when is a format not a format.

I am running windows2000, and recently formatted all drives. Since
then I ran a utility to detect certain types of files and was surprised
to see that files were detected which had been downloaded years prior to
the format.How come? I thought a format was supposed to wipe the disc clean.

 

I can recover all my files, even after using active killdisk, I can't if I
have it set as a raid array or sata though, unrecoverable.

 

On Mon, 20 Dec 2004 21:17:56 +0000, david

|> I am running windows2000, and recently formatted all drives. Since
|> then I ran a utility to detect certain types of files and was surprised
|> to see that files were detected which had been downloaded years prior to
|> the format.How come? I thought a format was supposed to wipe the disc clean.

Running Format /Q or a quick format will only delete(clear) the fat
table, the rest of the hard drive/floppy remains intact.


--

 

The way hard disks work mean that it is possible to get back data you
deleted.

How this works gets really technical and I don't understand it beyond
a basic level.

Why this happens is simpler. There are two types of formatting. Quick
and Full. Quick just deletes the MBR (Master Boot Record) and
partition table. The actual data isn't touched so recovery tools just
search the drive and locate file chunks. Normally if you just quick
format you can get back a very high amount of data (in the 95%+
areas). A full format writes over the drive with blank data, normally
just FF (hex value). A full format normally means you can't get much
back however it isn't perfect. Like I said there are ways to get data
back even from a full format, just not as much (I don't have a %
sorry).

It is because of this reason that the DoD, etc. use multi pass secure
formatting methods such as overwriting the drive several times with
random data. There are several free tools that do this for you such as
Eraser [http://www.tolvanen.com/eraser/] as well as commercial ones.