Is the data really gone?

I recently copied my father's files from the laptop to an external ssd. Then he encrypted it, but couldn't decrypt it again on his Mac. Then I transferred the data to my PC, formatted the hard drive and restored everything. Everything worked again. But then he realized that a folder with important data is completely empty. I checked it on my PC and the folder was empty. On the laptop, however, he has already deleted the data and it can no longer be restored with any program. What should I do now? Did i make a mistake? Do I have to feel bad now?

It's kind of complicated… You can of course reset the hard drive to a previous point in time, I had to do that once, but whether that will do anything, I can't say for sure, would be my only idea now.

I didn't understand a word of this confused explanation, but it doesn't matter:

Of course, you have to use the correct password to decrypt. Most of these programs are likely to encrypt symmetrically, that is, it is the same password that you entered when encrypting - including upper and lower case or spaces at the end.
If you do not have the correct password, the data is gone.

It is also possible that an error occurs during encryption, which is rare but not impossible. Therefore, if you want to delete the original data, you should always check beforehand whether the decryption works without errors.

And if you've deleted the data everywhere else, it's gone.
Maybe they're still in the trash.

Alternatively, there are recovery tools that use a trick from Windows and Co. "Real" deletion (actually does not exist, instead it is overwritten with 0) of files is time-consuming (and would reduce the lifespan of SSDs), so they are usually not deleted at all. Instead, only the information that this file exists is deleted internally, but the file itself is still there.
Such recovery tools search for such files and try to restore them. The problem is, this file may have been partially or completely overwritten because it no longer existed for Windows and Co. Yes.
So you have no guarantee that you can restore everything or at least something and you may have to search a lot of cryptic stuff until you have found the data.

By the way:
The topics that put any *** here are gruesome…
So it doesn't surprise me that I always get scrap questions with my filters…

I recently copied my father's files from the laptop to an external ssd.

OK. So far so good - but remember if you delete something on an SSD then the TRIM command will ensure that the data is also removed. Since then neither software nor the prof. Data rescuers still do something!

Then he encrypted it, but couldn't decrypt it again on his Mac.

How and with what encrypted?

Then I transferred the data to my PC, formatted the hard drive and restored everything.

Very bad idea because then you overwrite data before you are even sure that the data is usable. So you take the chance to try something again.

Then he realized that a folder with important data is completely empty. I then checked my PC and the folder was empty.

Then it was not copied correctly, encrypted, decrypted or something else. But since you copy everything back and forth you destroy what was on it before!

On the laptop, however, he has already deleted the data and it can no longer be restored with any program

Does he have an HDD on the laptop or an SSD? If SSD then the data is gone with 99% certainty…

What should I do now?

… If the data is important then leave it to a professional - but I don't see much of a chance the way you worked. If you keep tinkering like this then I see black!

Did i make a mistake?

Not just one!

Where is the backup?
Why didn't you verify that everything is there after encryption?
Why do you overwrite and format data before everything is checked after decryption?
etc.

In short - no backup, no success control, no systematic work, etc.

do I have to feel bad now

No - unless you do it professionally!

First, your father should take care of this when it's his important dates. If he can't do that then you get someone who can and don't do "Jugend forscht" with important data.

And experimenting without backups is not great either!

PS.: There's no point in spamming 100 topics that don't fit.

PPS.: I do data recovery professionally - get in touch by PM. I may be able to help.

Alternatively, there are recovery tools that use a trick from Windows and Co. "Real" deletion (actually does not exist, instead it is overwritten with 0) of files is time-consuming (and would reduce the lifespan of SSDs), so they are usually not deleted at all. Instead, only the information that this file exists is deleted internally, but the file itself is still there.

Not correct. This is the case with most HDDs, but SSDs and newer hard disks support a command called TRIM and it works like garbage disposal.

It securely discards deleted data in the background. Are you looking at:

The topics that have put any *** here are gruesome… So I'm not surprised that I always get junk questions with my filters…

You're a community expert, then you should be able to hide topics. I got rid of the most absurd ;-)

Not correct. This is the case with most HDDs, but SSDs and newer hard disks support a command called TRIM and it works like garbage disposal.

It securely discards deleted data in the background.

I just read in your answer - I didn't know it before, thanks for that.
But maybe there's still hope (maybe not here) if nothing more has been done afterwards. The TRIM command only marks for overwriting, as long as nothing is written, it will not be overwritten.
But since so much has happened around here, that is unlikely.

You're a community expert, then you should be able to hide topics. I got rid of the most absurd ;-)

I can, I usually do too, but that was so much that, to be honest, I lost my motivation - thanks for tidying up.

PS:

Ok, the video shows: There's no hope.
I'm not sure why, but maybe it's just too late and I missed the reason.

That should make the why again clearer -

You can also switch it off, but that's not ideal for an SSD as you can see.

Therefore I would still use an HDD for data and the SSD for the OS and the programs. Why do you see here

If you do not have the correct password, the data is gone.

No, of course the data is still there. However, it is encrypted and can't be used. But since he was able to decrypt the data on another computer, he probably also has the correct password.

Since we don't know exactly what you did, the problem is not understandable. Laptop? Which operating system? How was it encrypted? The mistake is probably that it is better to make a backup before such actions. In general, it is a good idea to make regular backups, especially if you have "important data". The mistake is also to delete the unencrypted data before one has fully checked the completeness and usability of the encrypted data. You should start with the "important data". Because they are important.

You can no longer understand whether the now empty folder was not already empty. I type on it. As a rule, the encryption and decryption work completely or not at all. It can hardly be explained that only one directory is destroyed in the process.

But remember if you delete something on an SSD then the TRIM command will ensure that the data is also removed.

Is trim carried out after every deletion process, i.e. After every "empty trash"? Or only at certain intervals?

How is it with Linux, if you z. B. Works with rm?

Trim runs in the background and can be activated or deactivated in the OS. The sense of TRIM is explained here:

You have to check in the OS whether this is activated. It doesn't matter whether you use the GUI or CLI - if trim is activated, it always runs in the background.

For most people, "unusable" should mean "gone".

This also explains the second point that I did not fully understand:
Writing affects lifespan, so why actually delete it and not just ignore it?
But then the SSD probably thwarted my plans.
Thanks for the lesson.

And subject of backups:
Sounds like you should use SSDs for the e.g. 5-minute backup and then write to HDDs every night, for example. That would be a combination of performance and data security.
And if you want to be particularly sure, you can also write redundantly, but that is independent of SSD or HDD.

And for the work PC on which secret data is stored, it is best to use the SSD.

Neither of these applies to me, but if you want to be able to advise / help you should understand the background.

Writing affects lifespan, so why actually delete it and not just ignore it?

Short answer: Has to do with the way an SSD works.

Long answer: https://fdocuments.in/reader/full/nand-flash-data-recovery-cookbook (It's in there somewhere, I'm too lazy to search…)

Sounds like you should use SSDs for the e.g. 5-minute backup and then write to HDDs every night, for example. That would be a combination of performance and data security.

… 5 minute backups?! RAID arrays are more suitable for such short-term backups. Make a RAID1 so that a failure has no consequences and then one backup every night on an HDD and a second offsite backup is sufficient. If, for example, the booth is on fire, 3 backups won't help you if they were all there!

And if you want to be particularly sure, you can also write redundantly, but that is independent of SSD or HDD.

Yes and no - many use the same data carriers with RAID arrays, which are then bought at the same time. But that also means that they could have the same firmware or construction error, for example, and then fail soon.

I also keep getting RAID arrays in which one disk has failed and the second then fails during the recovery. Rebuilding the array after replacing a plate means a lot of work for the remaining old plates, which are then no longer entirely fresh.

If you do something like that, you have to monitor the condition of the disks and replace them when there are signs of imminent failure and not just when one has failed. Keep in mind that data carriers (regardless of whether they are HDD or SSD) do not get better over time. There are mechanical problems, electronics and firmware damage. You then have, for example, 4 identical data carriers that all have the same weaknesses - e.g. The controller overheats and fails, firmware bug or the like and if one of them has already completely failed, the chance is very high that a second will fail soon and that of the Situation you let the things run 8h, 10h or even longer under full load…

And for the work PC on which secret data is stored, it is best to use the SSD.

… Why? I'm maximizing the damage if there's a problem?!

An SSD for the system, temp. Data and programs is ideal - that speeds up the PC. For important data then prefer the HDD and a decent backup concept, but that also fails.

I have, for example, again and again customers who had a backup until, for example, a Windows update deactivated the service and in an emergency they then notice that the last backup is 6.5 months old.

Anything can fail if you don't monitor it, and automatic backups should be monitored just like everything else.

So the external ssd would be encrypted with SanDisk Secure Access and the laptop had a hdd

Well - then I would start with the HDD first - there could still be data to be found - Take the HDD out of the laptop and connect it to another PC or boot the laptop from a live Linux such as: https://sourceforge.net/...y-toolkit/

On no account continue to write data to the HDD! Also, do not continue to use the data recovery software or the PC. Defragmentation, temp. Operating system data and logs can overwrite data.

Or, as I said, let a professional take care of it so that it doesn't go wrong anymore.

5 minute backups?! RAID arrays are more suitable for such short-term backups.

Was an example, I don't need that myself.
And that would of course not be full backups, but transaction backups, e.g. From the DB server, which must also be somewhere.

… Why? I'm maximizing the damage if there's a problem?!

So I thought that someone might want to steal the data.
Because the deletion is then actually deletion and the backup is located somewhere else and is protected from access.

Personally, I also have everything that is important in the cloud in my private life, i.e. Work, documents, etc. The likelihood that my data carrier and all backups from the cloud operator will fail at the same time is rather low. Of course, that doesn't help against manual deletion, but then it's my own fault.
And I also have an HDD where I sporadically copy something onto it, so it is rarely used.

Sorry, you didn't answer my question. I know what trim is for. If not, I would have asked. The trim running in the background is also clear. I want to know what triggers trim. Trim is not a continuous process. To the best of my knowledge, trim on Ubuntu runs once a week. How is it with Windows? With others

If it is similar, your explanations are not entirely correct.

So far so good - but remember if you delete something on an SSD then the TRIM command will ensure that the data is also removed. Since then neither software nor the prof. Data rescuers still do something!

So if you are fast enough, and we're talking about days here, then trim hasn't hit the record yet.

By the way, on my Surface with the latest Windows 10, I see that trim is deactivated. As many posts as I find on the Internet about activating trim, it seems to be more the rule that the function is deactivated.

With the difference that gone is gone too. If you remember the correct password, the files are suddenly there again. A wonder!

So I thought that someone might want to steal the data. Because the deletion is then actually deletion and the backup is located somewhere else and is protected from access.

… No, because if someone steals the data then they are gone before you can delete them.

There's encryption for something like this - then someone can steal the disk or the PC and still do nothing with it!

Neither SSD nor encryption help against hacking attacks and the like when the data carriers are currently integrated.

Of course, that doesn't help against manual deletion, but then it's my own fault.

Wrong - a backup concept should of course also hold up in this case. What use is a backup if you can't save anything after a mistake?

When you delete data, the OS informs the disk that certain blocks are no longer needed. When this happens depends on the OS and possibly also on the version and other settings.

It probably also depends on the workload.

You have to google it or look at the corresponding source code - it can be viewed on Linux. With Windows, for example, I would just try it out.

So if you are fast enough, and we're talking about days here, then trim hasn't hit the record yet.

It can be theoretical, but especially with Windows there's often much less time. I have not yet had the muse to test it out in detail and to familiarize myself with it so deeply.

By the way, on my Surface with the latest Windows 10, I see that trim is deactivated. As many posts as I find on the Internet about activating trim, it seems to be more the rule that the function is deactivated.

Perhaps, users have learned over decades that dates are not really deleted and now there are some who don't know about TRIM.

So it can be exactly like with several disks on one SATA cable. That would be technically feasible, but with IDE where that was possible, a large part of the support requests were due to incorrectly set jumpers and therefore the manufacturers decided that they no longer want this circus with SATA.

No problem - it was decided that we're too stupid to deal with jumpers and therefore there's only one disk per SATA port.

So the same can apply here - it would be good for the SSD but if it produces too many support requests it will be deactivated again.

If you do not have the correct password, the data is gone.

If you remember the correct password, the files are suddenly there again.

Then he does have the password.

But not temporarily. Forgotten, relocated, invaded again, found again. The data was always there. It's kind of like the bun that lies behind the locked door. You are hungry, you know that there's a bread roll, but you can't get it. If you find the key that you had locked up, you can satisfy your hunger. Temporary key loss, but the bun was always there. It just wasn't your turn.

And this is a completely pointless discussion about a word that is wrong from one point of view, but is from another.

In the sense: Have fun with your word, I'm out.