Recover old Data after Format??

Once the bits on a drive have been changed there is no way to tell what they were previously. i.e. in answer to your question, no.

If he has formated the drive and installed the OS it may still be possible to find data that was not overwritten however. Use a program like File Scavenger to look for these files.

<A HREF="http://www.anandtech.com/myanandtech.html?member=114979" target="_new">My PCs</A> :cool:

he might find the "names" of the files that used to be there, but the actual files (the content) are gone for good.

..this is very useful and helpful place for information...

Data on a hard disk is only removed when the status of the bits is changed. Formating doesn't do that, it just clears out the FAT or $MFT and leaves the data intact on the disk, but writing new data does. So if he had 40GB of files on the disk, fomated it and installed 1.5GB of OS then there should still be 38.5GB of files on the disk, most of which should be recoverable with programs like File Scavanger that search the disk for file structures.

<A HREF="http://www.anandtech.com/myanandtech.html?member=114979" target="_new">My PCs</A> :cool:

If formatting a hard disk only changes the FAT then why does it take so damn long to format a drive?
(Not particually relevant but I was just wondering)

<font color=blue>P4c 2.6@3.25
512Mb PC4000
2x120Gb 7200.7 in RAID0
Waterchill KT12-L30
Abit AI7
Radeon 9800Pro
</font color=blue>

It doesn't. If you do a quick format of a drive it will take a very short about of time. A full format checks the drive for bad sectors and marks them as unavailable in the FAT.

<A HREF="http://www.anandtech.com/myanandtech.html?member=114979" target="_new">My PCs</A> :cool:

I think we have issues with Microsoft  

<A HREF="http://www.computerhope.com/formathl.htm" target="_new">PS</A>: "<b>Format is used to erase all of the information off of a computer diskette or fixed drive.</b>"

"<b>When using the format command remember all information the drive you wish to format will be completely erased.</b>"

PSS: if FAT is killed, how can you find peices of the file if addresses to them are lost without restoring FAT? And how can you restore the FAT if there was another FAT written over it after format and windows install? What "file" holds the old FAT infarmation when new FAT was created?.. etc.

PSSS: just curious  

..this is very useful and helpful place for information...

Files written to a hard disk have lots of information contained within them that indicate where the file starts, where it ends, what sort of file it is, it's file name etc. everything in fact to make that file useable. The FAT is merely a directory that the hard disk uses to keep track of files, without a FAT the hard disk would have to search the entire disk looking for your file. Naturally just looking something up in a directory and going straight to the start cluster is much faster than searching every cluster for the file. The file recovery software simply searches the entire hard disk for file structures it can recognize and creates its own software index. You then recover these files to a different hard disk where they are written as normal.

Partition recovery software works along a similar line. Partitions contains start and end markers, information about how big they are etc. The software just searches for these and rewrites the partition table according to what it finds.

<A HREF="http://www.anandtech.com/myanandtech.html?member=114979" target="_new">My PCs</A> :cool:

very well explained.
btw, just recently I have recovered files from a reformatted harddrive - the thread is called "Help - Im Stuck" and it's in this secrion of the forum.

Not the Official Sicko of THG.

heh, so, when I format FAT32 drive into NTFS it still can be restored as FAT32 (or back)? And still, if format is not "formatting" how can I kill the files so no body can find them ever? Scratch the surface of the drive itself?

..this is very useful and helpful place for information...

You can recover data from a FAT32 drive that has been formatted as NTFS yes. You will loose some data though because NTFS doesn't use a FAT it uses a Master File Table ($MFT) which will use up difference disk space to the FAT.
Formatting is formatting, formatting means setting up the drive in a clean format so the drive will write to all good clusters on the disk. If you want to permanently erase files you can do a low level format (rewrite all bits as 0) or use one of the numerous permanent erase utilities such as Norton WipeInfo which will rewrite the portion of the disk that contained the file with 0 s.

" About Wipe Info

Wipe Info Wizard erases files or folders from your hard disk so that they cannot be recovered.

When you wipe a file, Wipe Info wipes the file and attempts to wipe any free space that is associated with the file and the file's directory entry.

When you wipe a folder, Wipe Info wipes all of the files in the folder, and then, if the folder is empty, it attempts to wipe the directory entry for the folder.

In general, you cannot recover files that have been wiped. Windows Me/XP System Restore can restore files that have been wiped if they are one of the protected file types. By default, many document types, such as .doc and .xls files in My Documents, are protected. Windows Me/XP System Restore maintains copies of protected files. Wiping the original file does not wipe the copy that Windows Me/XP System Restore maintains.

Wipe Info eliminates a file's contents from the disk, but does not remove the file name. While the file name remains on disk, it is no longer visible in Windows Explorer, and there is no data stored with it. On NTFS volumes, streams (alternate data that belongs to a file but is not stored with the file) are also wiped.

Never store sensitive information in a file name or attribute. This data can be replicated throughout your system without your knowledge, for example, in a list of most recently used files, or a file name search. This type of embedded information can be very difficult to remove from your computer. "

<A HREF="http://www.anandtech.com/myanandtech.html?member=114979" target="_new">My PCs</A> :cool:

Last question (at this point;), will Evidence Eliminator do the job better than Wipe Info? Caz I can see the Wipe thingy is not removing the "whole" thing from the disk (name of the file remains), but EE claims that it does? I am on sensitive info all the time in my laptop, so was wondering if I looze it, no body can see what was deleted after I send the files back to home and delete the copies.

..this is very useful and helpful place for information...

I don't know any more than you about "Evidence Eliminator", it looks like one of those programs porn sites advertise. Under computer misue legislation you should not be using your computer for non-authorised activity anyway and nor should anyone else for that matter. To do so opens you or them up to potential prosecution. Files on your hard drive can be secured against non-authorised access by storing them in an encrypted NTFS partition or folder.

<A HREF="http://www.anandtech.com/myanandtech.html?member=114979" target="_new">My PCs</A> :cool:

Thanks for the great info....

I did find a program called R-Studio it allowed me to see previous files that were on the HD and probably existed since a few formats. The demo lets you recover up to 68k of data at a time.

Http://www.r-studio.com



Want to make some extra income reading emails? goto www.maldacai.150m.com and get a Free 7 Day Course<P ID="edit"><FONT SIZE=-1><EM>Edited by maldacai on 06/09/04 02:02 PM.</EM></FONT></P>

Well i already faced that kind of problem few month ago when i went to my uncle marriage anniversary. My neighborhood son peter formatting my E: drive and install windows xp os. When I reached home and check pc i lost every important data from E: drive and found a new windows os in it, now what to do even i confuse.

To resolve this problem i went to the cybercafe for searching & collecting information over how to recover lost data from formatted partitions, I found Recover Data web site & try to contact with them. They said "my partition is not overwritten, it just formatted" and send me a link of there software http://www.windowsdiskrecovery.com/windows-partition-recovery, i download & run the demo software in healthy drive & scan formatted E: drive, it shows all my lost files & folder in front of me. I fully satisfied with the demo software results & decided to purchase the full featured software in USD69

so, as you have the same problem i suggest you download the demo software from here: http://www.windowsdiskrecovery.com/windows-partition-recovery and scan your full hard drive. I hope its work for your need

John Methew
United States

^ And anyone who believes that probably has an IQ smaller than their shoe size.

If you most use SPAM to advertise your products, at least try and make it believable (and learn English!).

Actually, I encountered the similar problem, too.
My problem is like this: I have a Western Digital 1TB hard drive with 2 partitions: one for system programs and one for important data. However, last night, my little cousin had formatted the partition for data. I did not know why. As I was aware of it this morning, I had already pasted some new data on this partition from my flash drive. What could I do to take my data back? I also could use these recovery tools recommended above?

http://www.cgsecurity.org/wiki/TestDisk

Failing that for $1,200 or more using magnetic force microscopy you can actually tell what the bit patterns were for not just the last overwrite but the last seven or more overwrites.

Actually, last week, I also got the similar problem. I remembered I tried a trusted format drive recovery freeware recommended by my brother. It was totally fantastic. I still could record that it offered four recovery options to choose from. Naturally, I selected the “Format Recovery” option according to their names. In short, now, I have recovered all of my important data. You should have a try.

Thank you so much for your instruction of format recovery.

I formatted my 1TB western digital external disk by mistake when it asked me to format it. It shows RAW and I did not know what happened to the disk. I stored many family photos on the disk including my daughter's 1 year to 5 years old photos. I was desperate when I formatted it and the 1TB disk shows 0 byte.

Thank you thank you thank you for your help.

I followed the url you advised, downloaded the software, install it on my laptop and get the 1TB disk connected as external drive. I ran FORMAT RECOVERY, there I got all lost photos.

Thank-you for the advice and the link. Best £40 I've spent in a long time After keeping the offending SD card safe for two years (after running a deleted file scan on it and coming up with nothing) file savenger has recovered my little boy's last primary school production and his leavers assemly. Now safely stowed.

i dont think data overwritten can be recovered.. but you can get the not overwritten part back. try minitool power data recovery. it has the free version. sorry for the already overwritten data.