatting or erasing an SSD doesn’t instantly vaporize all data into thin air. TRIM marks blocks as available, but until they’re actually overwritten, the data is still there and can be recovered with the right tools. That’s why SSD forensic recovery exists.

Corrupted and crashed and failed SSDs can potentially have data recoverable, sure.

If you can acquire the decryption key.

As for encrypted data that’s been intentionally erased, and quite probably with enough powered-on time for the pending-erase queue to have been run to completion? Ask those same companies what and how much data they would expect to recover from that.

Apple documents reformatting and reinstalling as a means to clear user data, and recent Macs (including the M3 here) use encryption to further protect that data. A sequence which means they don’t expect user data to remain.

TRIM marks blocks as available, but until they’re actually overwritten, the data is still there and can be recovered with the right tools. That’s why SSD forensic recovery exists.

TRIM allows the SSD/NVMe controller to move blocks onto the garbage collection queue. From there they may be pre-cleaned for a future write.

When the garbage collection queue finds that a pre-clean group is all on the queue that group is pre-cleaned and made available as soon as possible, so there are no write delays.

If there are any blocks still in use in the pre-clean group, then its companions will sit in the garbage collection queue until all the group's blocks are in the queue, or the need for pre-cleaned blocks becomes sufficiently high, that the SSD/NVMe controller starts doing read/modify/writes to move blocks in a pre-clean group to other locations so that group can be pre-cleaned and use for new writes.

Now an external SSD is less likely to be encrypted (it can be, but I would bet most users do not bother). However, Mac NVMe storage in an Apple Silicon Mac is always encrypted, even if the user does not enable FileVault. Recovering data from those NVMe chips would be more of a challange.