1.18 SSD盘如何抢救被删除的文件

https://scz.617.cn/windows/202203161423.txt

Q:

我一般系统盘用SSD，数据盘仍然老老实实用机械硬盘，无它，就是多一次救命的机
会。昨天手贱删了一个文件，反应过来，立刻WinHex打开目标盘，蹭一下就复制、
恢复到其他分区了。若是SSD，死了就凉透了。

A: tk 2022-03-16

执行

fsutil behavior set DisableDeleteNotify NTFS 1

这个你尝试过吗？如果特别希望SSD的文件删除后能恢复，可以打开这个，不过最好
不打开。

D: scz

查了一下，tk说的这条命令会关闭SSD的TRIM特性，这样干之后WinHex能从SSD盘抢救
被删除的文件，实测无误。

对于Win10 NTFS，DisableDeleteNotify缺省为0，表示启用SSD TRIM特性。

$ fsutil behavior query DisableDeleteNotify NTFS
NTFS DisableDeleteNotify = 0

假设此时删除某文件，立刻用WinHex抢救，能看到文件名残像，文件大小也对得上，
但文件内容被抹成全零，恢复操作得到的是大小一样的全零内容的无效文件，这就是
TRIM的物理意义。

现在禁用TRIM，该操作立即热生效，无需重启OS或其他服务。

$ fsutil behavior set DisableDeleteNotify NTFS 1
NTFS DisableDeleteNotify = 1

假设此时删除某文件，立刻用WinHex抢救，能看到文件名残像，文件大小也对得上，
文件内容保持原样，恢复操作得到的是有效原文件。

禁用TRIM有负作用，一是SSD性能下降，二是SSD寿命缩短，据说会增加额外的写操作。
启用TRIM使SSD盘保持最佳性能、延长使用寿命，不值得为了"反删除"而禁用TRIM。

Win7最早识别SSD驱动并内在支持TRIM，但GUI上没有体现，Win10在GUI上有体现。

--------------------------------------------------------------------------
右键选中任一盘符
  Properties
    Tools
      Optimize
        dfrgui.exe (实际执行该程序，可以命令行直接启动)
--------------------------------------------------------------------------

dfrgui.exe会显示各盘符的"Media type"，常见两种是"Solid state drive"、"Hard
disk drive"，前者是SSD，后者是机械硬盘。任务管理器性能标签页直接能看到各盘
类型，比如SSD、HDD、USB等，啥也看不到时可能在VMware中。

在"Optimize Drivers"界面选中指定SSD盘，点击"Optimize"，相当于手工TRIM。

此外，在Win10上，不必也不要显式对SSD盘使用defrag.exe，OS会处理好的。

参看

--------------------------------------------------------------------------
fsutil behavior
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior

Does Windows defragment your SSD - Scott Hanselman [2014-12-04]
http://www.hanselman.com/blog/the-real-and-complete-story-does-windows-defragment-your-ssd
--------------------------------------------------------------------------

fsutil behavior set DisableDeleteNotify NTFS 0|1

Disables (1) or enables (0) delete notifications.

Delete notifications (also known as trim or unmap) is a feature that
notifies the underlying storage device of clusters that have been freed
due to a file delete operation. For systems using NTFS, trim is enabled by
default unless an administrator disables it.

Enabling or disabling doesn't require a restart. Trim is effective when
the next unmap command is issued. Existing inflight IO are not impacted by
the registry change. Doesn't require any service restart when you enable
or disable trim.

TRIM is an ATA command set that was originally designed for the purpose of
keeping a Solid State Drive at its optimal performance throughout its
lifespan.

The TRIM feature allows Windows 10, or any supported operating system, to
notify an SSD which blocks of data are no longer in use and can be safely
wiped out to be writable again. Having this operation done ahead of time
improves performance, as the drive won't have to spend time erasing a
particular block when space is needed to store new data, ensuring the SSD
reaches its advertised lifespan.

For TRIM to work, both the operating system and the Solid State Drive must
support the feature, and it must be enabled in the operating system.

TRIM lets the operating system notify the SSD that a page is no longer in
use and this hint gives the SSD more information which results in fewer
writes, and theoretically longer operating life.