Abstract
Data recovery process for magnetic hard disk drives has remained forensic friendly for digital investigation team. Since solid state drive (SSD) with transistor based storage started gaining popularity among desktop and laptop users, it has become challenging to recover data from SSD, due to its implementation of background garbage collection and wear leveling and TRIM command which sanitizes the disk in few seconds. In this paper we experiment and analyses the data recovery from solid state drive in an open source test environment, sample data of multiple file format is copied in to two partitions, data from first partition (sdc1) is deleted and second partition (sdc2) is formatted. Data recovery is performed in two different approaches one is directly from the disk drive and the other is imaging the SSD and recovering the data from image. Results shown that data recovery partition-wise from disk image is extracting more data.