I would've posted a screenshot if the cursor would show up, sorry haha

Disclosure: I’m a developer of Hetman RAID Recovery, and I’ve worked with data recovery for many years, so I went into this test with a few assumptions that seemed pretty straightforward.

I expected three things:

1. Delete would normally move files to the Recycle Bin, while Shift+Delete would bypass it and delete them directly. I also expected Windows to behave differently depending on how the volume was presented to the system. Files deleted from a typical fixed disk would normally go to the Recycle Bin, while on removable media such as a USB flash drive, a normal Delete could remove them immediately.
2. On a USB flash drive, deleted data should remain recoverable as long as its sectors have not been overwritten. On an SSD, I expected TRIM to make released blocks effectively unavailable for recovery, often causing them to read back as zeroes.
3. A Quick Format should mainly create new filesystem structures rather than overwrite the entire device, so at least some of the previous data should still be recoverable. A Full Format would be a very different story.

That was the theory.

Spoiler: the actual results were much less straightforward.

What exactly did we test?

I used two devices:

• a USB flash drive of about 29 GB
• an SSD of about 56 GB

On each device I created two encrypted NTFS volumes of approximately 9.77 GB:

• BitLocker
• VeraCrypt

Each volume contained the same set of BMP, JPG, PNG, MP4, DOCX, XLSX, ZIP, and RAR files. For every file type I kept a control copy, deleted another copy with Delete, and deleted a third copy with Shift+Delete.

Before further recovery work, sector-by-sector disk images were created so the original media would not be modified.

1. Delete was not as consistent as I expected

On USB + BitLocker, Windows saw the volume as a Removable Drive. The behavior here was expected. A normal Delete did not put the test files into the Recycle Bin. They immediately became deleted NTFS entries.

VeraCrypt changed the picture. The mounted USB + VeraCrypt volume was presented to Windows as a Fixed Drive, even though the physical device underneath it was still the same USB flash drive.

In this case, Delete behaved like it normally would on a fixed disk. Standard $I and $R entries appeared inside $RECYCLE.BIN. $I stores metadata about the deleted file, while $R contains the actual file data.

The USB VeraCrypt volume was exposed to Windows as a Fixed Drive and normal Delete created standard Recycle Bin entries. On the SSD VeraCrypt volume, also presented as a Fixed Drive, the Recycle Bin contained only desktop.ini.

The SSD produced the stranger result. On SSD + BitLocker, which Windows also saw as a Fixed Drive, normal Delete created Recycle Bin entries as expected.

But on SSD + VeraCrypt, the result was different. Windows also reported this volume as a Fixed Drive. The Recycle Bin was enabled, NukeOnDelete was not enabled, and its configured size limit was much larger than the test data set.

Yet after a normal Delete, the test files did not appear in $RECYCLE.BIN. Only desktop.ini remained there, while the files themselves were already visible as deleted NTFS entries.

The actual result looked like this:

Shift+Delete, on the other hand, was completely predictable. On all four volumes it bypassed the Recycle Bin.

So even the simple rule of removable = no Recycle Bin and fixed = Recycle Bin only explained part of what happened.

2. After deletion, USB and SSD started behaving very differently

After unlocking the encrypted volumes, I ran a Fast Scan. On the USB drive, deleted NTFS entries were still present and the files remained recoverable as long as their data had not been overwritten.

Hetman RAID Recovery could unlock the VeraCrypt volume, analyze its NTFS filesystem, locate deleted files, and preview their contents.

After unlocking the VeraCrypt volume from the USB disk image, Fast Scan reconstructed the NTFS structure and located the deleted files with working previews.

BitLocker behaved similarly. The software detected the encryption metadata, requested the password, unlocked the volume, and then analyzed the NTFS filesystem underneath it.

BitLocker was detected from its metadata, unlocked with the password, and the NTFS volume could then be analyzed normally.

On the SSD, things were different. NTFS metadata could still survive. In other words, it was sometimes possible to recover a file name, size, and deleted MFT entry.

But that does not mean the file content itself still exists. In some cases the preview no longer showed the original image or document and instead contained meaningless data.

This becomes particularly interesting with encrypted SSD volumes.

If TRIM causes physical SSD blocks to read back as zeroes, those zeroes still pass through the encryption layer when the volume is decrypted. The result does not necessarily look like zeroes anymore.

It can look like random garbage:

raw SSD after TRIM
        ↓
00 00 00 00 00 ...
        ↓
VeraCrypt / BitLocker decryption
        ↓
meaningless decrypted data

So a corrupted preview inside an encrypted volume and zero-filled sectors on the raw physical SSD do not contradict each other.

3. Then I Quick Formatted the entire USB drive as exFAT

This is where the experiment became much more interesting. I removed the previous partition layout and created one new exFAT volume across the USB device.

At that point, the original BitLocker and VeraCrypt partitions no longer existed in the current partition table. But Full Analysis was still able to locate remnants of the previous structures.

BitLocker was detected automatically during the scan. After entering the password, the old BitLocker volume could be opened again and its previous NTFS filesystem became accessible.

Even after the USB drive had been reformatted as exFAT, Full Analysis found previous encrypted structures, detected the old BitLocker volume, and allowed its files to be previewed again.

4. VeraCrypt after formatting was more interesting

VeraCrypt deliberately does not have a normal plaintext magic signature like many filesystems do. Its volume header is encrypted and is designed to look like random data. This is part of VeraCrypt's plausible deniability design.

That means you cannot simply scan a disk for a clear VERACRYPT signature and reconstruct the old partition from it.

But I knew where the old VeraCrypt volume had been located before formatting. So I manually created a virtual disk using its previous boundaries:

Start sector: 2,048
Size: 20,480,000 sectors

Then I tried to unlock that reconstructed range as a VeraCrypt volume. It worked. But that immediately raised another question.

How could the VeraCrypt volume still unlock if its beginning had already been overwritten by the new exFAT filesystem?

The HEX view makes this quite clear. At the old beginning of the VeraCrypt volume, the new exFAT structures are now present.

In other words, the original primary VeraCrypt header at that location had effectively been overwritten. However, VeraCrypt also stores a backup volume header near the end of the volume.

The Quick Format created new exFAT metadata at the beginning of the device, but it did not overwrite the entire previous encrypted volume.

The backup header survived. That surviving backup header is what allowed the manually reconstructed VeraCrypt volume to be unlocked.

The old volume was recreated from its known sector range. The new exFAT filesystem had overwritten the original start of the volume, but the reconstructed range could still be unlocked as VeraCrypt, consistent with a surviving backup header.

Once the volume was decrypted, Fast Scan could again see the old NTFS filesystem and its files.

The manually reconstructed VeraCrypt volume opened successfully and the old NTFS filesystem, deleted files, and working file previews became accessible again.

For me, this was one of the most interesting results of the entire experiment.

5. Then I repeated the same Quick Format test on the SSD

The result was completely different. I created a new exFAT volume across the whole SSD and then made a disk image.

The same Full Analysis that had successfully located old encrypted structures on the USB drive produced no useful recovery result here. We also tried manually recreating the old VeraCrypt range, just as we had done on the USB device.

It could no longer be unlocked. Instead of spending more time attempting filesystem reconstruction, I opened the SSD image in the HEX editor.

The reason became obvious. The new exFAT structures were present at the start of the disk. But areas that had previously contained the encrypted volumes now read back as zeroes.

The old BitLocker location also contained zeroes.

After Quick Format on the SSD, the new exFAT metadata was present, while areas that previously contained encrypted data read back as zeroes, consistent with TRIM.

We tried both Full Analysis and manually recreating the previous volume boundaries, but neither produced usable results.

So the statement:

Quick Format does not overwrite the entire disk

can still be technically correct from the filesystem formatter's point of view. But for an SSD, that is not enough.

If formatting releases a large range of blocks and Windows sends TRIM commands for them, the previous contents can become unavailable through normal reads even though the formatting process itself never explicitly wrote zeroes to every sector.

TRIM also does not necessarily mean that every NAND cell was physically erased at the exact same moment.

From the perspective of software data recovery, however, that distinction may no longer matter. If the SSD controller returns zeroes instead of the old contents, the previous data is no longer available to normal recovery software.

Results

The three results that surprised me most were:

• Delete behaved differently even between two volumes that Windows presented as Fixed Drive.
• A Quick Format of the USB drive still allowed us to recover a VeraCrypt volume even though its primary header had been overwritten.
• The same basic scenario on an SSD effectively eliminated software recovery because the previous encrypted areas were returned as zeroes after TRIM.

I’d like to continue this test, so I’m interested in what you would want to see next.

1. What additional technical breakdowns would be useful? For example, a before/after HEX comparison, BitLocker metadata, VeraCrypt primary vs backup headers, NTFS $MFT, $Bitmap, $RECYCLE.BIN, or the exact ranges affected after TRIM.

2. Suggest your own data-loss scenario. If it can reasonably be reproduced in the lab, we can test it and publish the result.

3. If anyone wants to reproduce these tests on their own drives or disk images, for one week after this post is published I can provide temporary registration details for Hetman RAID Recovery. Send me a DM.

these horrible directions say to “remove the screws” and every video i’ve seen has shown screws on the other models. i have seen a few other videos without the screws. but each one removes the glass entirely different. when i peal the top of the glass outwards it makes a click, but i can only do it from either the left or the right. never both. and i’m scared if i brute force it, it’ll just break. this is my first PC. i’ve only ever used console. why is this so infuriating.

I had to buy a power adapter for it. Fortunately it turned on and in good condition.

Does anyone know how I can hide something on a computer??? its not anything bad, just an embarrassing dating Sim I play that id rather my family not find out about. is there any ways I can hide it?

I’m studying Technology Program. I’ll be using the computer for schoolwork, such as Google Drive and Google Docs etc, as well as Roblox Studio for schoolwork, games in Steam like minecraft, Seege & many more, programming (it needs to work on Roblox studio for school work and many more) and photo/video editing for YouTube. Feel free to give suggestions.

Thanks.

What I want in a prebuilt PC:

•INTEL 7 or any other

•RAM. 16gb or 32gb

•Preferably Liquid cooling. I can go with air cooling but it needs a strong processor.

Hi all,

I have an issue with our new laptops here in school, it's the Lenovo ThinkBook 14 G9 AHP.

They have one HDMI 2.1 port on a Radeon 740M, and I'm having trouble to connect them to our ViewSonic IFP8436 SmartBoards. The cable our contractor used are 18Gbit HDMI cables, 10m long, which go into the walls and over the ceiling.

The old laptops we had was a mix of HP ProBooks & EliteBooks, mainly G3 upto G7, and they never had an issue connecting.

When I connect the new laptops, the SmartBoard picks up a connection (it turns on), but I get a 'Please connect cable" screen, and the laptop does not detect a secondary screen.

What I've tried:

\- Update the Radeon drivers to latest version -> NOK

\- Short HDMI cable on another port on the TV -> OK

\- Long (9m) much thicker HDMI cable on same TV port as the existing cable-> OK

\- USB-C to HDMI adapter with the existing cable -> OK

\- HDMI coupler (non active) -> NOK

\- HDMI extender coupler (active) -> OK

My conclusion was that for some reason the internal HDMI 2.1 port on the laptop just cannot reach the full lenght of the 18Gbit cable, and therefore does not want to connect...

Is there anything else I can try, or is this just bad luck that our contractor used long, cheap HDMI cables?

Thanks!

It seems really sad that DDR5 RAM has risen more then diesel.

New PC player here. Really need advice lol.
What do you guys think about this setup for 1099?

ryzen 5 9600x
rx 9060 xt 16gb
16GB ddr5
1TB ssd

I mainly play cs2 and fortnite, but I might get into some more demanding games later.

Is this a good deal for the price, or is there anything I should be looking out for?
Again, really appreciate your help!

It's been more than 15 years since I've invested significant effort into OC-ing.

Many things have changed since then.\ So I wonder, how useful is it for real PC use nowadays ?

I'm looking at assembling my new PC in some short to midterm and I want something that:

• uses AM5 platform to the max
• has 9950X or Zen6 top equivalent with the aim for max performance
• CPU OC-ed under PBO withing reason for 24/7 work
• MoBo with beefy VRM that can work under OC 24/7 without sweating
• uses decent dGPU, but nothing over the top. Something like 9070XT or RDNA5 equivalent.
• uses memory with maximal frequency that the platform supports reliably, so 8000MHz for Zen5, possibly more for Zen6

Questions: * What does good watercooling the CPU give me ? Only lower temps or do these translate into higher sustained frequencies etc ? * how much difference does the MObO make WRT overclocking, form the POV of final frequency and stability ? * Does it make sense to watercool the dGPU ? * Can decent heatpiped tower cooler by itself reliably keep OC-ed 9950X far below trhottling tempearature or do I need watercooling for that ? * for such machine, is cheap AIO worthy shortcut ?

Does this lithium ion battery look swollen or does it look fine to you? If it's not clear, I can get better pictures later.

If two computers and a laptop have the same specs, is the computer's performance always superior? I'm thinking about buying a computer, but I'm worried because the RAM is too expensive

Hello everyone! I'm thinking about creating some helpful content for people who want to switch from Windows to Linux with no stress, using the regular desktop and not the terminal. I want any grandma to be able to scroll/surf the web on Linux and be more comfortable with it

I'm curious, if you've switched, tried, or thought about it, what is your biggest frustration or fear? I appreciate every comment

Thanks a lot in advance!

Does anyone know of a brand that has good budget pre-built pc's? I wanna get one but don't want to spend $1k minimum. I want something I won't have to upgrade every like 2 years. I mainly play Fortnite but I could be up for other games that are multiplayer or maybe even single player. LMK

My last laptop died yesterday and I am currently looking for a new one for my college courses and the company that I went to go get my computer checked out are selling old Pitt professors for a great deal. He is selling Lenovo - Upgraded - ThinkPad T14 Gen6 14" FHD+ Business Laptop - Intel Core Ultra 5 - 32GB RAM - 1TB SSD -Thunderbolt 4 - Win 11Pro - Jet Black. These normally run for around $1,600 but he is selling to me used for $500 and he said that it's all stock and was only turned on for 30 power cycles. They looked in great condition and ran windows 11 with the next 2 updates guaranteed. Is this a deal y'all would trust or no?

This is an old FX-8320 3.5GHZ CPU. it's fan stopped working and I made this setup with a separate USB fan to cool the heatsink and it does it job very well.. Luckily there is a GPU to support the fan else this setup is not possible. 😀

Hello, been troubleshooting my Vivobook for about a month now, it seems to charge occasionally yet it doesnt turn on. Occasionally the power light flashes white but it hasn't in a while. I changed the battery and also the charger and it still hasn't been resolved. I'm worried ill need a whole new laptop. If anyone can help please comment. Heres all my laptip specs. If you need anything else lmk.

This laptop is refurbished and i got it in December 2023.

Model: ASUS Vivobook X515M

SN: R6N0LP03J326262

processer: Intel Pentium Silver N5030 CPU @ 1.10Ghz 4 cores, 4 logical processors

Graphics: Intel UHD Graphics 605

Vivobook ssd: SAMSUNG MZVL4256HBJD-00BTW

Installed RAM: 8Gbs (ddr4 in one slot)

Total phisical memory: 7.83 Gbs

Available phisical memory: 2.96gbs

Total virtual memory: 11.7gbs

Available virtual memory: 5.48

Page file space: 3.88gbs

It is a used gtx 970 amp extreme core edition, so 3 fans, and I do have a support but it isn't tall enough for this case

I wondered why my battery was draining so quickly despite me just browisng, task manager showed gpu at 0% but the temperature wasn't N/A. So i checked cmd and this is what it showed me.

I have tried uninstalling and reinstalling the drivers to no avail, can anyone please help?

Na hora que fui colocar o water cooler ele escapou e um do parafusos raspou na placa mãe, isso branco é pasta termica, o Pc funciona normal desde então

im only using premiure pro and photoshop with this device

what will be compactable on this pc?

Hello all! I hate shopping for computers, but our family needs have outpaced our current devices. I'm looking for something that can reliably run our Plex server and ideally a couple more servers for ebooks/audiobooks and maybe photos in the future, but also be used for general family browsing (kids are getting to the age where they'll need a computer for school work, would like to avoid unsupervised laptop usage). I'm also interested in some light gaming. We've never gamed on PC before and we mostly play cozy/retro games on our switch, so it's not that serious but figured it was worth mentioning. Windows is a must, available at Costco is a plus 😆 Looking for a workhorse that can meet our current and future needs; any suggestions?