hard drive - Why can data be recovered after formatting?

09
2014-02
  • cantsay

    If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN, and why are multiple passes ever required?

    • Answers
  • Alex McKenzie

    It used to be possible by reading the residual magnetism left by the previous bit. This isn't so much of an issue now that the tracks and bits that hard drives write are so small. It is almost impossible to recover any meaningful data off of a zeroed drive with modern disks.

    EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.

    That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.

    So it's best to use a tool like DBAN to at least do one pass if you want to make sure data isn't recoverable. And if you're doing one, why not a few more for fun!


    • Related Question

    recovery - How can I recover XFS partitions from a formatted HD?
  • giuprivite

    I deleted the partition table of my HD. I wanted to format another one, but by mistake, I formatted the wrong one. Then I also created some new partition on it. Now I would like, if possible, to recover my old data. The old configuration was this:

    A primary NTFS partition with Windows, and a secondary partition with four logical partitions: a swap and three XFS partitions (two for Ubuntu and OpenSuSE, and one with the home for both systems).

    This is the output I get when I run gpart in a terminal:

    ubuntu@ubuntu:~$ sudo gpart /dev/sdb

    Begin scan...
    Possible partition(Windows NT/W2K FS), size(39997mb), offset(0mb)
    Possible extended partition at offset(39997mb)
    Possible partition(Linux swap), size(8189mb), offset(39997mb)
    Possible partition(SGI XFS filesystem), size(40942mb), offset(48187mb)
    Possible partition(SGI XFS filesystem), size(40942mb), offset(89149mb)
    Possible partition(SGI XFS filesystem), size(175044mb), offset(130112mb)
    End scan.

    Checking partitions...
    Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
    Partition(Linux swap or Solaris/x86): logical
    Partition(Linux ext2 filesystem): logical
    Partition(Linux ext2 filesystem): orphaned logical
    Partition(Linux ext2 filesystem): orphaned logical
    Ok.

    Guessed primary partition table:
    Primary partition(1)
    type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
    size: 39997mb #s(81915360) s(63-81915422)
    chs: (0/1/1)-(1023/254/63)d (0/1/1)-(5098/254/51)r

    Primary partition(2)
    type: 015(0x0F)(Extended DOS, LBA)
    size: 265245mb #s(543221849) s(81915435-625137283)
    chs: (1023/254/63)-(1023/254/63)d (5099/0/1)-(38912/254/2)r

    Primary partition(3)
    type: 000(0x00)(unused)
    size: 0mb #s(0) s(0-0)
    chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

    Primary partition(4)
    type: 000(0x00)(unused)
    size: 0mb #s(0) s(0-0)
    chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

    Looking the first eight lines, it seems the data are still there... but I don't know how to recover them. I have a free second HD of about 500 GB (the formatted one is 320 GB) that I can use for the recovery process.


    • Related Answers
  • cbz

    gpart -W won't work, as it'll write out the new partition table that is being displayed after the first eight lines - which is in fact the new partition table. TestDisk is an alternative that will allow you to select the partitions that then want restoring.

  • rems

    FIRST, do a copy of your hard disc to your free one, I think the best option would be to do read dd man page and then copy the disc

    man dd
dd if=/dev/sda of=/dev/sdb

    assuming /dev/sda is the old one with data and /dev/sdb is the new empty one.

    SECOND, use devices from /dev/disk/by-id/* . This way you could avoid errors.

    THIRD, remove the newly created partitions, so the found ones can be rewritten to the partition table. Use parted or fdisk.

    FOURTH, read ALL the gpart mnan page, specially the "-W" option

    man gpart
sudo gpart -W /dev/sdb

    Hope this helps. But you have a backup, don't you?