CHFI Storage Forensics and File System Analysis Practice Question
An investigator images an SSD that has TRIM enabled. Which of the following challenges will MOST likely affect the recovery of deleted files from this SSD?
⚠ Common exam trap
Many candidates confuse wear leveling with TRIM, assuming that wear leveling itself causes data loss, when in fact TRIM is the specific command that actively erases freed blocks on SSDs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TRIM causes the SSD to zero out freed blocks, preventing recovery
When TRIM is enabled on an SSD, the operating system notifies the drive which blocks are no longer in use. The SSD's firmware then immediately zeroes out or internally marks those blocks as free, physically erasing the data. This prevents forensic tools from recovering deleted files because the underlying data is no longer present on the NAND flash cells.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSD uses a different partition table scheme
Why it's wrong here
The partition table scheme (MBR vs. GPT) only defines the logical layout of disks and partition metadata; it has no effect on how the SSD controller manages flash blocks. TRIM operates at the logical block address level, sending ATA commands to mark deleted sectors as invalid, independent of partitioning. Therefore, imaging the SSD would not be prevented by a partition scheme.
- ✓
TRIM causes the SSD to zero out freed blocks, preventing recovery
Why this is correct
TRIM is an ATA command that tells the SSD which logical blocks belonging to a deleted file are no longer in use, causing the controller to immediately discard or erase that data at the flash level. As a result, the original content is physically removed or marked for garbage collection before a forensic image is taken, so common recovery tools cannot reconstruct the file. This direct erasure is what makes deleted data unrecoverable on a TRIM-enabled SSD.
- ✗
The SSD firmware encrypts all data, requiring a decryption key
Why it's wrong here
While some SSDs feature self-encrypting drive (SED) hardware, encryption is an orthogonal security feature: the drive may require a key to decrypt data at rest, but that does not inherently erase deleted files. If the SSD is unlocked and mounted, encrypted deleted data would remain logically present until overwritten, unless TRIM is enabled to discard it. The observed loss of deleted files on a TRIM-enabled SSD is due to the TRIM erasure process, not the need for a decryption key.
- ✗
Wear leveling spreads data across blocks, complicating recovery
Why it's wrong here
Wear leveling is a flash management technique that spreads write operations evenly across physical blocks to prolong SSD lifespan; it decides where incoming data is written, but it does not invalidate or erase data that has been deleted by the file system. Deleted data may indeed be scattered across different flash chips due to wear leveling, complicating forensic reassembly, but the data still remains accessible until physically overwritten. It is TRIM's explicit invalidation of deleted blocks, not wear leveling, that prevents recovery on modern SSDs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.