CHFI Storage Forensics and File System Analysis Practice Question
During a forensic examination of an SSD, the analyst notes that TRIM is enabled. What challenge does TRIM pose for data recovery?
⚠ Common exam trap
Watch out — candidates often confuse TRIM with wear-leveling or encryption, assuming it protects data rather than permanently destroying it, leading them to choose options that describe unrelated SSD features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TRIM permanently erases deleted data at the block level, hindering recovery
TRIM is an ATA command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's garbage collection process immediately erases these blocks at the physical level, making the data permanently unrecoverable through conventional forensic tools. This directly hinders data recovery because the deleted data is physically zeroed or marked as invalid before any forensic acquisition can occur.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TRIM reduces the lifespan of the SSD by excessive writes
Why it's wrong here
TRIM is a host-to-device command that marks logical block addresses as no longer containing valid data; it does not write data to the NAND. In fact, TRIM reduces write amplification and helps maintain steady performance by enabling the controller to reclaim erased blocks efficiently. It therefore extends, rather than shortens, SSD lifespan, and it is not a source of excessive write cycles.
- ✗
TRIM compresses data, altering forensic signatures
Why it's wrong here
TRIM performs no transformation of user data and never compresses it; compression, if applied, is done by the SSD controller's internal data reduction or by the operating system before data reaches the device. The command simply communicates which regions can be discarded, so file contents and their metadata signatures remain unchanged at the logical layer. Consequently, a forensic examiner would not see altered signatures caused by TRIM.
- ✗
TRIM encrypts data, preventing forensic access
Why it's wrong here
TRIM has no cryptographic function; it is an unmap or discard operation that informs the SSD that previously written data blocks are invalid. Encryption on SSDs is implemented separately through hardware features such as TCG Opal/SED drives with media encryption or through full-disk encryption software like BitLocker. TRIM neither encrypts nor decrypts data, and it does not create a cryptographic barrier preventing forensic access.
- ✓
TRIM permanently erases deleted data at the block level, hindering recovery
Why this is correct
TRIM permanently erases deleted data at the block level by having the OS issue ATA DATASET MANAGEMENT or NVMe Deallocate commands that unmap the blocks containing the deleted file. Once unmapped, the SSD controller no longer preserves the old data and may zero or reuse those physical blocks during garbage collection, so conventional recovery tools cannot locate the file. This is why TRIM-implementing SSDs present a much greater forensic recovery challenge than HDDs or TRIM-disabled SSDs.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.