Data recovery

[FireFox_13]

Hello everyone. I was just wondering that if i could recover data from a formatted disk. The drive had a OS on it but not now. Is it possible to recovery files from it ? Thank you for the suggestions  

[xentropa]

Was it a quick format?

 

Quick format - several seconds

Full format - 30 minutes (for HDD, no idea for SSD)

 

Quick format may be possible to recover if you didnt write any new files to it.  Full, no.

[Nuluvius]

6 hours ago, xentropa said:

Full, no.

Simply not true. The data can be recovered by specialized tools... Why do you think erasure algorithms exist?

[xentropa]

On 7/11/2016 at 7:39 PM, Nuluvius said:

Simply not true. The data can be recovered by specialized tools... Why do you think erasure algorithms exist?

How do you recover information on a storage device when all bits have been written to 0 which is what a full format does?

 

Erasure alorithms work to destroy data through mapping techniques on individual sectors of a storage device outside of the OS's control which is only necessary if you wanted to delete individual files and not the whole disk.  Otherwise some perform a checksum on sectors to actually make sure data actually has been written to all 0s but failing that would mean data is destroyed beyond recognition in all probability as opposed to written to all 0.

[Nuluvius]

8 hours ago, xentropa said:

How do you recover information on a storage device when all bits have been written to 0 which is what a full format does?

Firstly it depends on the formatting method as not all of them actually write zeros to the disk; you have to ask for it in Linux for example. This is further compounded by format method versioning as detailed in this KB related to Windows (in summary writing zeros as part of the process was only a relatively recent addition).

 

Secondly it is at best subjective: It's still possible to recover some data even when writing zeros to the disk because at post write a sector that contained a one will be magnetically or otherwise distinguishable from one that contained a zero pre write, see Data Remanence. This is why multiple passes are suggested and that zero writing is generally not considered (by government agencies) good enough anyway. Instead the use of a method such as DoD 5220.22-M for example combined with the Mersenne Twister algorithm would be better - software such as DBAN allows one to achieve this. Moreover if the disk has bad sectors then those would have been isolated by the firmware thus it's highly likely post erasure to be able to recover some data from them.

 

I don't know about you but I don't like for there to be any subjectivity when it comes to my data.

8 hours ago, xentropa said:

Erasure alorithms work to destroy data through mapping techniques on individual sectors of a storage device outside of the OS's control which is only necessary if you wanted to delete individual files and not the whole disk. Otherwise some perform a checksum on sectors to actually make sure data actually has been written to all 0s but failing that would mean data is destroyed beyond recognition in all probability as opposed to written to all 0.

I think you are slightly confused. When you 'delete' a file in an OS such as Windows for example it's only 'tagged' as reusable space and then hidden from view. One may find 'file shredder' software that proposes to appropriately destroy the underlying allocated space in situ. In that specific context you'd be right in saying that this methodology is indeed beyond the control of the OS.

 

Another method is cryptographic erasure; data on the disk is encrypted and the key is stored in some control block by the firmware. When one wants to 'erase' the disk then it's a simple and almost instantaneous operation performed by the disks firmware which changes this key thus rendering all data cryptographically erased i.e. the disk is now filled with meaningless crap.

 

Beyond these all that's left are physical methods such as degaussing, smashing, burning, vaporization and so on.

 

This is all digressing from the question however:

On 11/07/2016 at 4:37 AM, FireFox_13 said:

Hello everyone. I was just wondering that if i could recover data from a formatted disk. The drive had a OS on it but not now. Is it possible to recovery files from it ? Thank you for the suggestions  

As I said at the beginning: It depends on the details of how it was formatted. If it's the case of a zero write pass then it's not going to be very likely to recover the data using average commercial processes.