CHFI Storage Forensics and File System Analysis Practice Question
During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?
⚠ Common exam trap
EC-Council often tests the distinction between TRIM (an OS-to-SSD command that explicitly tells the drive to erase unused blocks) and Garbage Collection (a firmware-level process that may or may not erase data without TRIM), leading candidates to incorrectly choose Garbage Collection because they confuse background maintenance with the specific command that prevents recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TRIM
The TRIM command (ATA Data Set Management command) allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's controller immediately erases those blocks internally, making the original file data unrecoverable by file carving tools because the physical NAND cells are zeroed or marked as invalid. For files deleted months ago, TRIM would have already been issued for those LBAs, so traditional carving that relies on residual data in unallocated space fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TRIM
Why this is correct
TRIM is an ATA command that explicitly informs the SSD controller of pages that are no longer in use, prompting the controller to erase those physical blocks either immediately or during idle time. Because the erasure is performed at the flash level, the actual data is removed or invalidated, preventing recovery via file carving. This makes TRIM the critical factor that distinguishes SSD forensic examinations from HDD ones, as deleted files become inaccessible to software-based recovery tools.
- ✗
Over-provisioning
Why it's wrong here
Over-provisioning refers to the portion of an SSD's NAND capacity that is hidden from the host and used as spare space to enhance write performance and extend drive lifespan. It does not issue any commands to erase data upon file deletion; instead, it merely provides a reserve pool for wear levelling and garbage collection. Consequently, deleted file contents remain in the user-accessible blocks until the controller later rewrites those blocks, meaning file carving can often still recover data until that overwrite occurs.
- ✗
Garbage Collection
Why it's wrong here
Garbage Collection is an internal SSD controller process that consolidates valid data into fewer blocks and then erases blocks containing only invalid data. Unlike TRIM, GC is opportunistic and reactive—it runs when the drive is busy or during idle periods, and it may not reclaim a block for a long time after invalidation. Because GC does not systematically erase freed blocks on demand, deleted data can persist for extended periods, making forensic recovery possible until the controller eventually performs an erase operation.
- ✗
Wear levelling
Why it's wrong here
Wear levelling is an algorithm that redistributes write and erase cycles evenly across all NAND blocks to prevent premature wear out of any single cell. It operates by remapping logical addresses to physical locations, but it does not trigger any data erasure in response to a file deletion command. Deleted data simply remains in its physical blocks until the wear-levelling logic later selects those blocks for reuse, at which point the data is overwritten—so the mechanism itself does not impede forensic carving in the short term.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.