data recovery get quote

What effect does formatting a hard drive have?

Low level formatting is normally done by the manufacturer of a hard drive to dictate how and where the data is stored on the disk and prepare that disk for initial use. The process also creates the new file system. This is not to be confused with partitioning, which makes the device visible to the operating system. Lastly, high level formatting (sometimes referred to as 'quick formatting') is used to prepare the drive ready for use.

A computer is not able to replicate this low level format although it is often assumed that it can. Low level formatting is performed directly against the disk sectors , skipping the file system layer and working directly with the underlying storage. A genuine low level format should render any data unrecoverable. The binary code on your hard drive is represented by either a positive or a negative magnetic represented as a 1 or a zero. Low level formatting writes zeros across the disk, therefore rendering any data unrecoverable.

However, users often assume they have completed a low level format when actually they have not and we often find data recoverable after an 'alleged' low level format. As a general rule, when a user formats a hard disk drive some or all of the data is recoverable with special tools. Although many utilities and secure erasure software claim to complete a low level format - as we have already discussed, the hard drive is simply not able to complete the kind of format that is completed at the factory. To actually "erase" everything requires overwriting each block of data on the medium; something that is not done by many formatting utilities.

Recovering data from a user formatted disk requires specialist tools and software but is often successful. This is because most utilities do not overwrite every single bit of data with a zero, which is extremely time consuming and stressful for the drive. As an example, when we image a 1TB hard drive and read every single bit of data from the first sector to the last, this can take many days and how many users would wait that long to reformat their hard drive? Hence the formatting process often skips vast areas of the disk surface and simply marks these data areas as 'available' for reuse and removes the pointer to that particular file.

If the disk is formatted with a different file system, more of the data may be overwritten or 'scrambled', but is still recoverable . However, under some file systems (e.g., NTFS, but not FAT), the file indexes (such as $MFTs under NTFS, inodes under ext2/3, etc.) may not be written to the same exact locations. And if the partition size is increased, even FAT file systems will overwrite more data at the beginning of that new partition. It is commonly known in the industry that to securely erase the contents of a hard disk drive, a series of 35 passes across the hard drive must be used - known as the Gutmann method. Some people have claimed that completely overwritten files can be recovered by detecting the previous value of bits on the affected area of the media. However there is no evidence to support this and even if possible, it would not be economically viable.