One of our developers had issues with OneDrive. Thinking that his data was still in sync I shift-deleted the synchronisation folder allowing it to resync. After the resync it became clear that his data had not been syncing at all since january (over 4 months!).
No worries.. let's use some recovery tools to restore that delete data..
I've tried Recuva, GetDataBack & Puran but they all have the exact same result. Every file is visible in the correct folder structure but contain NULL values only. Not just 1 or 2 files but every file within those onedrive folders..
I suspect that this may be the case because Onedrive has overwritten the orignal files with null values since it's only syncing data it needs. But this does not make sense because there were 2 onedrive folders:
- C:\Users\%user%\Onedrive - %Companyname%
- C:\Users\%user%\Onedrive - %Companyname% 1
The data we need is visible in the last (ending with '1') folder while the new sync was restored in the first. Before this delete, every file was saves locally.
The device is a HP Zbook with a Toshiba 256GB SSD (THNSN5256GPU7) running Windows 10 Enterprise (10.0.16299). Windows & Data are both on the same NTFS volume as it was never intended to store any data.
Anything else I can try? We were just finishing some urgent projects. A few months of work is just gone.. A few projects can be recovered using decompile tools and others have a few GIT versions but there is a bunch of critical administration as well.
答案1
Modern SSDs all employ a feature called Trim or Deallocate on NVMe (or more generally, garbage collection) where the OS instructs it to erase freed blocks when files are deleted.
This means when you Shift+Delete, all the sectors on the drive containing your data are marked as unused, and the SSD overwrites them with NULL in the background over the next few seconds or minutes (strictly speaking, it erases the page during garbage collection and may shift data in partly used pages elsewhere).
There is an additional feature called "deterministic read zero after trim" on (S)ATA drives or "Write zeros" command on NVMe which causes the drive to explicitly return zeros for sectors marked as deleted, even if it hasn't actually finished erasing them yet.
Tl;dr: Deleted data is unrecoverable on modern SSDs, as it gets intentionally overwritten by zero or null values upon deletion.
Irrespective. Always maintain and test your backups