How Formatting Works

Today’s data recovery tools have no problem recovering your data from a recently formatted hard drive or memory card. If you are following our publications, you may already know how they do it (and if you don’t, you’re welcome to read “Content Aware Recovery and Data Carving Explained” we published two weeks ago). But why exactly is this possible? Isn’t the very purpose of formatting the disk destroying everything on it? Well, not quire. Let’s have a look at what actually happens when you format (or “initialize”) a disk volume.

How Formatting Works

Contents

  1. Formatting FAT/FAT32 Devices
  2. Formatting NTFS Volumes
  3. Formatting SSD Drives

Formatting FAT/FAT32 Devices

First and foremost, we are only interested in how formatting works on devices carrying an existing file system (and storing existing data we’ll be recovering later on). Let’s start from reformatting a FAT32 partition using the same type of file system.

FAT32 is an old file system that keeps records linking file names with actual data blocks on the disk in a system area in the beginning of the disk. The size of this area depends on the size of the volume being formatted and the chosen cluster size (typically, the operating system will use clusters of 4KB for volumes under 2GB). As a result, unless you manually change cluster size, the size of the new file allocation table will be exactly the same as the size of the file allocation table it replaces. Meaning, the new file system will irreversibly wipe all of the old records containing file names and linking them with disk sectors that actually store data.

As you can see, the actual data still remains on the disk, and can be recovered with tools using content-aware analysis such as Partition Recovery.

This is what happens if you used Quick Format. But what if you used the slower but more comprehensive Full Format instead? Isn’t the very purpose of fully formatting the disk finally and irreversibly deleting all data on that disk? Again, things aren’t as simple as they appear.

If you use an operating system older than Windows Vista (including Windows 98, ME, 2000 or XP), the full format operation will also wipe the file system area. However, instead of writing zeroes onto the disk, the system format tool will instead read disk sectors to verify them. Once again, your data remains safely available on the disk, and can be recovered with content-aware analysis in Data Recovery Software.

Only if you use Full Format in a fairly recent OS such as Windows Vista, 7, 8 or 8.1 will the system actually overwrite the entire partition with zeroes. If this is the case, the data is actually gone.

Formatting NTFS Volumes

The New Technology File System (NTFS) is a de-facto standard in the Windows world. Windows NT, 2000, XP, Vista, Windows 7, 8, 8.1 and the upcoming Windows 10 use NTFS as the file system of choice. While these OSes support FAT and FAT32, starting with Windows XP the operating system can only be installed on an NTFS volume. This means that pretty much every computer today that runs Windows has at least one NTFS volume.

So what happens if you format an NTFS disk?

NTFS is organized differently compared to the older FAT32. Where FAT32 uses a system area of a fixed size to keep information about the location of files and folders, NTFS stores its file table in a file. This file ($MFT) can be stored anywhere on the disk. It can be moved around, expanded, truncated, fragmented or defragmented. Like any other file, it can also be deleted when you format the disk. And just like any file being deleted, it does not lose most of its content when you actually reformat an NTFS partition (assuming that you’re using NTFS as the new file system). Only the first few records will be overwritten, and of course records will get overwritten as you save other files on that partition, but the majority of the old file system will still reside on the disk.

There is also another factor helping to recover NTFS volumes if the disk is formatted. NTFS stores a backup (mirror_ copy of the Master File Table (MFT). If you format the disk, the mirror copy of the file system may still reside on the disk, allowing a data recovery tool to recover the original file system from its mirror copy.

As you can see, quick-formatting an NTFS volume is actually less of a problem compared to FAT32 disks, with one exception: SSD drives.

Formatting SSD Drives

SSD drives feature a number of special technologies to maintain their health and performance. These technologies are inherent to solid-state storage media and are neither available nor needed on traditional magnetic hard drives. SSD drives must wipe empty flash cells before writing new data. The wiping operation is quite lengthy compared to simple writes. In order to maintain good health and high performance levels, SSD drives erase empty cells in background to prepare them to accept new data. But how does an SSD drive know that a certain cell is no longer used by the operating system? The disk communicates with the OS via a special interface called TRIM. As a result, when you delete a file or format the disk, the operating system will tell the SSD drive that these and those sectors are no longer used and can be physically erased. What happens to the data stored in those sectors? It’s zeroed, emptied… irreversibly destroyed. All that, if you use NTFS.

If you format an SSD drive with FAT32, the TRIM interface is not enabled in any current version of Windows. In other words, Windows will only issue the TRIM command on NTFS volumes, and will not support TRIM on FAT32 volumes. For this reason, quick-formatting an SSD drive in Windows 7, 8 or 8.1 with NTFS will reliably destroy all of the user’s data, while quick-formatting the same drive with FAT32 will leave the data untouched. This is something to consider when recovering formatting SSD drives with our Data Recovery Software.

Frequently Asked Questions

Yes, it is possible to recover deleted files if they have not been overwritten by new data.

Stop using the disk (create an image) as soon as the files have been deleted and use the professional data recovery software RS File Recovery to recover the deleted files.

This greatly depends on the capacity of your hard drive and your computer's performance. Basically, most of hard disk recovery operations can be performed in about 3-12 hours HDD 1TB in normal conditions.

If the file does not open, it means that the file was damaged or corrupted before recovery.

Use "Preview" to evaluate the quality of the recovered file.

When you try to access the drive, you get the message "Drive is not accessible" or "You need to format the partition drive"

Your disk structure is corrupted.

In most cases, the data may still remain available. Just run the data recovery software and scan the desired partition to get it back.

Please use free versions of programs with which you can analyze the storage and view the files available for recovery.

You can save them after purchasing the program - you won't need to scan it again.

Leave a comment

Related Posts

How to boot Windows in Safe Mode
How to boot Windows in Safe Mode
Safe mode in Windows 10, as in any other version of the OS, is a convenient way to solve problems with the operating system. By running in safe mode, the user can get a clean Windows boot, avoiding the automatic … Continue reading
Using Symbolic and Hard Links in Windows
Using Symbolic and Hard Links in Windows
Below we will analyze the notion of hard and symbolic links in Windows, tell you about their primary purpose and key differences. You can also learn how to create links using standard Windows methods or special software quickly.
What is the Best RAID configuration for NAS?
What is the Best RAID configuration for NAS?
One of the important criteria for choosing a NAS (network attached storage) device is its ability to ensure data integrity using RAID arrays. However, to ensure reliable data protection, it is important to choose the correct RAID configuration. In this … Continue reading
Useful Windows commands
Useful Windows commands
The command prompt is an essential Windows component with which you can fix certain problems, improve system performance, test important components, and learn more about the OS. A list and application of the most useful commands can be found below.
Online Chat with Recovery Software