Today’s data recovery tools have no problem recovering your data from a recently formatted hard drive or memory card. If you are following our publications, you may already know how they do it (and if you don’t, you’re welcome to read “Content Aware Recovery and Data Carving Explained” we published two weeks ago). But why exactly is this possible? Isn’t the very purpose of formatting the disk destroying everything on it? Well, not quire. Let’s have a look at what actually happens when you format (or “initialize”) a disk volume.
Formatting FAT/FAT32 Devices
First and foremost, we are only interested in how formatting works on devices carrying an existing file system (and storing existing data we’ll be recovering later on). Let’s start from reformatting a FAT32 partition using the same type of file system.
FAT32 is an old file system that keeps records linking file names with actual data blocks on the disk in a system area in the beginning of the disk. The size of this area depends on the size of the volume being formatted and the chosen cluster size (typically, the operating system will use clusters of 4KB for volumes under 2GB). As a result, unless you manually change cluster size, the size of the new file allocation table will be exactly the same as the size of the file allocation table it replaces. Meaning, the new file system will irreversibly wipe all of the old records containing file names and linking them with disk sectors that actually store data.
As you can see, the actual data still remains on the disk, and can be recovered with tools using content-aware analysis such as Partition Recovery.
This is what happens if you used Quick Format. But what if you used the slower but more comprehensive Full Format instead? Isn’t the very purpose of fully formatting the disk finally and irreversibly deleting all data on that disk? Again, things aren’t as simple as they appear.
If you use an operating system older than Windows Vista (including Windows 98, ME, 2000 or XP), the full format operation will also wipe the file system area. However, instead of writing zeroes onto the disk, the system format tool will instead read disk sectors to verify them. Once again, your data remains safely available on the disk, and can be recovered with content-aware analysis in Data Recovery Software.
Only if you use Full Format in a fairly recent OS such as Windows Vista, 7, 8 or 8.1 will the system actually overwrite the entire partition with zeroes. If this is the case, the data is actually gone.
Formatting NTFS Volumes
The New Technology File System (NTFS) is a de-facto standard in the Windows world. Windows NT, 2000, XP, Vista, Windows 7, 8, 8.1 and the upcoming Windows 10 use NTFS as the file system of choice. While these OSes support FAT and FAT32, starting with Windows XP the operating system can only be installed on an NTFS volume. This means that pretty much every computer today that runs Windows has at least one NTFS volume.
So what happens if you format an NTFS disk?
NTFS is organized differently compared to the older FAT32. Where FAT32 uses a system area of a fixed size to keep information about the location of files and folders, NTFS stores its file table in a file. This file ($MFT) can be stored anywhere on the disk. It can be moved around, expanded, truncated, fragmented or defragmented. Like any other file, it can also be deleted when you format the disk. And just like any file being deleted, it does not lose most of its content when you actually reformat an NTFS partition (assuming that you’re using NTFS as the new file system). Only the first few records will be overwritten, and of course records will get overwritten as you save other files on that partition, but the majority of the old file system will still reside on the disk.
There is also another factor helping to recover NTFS volumes if the disk is formatted. NTFS stores a backup (mirror_ copy of the Master File Table (MFT). If you format the disk, the mirror copy of the file system may still reside on the disk, allowing a data recovery tool to recover the original file system from its mirror copy.
As you can see, quick-formatting an NTFS volume is actually less of a problem compared to FAT32 disks, with one exception: SSD drives.
Formatting SSD Drives
SSD drives feature a number of special technologies to maintain their health and performance. These technologies are inherent to solid-state storage media and are neither available nor needed on traditional magnetic hard drives. SSD drives must wipe empty flash cells before writing new data. The wiping operation is quite lengthy compared to simple writes. In order to maintain good health and high performance levels, SSD drives erase empty cells in background to prepare them to accept new data. But how does an SSD drive know that a certain cell is no longer used by the operating system? The disk communicates with the OS via a special interface called TRIM. As a result, when you delete a file or format the disk, the operating system will tell the SSD drive that these and those sectors are no longer used and can be physically erased. What happens to the data stored in those sectors? It’s zeroed, emptied… irreversibly destroyed. All that, if you use NTFS.
If you format an SSD drive with FAT32, the TRIM interface is not enabled in any current version of Windows. In other words, Windows will only issue the TRIM command on NTFS volumes, and will not support TRIM on FAT32 volumes. For this reason, quick-formatting an SSD drive in Windows 7, 8 or 8.1 with NTFS will reliably destroy all of the user’s data, while quick-formatting the same drive with FAT32 will leave the data untouched. This is something to consider when recovering formatting SSD drives with our Data Recovery Software.