Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Recovering formatted Drives?


  • Please log in to reply
10 replies to this topic

#1 Threesom666

Threesom666

  • Banned
  • 131 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 22 July 2017 - 04:46 AM

Ive heard several theories on that nothing is ever really deleted on a drive. The other that no matter how many times you formatted it you can recover information. Yet every recovery software I've ever used is weak. Is any of it true or just propaganda? My personal hard drive(IDE) that I've had forever Ive had to format several times because stupid toshiba didnt bring its windows disc and since I didnt know much about computers I always thought that formatting it and reinstalling its operating system was the way to go recover from viruses and pc errors. But then I read and have heard that you can always recover that even if youve used that hard drive to the ground and reformatted it several times. Though whenever I use a recovery software it barely recovers anything. Do the recovery centers where it costs several thousands of dollars have the ability to recover all that data as well?
 


Edited by hamluis, 22 July 2017 - 05:07 AM.
Moved from External Hardware to Backup/Imaging - Hamluis.


BC AdBot (Login to Remove)

 


#2 Just_One_Question

Just_One_Question

  • Members
  • 1,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:10:30 PM

Posted 22 July 2017 - 07:32 AM

Formatting/deleting data on a hard drive or most other digital data storage doesn't completely vanish the files, but just marks the 'spots', so to speak, where the files were located on the hard drive as being free for an overwrite. This means that any data is not truly deleted and gone until you save something on that hard drive's space where the previous files were located. As long as the hard drive hasn't been overwritten, you can recover most of the data that was supposedly deleted/formatted. A super-cheap and hill-billy way of erasing your data forever is to format your hard drive and then overnight to download as much 4K movies over wi-fi as possible, so as to fill your space to the brink. If anyone were to then try to recover your hard disk's data, they'd only find the 4K movies. Hope this clear things up!:)



#3 Platypus

Platypus

  • Global Moderator
  • 15,808 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:06:30 AM

Posted 22 July 2017 - 10:05 AM

It depends on how a drive is formatted. Considering Windows, prior to Windows Vista, using either a Quick or Full format did not alter the stored data on the drive. The Quick format rebuilt the filesystem metadata files to represent the drive as empty, with all the data area of the formatted volume marked as available for storage. The Full format also did an integrity check of the volume, reading all sectors and performing a Cyclic Redundancy Check. In both cases the original contents of the data area remains intact, and can potentially be recovered as files by recovery software. As new data is written to the drive, it progressively overwrites these locations, and where overwritten, if recovery software "recovered" those locations, the contents of a previous file that was there will no longer be there. What is there now would be "recovered".

From Windows Vista onward, Quick format works the same, but a Full format will zero fill the user area of the volume being formatted. Because every sector of the formatted volume is overwritten, again the data that was previously there has been replaced, and software, including manually operated software like hex editors, can only return nulls from these locations. This will achieve basically the same results as filling the drive with alternative files.

However under laboratory conditions with the right equipment and techniques, it can be possible for the remnants of prior data on the drive to be seen, but it is not an easy thing to do by any means, and is a very costly process. So for many applications, a zero fill, either from a Full format or a third party wiping utility, is adequate since no-one will take those measures with a random old hard drive.

If someone wants a high degree of certainty that laboratory recovery will not succeed, apart from physically destroying the drive it can be put through a degausser, or given multiple pass wipes. Even though multiple pass wiping was developed for older drive types and may no longer deliver predictable results with modern ones, an organization that has to comply with regulations may still need to perform a particular standard of multi pass wipe.

Edited by Platypus, 22 July 2017 - 10:08 AM.

Top 5 things that never get done:

1.

#4 RolandJS

RolandJS

  • Members
  • 4,552 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:01:30 PM

Posted 23 July 2017 - 11:36 AM

Also consider this:

Have you seen either version of San Andreas movies?  No, watch it once.

Yes?  Recall that before the Big Event, the Big Upset, families lived in homes that were identified by resident names & numbers, street signs & street names, USPS infrastructure, and so on.

Now, after the Big Upset, the Big Event, within the affected areas, there are no house numbers, no more street signs, practically no more houses.  Families are no longer labeled by names on mailboxes.  Many if not most Individual family members are scattered all over the place, wandering aimlessly or perhaps heavily bunched up in various shelters.  Now your task:  go find them, person by person by person, reGroup them.

In a way, your one file is similar to a building violently brought down and somewhat scattered.  Your task will be to rebuild that structure enough to pull out furnishings and belongings that are recoverable.


Edited by RolandJS, 23 July 2017 - 11:47 AM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#5 Just_One_Question

Just_One_Question

  • Members
  • 1,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:10:30 PM

Posted 23 July 2017 - 01:49 PM

Nice analogy, RolandJS.:thumbup2:



#6 Threesom666

Threesom666
  • Topic Starter

  • Banned
  • 131 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 28 July 2017 - 10:51 PM

But thats also my question even if its overwritten several times, several times formatted. Ive heard that you can recover files. That nothing is ever ever deleted.



#7 RolandJS

RolandJS

  • Members
  • 4,552 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:01:30 PM

Posted 29 July 2017 - 09:46 AM

"...I've heard that you can recover files. That nothing is ever ever deleted..."

If you have infinite patience, almost unlimited time, calm energy, and $50-$100K worth of sector sensing hardware and software, you can wade through a hard-drive, sector by sector, similar to wading foot by foot through a San Andreas-Event-flooded Los Angeles, and recover some anonymous, unlabeled, unknown origin, unknown order, bits and pieces of data.  Turn off CSI, FBI, NCIS TV :)  and visit a live, real, police lab and let them tell you how data recovery really works.


Edited by RolandJS, 29 July 2017 - 05:51 PM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#8 malwaredpc

malwaredpc

  • Members
  • 141 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 AM

Posted 29 July 2017 - 01:17 PM

When a file is deleted, it means  that the OS marks it as space that can be used whenever wanted, That is a logical deletion. The data is still on the HDD until it is written again.

Formating as quick formatting will set the entire space of the partition to be used whenever wanted. With full format, all the sectors will be written with zeros (sectors can have zeros or ones). Therefore, the data can't be recovered with traditional methods and there is a need for more sophisticated methods.

But thats also my question even if its overwritten several times, several times formatted. Ive heard that you can recover files. That nothing is ever ever deleted.

Which format type? quick one? Read above.

To safely delete files there are various methods but all relies on writing zeros to the area three times. It can't be recovered after that. (note that I am talking about HDDs)


Edited by malwaredpc, 29 July 2017 - 01:18 PM.


#9 Threesom666

Threesom666
  • Topic Starter

  • Banned
  • 131 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 29 July 2017 - 02:35 PM

what about the popular sophisticated couple of grand recovery that some companies offer? I suppose that some law enforcement use. Even after being fully formatted several times. Ive gotten the idea that its always recoverable. I am talking about hard drive.



#10 malwaredpc

malwaredpc

  • Members
  • 141 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 AM

Posted 29 July 2017 - 03:23 PM

what about the popular sophisticated couple of grand recovery that some companies offer? I suppose that some law enforcement use. Even after being fully formatted several times. Ive gotten the idea that its always recoverable. I am talking about hard drive.

As I said, not happening wiping it with three passes per sector and I am not talking about formating.



#11 RolandJS

RolandJS

  • Members
  • 4,552 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:01:30 PM

Posted 29 July 2017 - 05:51 PM

See post number 7  :)


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users