Hello people. My forensics teacher tokd me once that you can unformat the deive - just type unformat in cmd and it's done. But, my friend gave me his old (well, a year/2 old, not really that old) hard drive. Right now I'm formattijg it in Ubuntu on DVD, full formatting. As I saw that some space goes to nowhere, unallocated space, I canceled the formatting, and now just am trying to format, but as I was in a hurry, I didn't put it to format as ntfs, though it shouldn't be a problem to do a quick format to make it usable by Windows. However, what if I wanted to unformat it, later, in Win? Could I unformat as Linux fs only, or could go as far as the day it was bought?
How many times can you "unformat" the hard drive?
- Thread starter miha2
- Start date
Solution
- Oct 15, 2014
- 18,032
- 2,337
- 101,590
you can format and reformat all you want. the drive does not really care as it is the OS that needs it to be formatted correctly.
the format and quick format still leaves the data on most of the drive but "forgets" where it is. to truly clean the drive of all data (what i think you mean by unformat) you have to write the drive to zeros. there are many programs that can do this and but i don't think the windows installer has this as an option, it'll have to be done another way. this will take every bit on the drive and write over it one at a time. some programs will do this more than once to ensure there is not a single bit of data left on the drive to be recovered. it will write all 0's, then 1's then 1,0,1,0,1,0.... etc until there is nothing left but random nonsense.
this is the only way to make the drive like it came out of the box with nothing on it at all.
the format and quick format still leaves the data on most of the drive but "forgets" where it is. to truly clean the drive of all data (what i think you mean by unformat) you have to write the drive to zeros. there are many programs that can do this and but i don't think the windows installer has this as an option, it'll have to be done another way. this will take every bit on the drive and write over it one at a time. some programs will do this more than once to ensure there is not a single bit of data left on the drive to be recovered. it will write all 0's, then 1's then 1,0,1,0,1,0.... etc until there is nothing left but random nonsense.
this is the only way to make the drive like it came out of the box with nothing on it at all.
No, what I mean by unformatting is imagine this situation:
You bought a new drive. You want it to be working, so you... do a quick format. Then you want to give it to some nooby friend who doesn't know anything about computers, just knows how to play Miniclip games, at most. Or copy videos/pictures. So, you give him your old hard drive, but before that, you format it. Then, after some time, your friend gives the same drive to another friend, who is good with computers, and that friend formats it too. So, can the "3rd friend" find any or all information you had on that drive? After 2x format. With the "unformat" command in cmd.
You bought a new drive. You want it to be working, so you... do a quick format. Then you want to give it to some nooby friend who doesn't know anything about computers, just knows how to play Miniclip games, at most. Or copy videos/pictures. So, you give him your old hard drive, but before that, you format it. Then, after some time, your friend gives the same drive to another friend, who is good with computers, and that friend formats it too. So, can the "3rd friend" find any or all information you had on that drive? After 2x format. With the "unformat" command in cmd.
Barty1884
Retired Moderator
- Apr 16, 2015
- 22,250
- 1,350
- 108,740
From your description, I think what you're trying to ask, is whether it's possible to 'undo' a format of an HDD (or in your scenario, numerous formats).
Essentially, yes. You can recover data from a drive that has been formatted. As Math Geek stated, formatting doesn't so much 'wipe' the drive, it just makes the drive 'forget' where the information was stored.
Recovery can be performed (infact, there are numerous tools available to do so) after 1x format (quick or full).
Where it would get difficult would be when information is written over top of a formatted drive.
For example:
You have a 50GB HDD (for simplicity - and also for your nooby friend from the early 00's
). You format the drive. At this point information could easily be recovered If, after the drive was formatted, you transferred 50GB of data to the drive, it will be written over top of the prior information (that the HDD 'forgot' how to read/assemble).
It doesn't mean it's not possible, but data recovery becomes more & more difficult after you write data to the drive after formatting, not so much the formatting itself. You could format repeatedly and the data would still be recoverable in the right hands.
So you want to say that formatting isn't the best option?
And also, I will copy a lot of files onto that another hard drive, I want to free up my primary hard drive
About a friend. Imagine this, not everybody I know knows enough information to format and "undo" format. I mean, what else unformat can mean? Or you want to say you are stupid enough not to follow your own words that my teacher can't be old enough to be a good computer teacher?
I mean, you say that, pretty much, everybody in the world (or all right, let's be not THAT global; US) has to know everything about computers. But if so, everybody should know that it's not "unformat", it's "undo format".
Yes, my teacher is 60+ and he is good about computers. But nobody's perfect, and if somebody is wrong, you shouldn't show off that you are the smartest here on the forum. Instead, show where I am wrong, so I didn't repeat the mistakes.
And also, I will copy a lot of files onto that another hard drive, I want to free up my primary hard drive
About a friend. Imagine this, not everybody I know knows enough information to format and "undo" format. I mean, what else unformat can mean? Or you want to say you are stupid enough not to follow your own words that my teacher can't be old enough to be a good computer teacher?
I mean, you say that, pretty much, everybody in the world (or all right, let's be not THAT global; US) has to know everything about computers. But if so, everybody should know that it's not "unformat", it's "undo format".
Yes, my teacher is 60+ and he is good about computers. But nobody's perfect, and if somebody is wrong, you shouldn't show off that you are the smartest here on the forum. Instead, show where I am wrong, so I didn't repeat the mistakes.
- Oct 15, 2014
- 18,032
- 2,337
- 101,590
yes it is possible to still recover data after a couple of formats (with or without the use of the unformat command). if the first friend (the noob as you describe him) puts little data onto the drive if any, then your data is still there and has not been written over. the third person it is passed to could indeed recover your old data if it has not been written over yet. now if your friend filled the drive up then your old data is now gone and replaced with your noob friends stuff. so the third person can recover this second data in this case.
the only way to be sure your data is gone is to use one of these programs we have spoke of to clean the drive before you pass it on. this is always the best idea as you just never know what someone down the line may or may not do with the drive. a simple program that will wipe all the data is something like
http://eraser.heidi.ie/
there are many more out there but this one is pretty simple and free as well. again the ONLY way to be sure your data is good and gone is to wipe it this way. the format no matter how many times won't remove it until it is overwritten by something else.
think about a library card catalog (the old school index card type ones from when i was a kid) it lists all the books in the library and where they are on the shelf. if you came in and took this catalog away and nothing else, what happens to the books? right they are still there it's just gonna be hard to find anything. this is what formatting does. it removes the catalog and sets up a new one but leaves the books there until it needs the space for something else. "unformating" would simply take the new catalog away as well. the books are still there no matter how many times you put a new catalog in place or take it away. not until the book is taken away and a new one put in it's place, will the book be gone. this is how your data is treated. it stays until the os needs that spot for something else. there is no telling when or how it decides where to put stuff on the shelf. the eraser program will go in and remove all the books and burn them leaving the shelves totally empty and waiting for a new book to take it's place.
i hope this kind of clarifies your question and our answers.
the only way to be sure your data is gone is to use one of these programs we have spoke of to clean the drive before you pass it on. this is always the best idea as you just never know what someone down the line may or may not do with the drive. a simple program that will wipe all the data is something like
http://eraser.heidi.ie/
there are many more out there but this one is pretty simple and free as well. again the ONLY way to be sure your data is good and gone is to wipe it this way. the format no matter how many times won't remove it until it is overwritten by something else.
think about a library card catalog (the old school index card type ones from when i was a kid) it lists all the books in the library and where they are on the shelf. if you came in and took this catalog away and nothing else, what happens to the books? right they are still there it's just gonna be hard to find anything. this is what formatting does. it removes the catalog and sets up a new one but leaves the books there until it needs the space for something else. "unformating" would simply take the new catalog away as well. the books are still there no matter how many times you put a new catalog in place or take it away. not until the book is taken away and a new one put in it's place, will the book be gone. this is how your data is treated. it stays until the os needs that spot for something else. there is no telling when or how it decides where to put stuff on the shelf. the eraser program will go in and remove all the books and burn them leaving the shelves totally empty and waiting for a new book to take it's place.
i hope this kind of clarifies your question and our answers.
The top part is exactly what I wanted to read.
Now, about your library card. Even though it is a pretty good, it's not perfect - you say the 3rd friend can recover only my friend's data, but not mine, assuming he copied bunch of stuff. But if you replace the library card, all the books are still there. Though I'm not going to show off. Thanks for the help, everybody.
P.S. As the same teacher said, the best way to make sure nobody can find the data on your hard drive, is to throw the hard drive in the lake and never tell angvody which lake.
P.p.s. I will overwrite data, and may fill up the entire 2nd drive, so... it should be all good.
Now, about your library card. Even though it is a pretty good, it's not perfect - you say the 3rd friend can recover only my friend's data, but not mine, assuming he copied bunch of stuff. But if you replace the library card, all the books are still there. Though I'm not going to show off. Thanks for the help, everybody.
P.S. As the same teacher said, the best way to make sure nobody can find the data on your hard drive, is to throw the hard drive in the lake and never tell angvody which lake.
P.p.s. I will overwrite data, and may fill up the entire 2nd drive, so... it should be all good.
Facebook
Twitter
Instagram