Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

If You Re-Format Your HD, Does The File Recovery Memory Go Away?


  • Please log in to reply
6 replies to this topic

#1 Terminus1

Terminus1

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 18 September 2014 - 03:19 PM

There is a record of everything you deleted on your computer and a lot of that is able to be recovered with the proper software. What I am wondering is, if I re-format my hard drive, delete everything and re-install the OS, would there still be a record of previous files on my HD? Like if I used a file recovery program, would files I had on it before still be there to recover?



BC AdBot (Login to Remove)

 


#2 kokomodrums

kokomodrums

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Indiana
  • Local time:01:15 AM

Posted 18 September 2014 - 03:28 PM

There isn't a "record" of everything deleted. When you delete a file, Windows doesn't actually delete that data off the hard drive. What it does is make a note that the space that the file takes up is now considered empty. Eventually, Windows will write new files over that space on the hard drive. But if you use a file recovery program before Windows writes over that file, you can recover the file (because the file is still there, it's just "hidden" from Windows essentially).
 
Here's a metaphor that might help explain it better:

 

Say you have a restaurant (hard drive), and a customer (file) reserves a table (space on the hard drive). The customer sits down (file is stored) at their reserved table (space on the hard drive). A few minutes later you decide to cancel their reservation (delete the file). For example, their credit card was declined etc. You could go and remove them from the table (wipe the file off the hard drive), but the manager (Windows) decides it's easier to just let them stay until another customer (another file) comes who wants that table. The table is still occupied, but it is no longer considered "reserved", and if another customer wants that table they will get it right away (the first file will get overwritten by the new file).
 
Let's assume your file recovery software is a detective. The detective is looking for the first customer (a deleted file). The detective knows that the customer might be at the restaurant (on the hard drive) but not on the "reserved" list (marked as "empty" by Windows), so he checks every table. The detective can find the customer (if he is still there) even though the customer is not on the reservations list, because he is allowed to check every table (file recovery software can see files that are marked as empty). However, if a new customer came in and reserved the table (a new file has overwritten to first file), the first customer has already been asked to leave (overwritten) and is no longer in the restaurant (on the hard drive).

 
Phew, that was a much longer metaphor than expected, but hopefully it helps someone someday understand file recovery better :P
 

When you format a hard drive, you aren't actually wiping the whole drive. You are just "marking" the whole drive as empty (imagine removing everyone in the restaurant from the reservations list). Most of the actual data will still be on the drive (you don't make the customers leave), but again, it will be marked as "empty space" now (all tables can be reserved by new customers). When you install Windows, you are writing the Windows operating system files to the hard drive, so it will override any files in that area of the hard drive (new customers are replacing old customers). But the rest of the drive will be untouched. So in that scenario, there is a chance of recovering some files.
 
There is no guarantee, however, that at any point in that process you can recover any files. Basically, don't rely on the fact that a deleted file is recoverable. Always assume it's unrecoverable, and use a better backup system next time.
 
Hopefully that answers your question!


Edited by kokomodrums, 18 September 2014 - 03:50 PM.

-- Matt


#3 MasseyMan65560

MasseyMan65560

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:01:15 AM

Posted 18 September 2014 - 03:32 PM

So in short f you need those files stop using the hard drive, take it out of your tower and find professional help

#4 Terminus1

Terminus1
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 18 September 2014 - 05:36 PM

Thank you for the help, I am just concerned because I want no record of previous files on my computer, I wanna get rid of it all. I know of a File Recovery tool that I have used before, I suppose I could test it with that after I re-install windows and wipe my hard drive. 



#5 kokomodrums

kokomodrums

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Indiana
  • Local time:01:15 AM

Posted 18 September 2014 - 06:11 PM

You need to completely wipe all the data off the hard drive. A simple Windows format won't do the trick. If you are comfortable with burning an ISO file to a CD and booting from a CD, you can use the DBAN boot disk to completely wipe the hard drive. If you are still paranoid, you can try a file recovery software afterwards to double check.

 

You can download DBAN for free from http://www.dban.org/download. The file is an ISO, you need to burn in to a CD (you can use a free program like ImgBurn: http://imgburn.com/index.php?act=download) or to a USB drive (you can use a free program like Rufus: http://rufus.akeo.ie/). Boot the CD/USB drive and follow the instructions in the article below to securely wipe all data from your hard drive: http://www.sevenforums.com/tutorials/233819-darik-s-boot-nuke-use-secure-wipe-hard-drive.html

 

Please make sure to remove any other hard drives/external drives in the computer when you run DBAN unless you are 100% sure you know what you are doing, otherwise you may risk wiping a drive you didn't mean to! That includes USB/eSATA/Thunderbolt/etc. drives. Any device that has data on it!


Edited by kokomodrums, 18 September 2014 - 06:11 PM.

-- Matt


#6 MasseyMan65560

MasseyMan65560

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:01:15 AM

Posted 18 September 2014 - 06:49 PM

If it was anything to illegal online you can still be caught. iP addresses and MAC addresses. You can claim somebody used your WiFi but your MAC address is for 1 certain device which is actually your Network card in your computer. So any Wifi adapter or internal wifi card etc etc etc. and that won't change on a reformat. Granted there. gift not be evidence on your hard drive but any site you may of went migtpht have a record of,it
If it was some movies off some P2P site chances of anybody coming after you are very very very very slim.

Edited by MasseyMan65560, 18 September 2014 - 07:18 PM.


#7 kokomodrums

kokomodrums

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Indiana
  • Local time:01:15 AM

Posted 18 September 2014 - 07:21 PM

Consumer grade routers don't track network activity, so your MAC address won't give you away. And only your internal networking gear would know your MAC address, websites only get an IP address. Even if your router was tracking your activity, you could argue that someone was on your WiFi and spoofed your MAC address. This is a pretty easy task for a competent network hacker.

 

I like that you jumped to the conclusion that he was up to no good haha  :wink:


Edited by kokomodrums, 18 September 2014 - 07:23 PM.

-- Matt





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users