What Data Recovery software recovers partition(s) if drive has been formatted?

douche · 03-07-2008, 11:22 PM

I used Active@ Partition Recovery and it restored my partition, but only because i deleted the partition. What about after a format? Do i need data/file recovery programs?

tlarkin · 03-07-2008, 11:25 PM

data is not gone until completely over written, and even then it can still sometimes be retrieved.

nyhk · 03-08-2008, 01:12 AM

well, if data is overwritten, i think you need a miracle to get it back

about the question, yes after a format you need a bit more work to get data back than deleting the partition.

douche · 03-08-2008, 01:18 AM

Quote:

Originally Posted by tlarkin

data is not gone until completely over written, and even then it can still sometimes be retrieved.

So, a format does NOT overwrite data, then? If a drive or partition is overwritten with data, how/what would be the best program to recover it?

Quote:

Originally Posted by nyhk

well, if data is overwritten, i think you need a miracle to get it back

about the question, yes after a format you need a bit more work to get data back than deleting the partition.

What work would that be? So, can using something like Active@ Partition Recovery help at all following a format?

nyhk · 03-08-2008, 01:22 AM

a format only overwrites a small portion of the drive, "the index"

If the entire drive is overwritten with new data, you cannot get it back.

douche · 03-08-2008, 01:39 AM

Quote:

Originally Posted by nyhk

a format only overwrites a small portion of the drive, "the index"

What is "the index"? Is data on there that a format overwrites? Or, is it the MBR? AFAIK, the MBR resides in area where NO data (i.e. files) are stored.

Quote:

If the entire drive is overwritten with new data, you cannot get it back.

But, the previous poster mentioned "it can still sometimes be retrieved." How so?

nyhk · 03-08-2008, 01:49 AM

The index is how the filesystem keeps track of all the files, where they are on the disk etc. The mbr holds the partition table on a normal disk. So deleting a partition is just a small modification to this table, and can easily be recreated.

I'm not sure how tlarkin will recover overwritten data. Not even professional recovery firms can do that

tlarkin · 03-08-2008, 06:11 AM

There are data foot prints in cache, memory, and unwritten sectors. While, it may not be probable, its definitely not impossible. That is why when secure data on a failed drive or a drive that is replaced, is physically destroyed rather than zero'd out. I've take a few crow bars to HDs before that contained medical information on it.

nyhk · 03-08-2008, 10:22 AM

the cache is like ram in your computer, it will be lost when the power goes.

unwritten sectors? then it is not overwritten, i guess.

it has long been known that overwriting the disk (modern disks anyway) is more secure than physically destroying it.

tlarkin · 03-08-2008, 07:30 PM

Quote:

Originally Posted by nyhk

the cache is like ram in your computer, it will be lost when the power goes.

unwritten sectors? then it is not overwritten, i guess.

it has long been known that overwriting the disk (modern disks anyway) is more secure than physically destroying it.

Just because you haven't written any user data to a sector it doesn't mean the OS hasn't threaded or cached something there. Also, if you have many different copies of the same file an older version can be restored, well with other filing systems.

How are you going to put back together a cracked platter?

03-07-2008, 11:22 PM	#1 (permalink)
douche Bronze Member Join Date: Nov 2006 Posts: 33	What Data Recovery software recovers partition(s) if drive has been formatted? I used Active@ Partition Recovery and it restored my partition, but only because i deleted the partition. What about after a format? Do i need data/file recovery programs?

03-08-2008, 10:22 AM	#9 (permalink)
nyhk Silver Member Join Date: Aug 2007 Posts: 152	the cache is like ram in your computer, it will be lost when the power goes. unwritten sectors? then it is not overwritten, i guess. it has long been known that overwriting the disk (modern disks anyway) is more secure than physically destroying it. Last edited by nyhk; 03-08-2008 at 10:25 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
help please!	wiwazevedo	General Software	8	02-22-2008 09:45 PM
homepage hijacked by nice.allxun	sid	Computer Security	2	12-03-2006 05:35 AM
Compaq mother board again	exopforce	Motherboards	15	09-29-2006 01:05 AM
Web Browser "Page cannot be displayed"	Gregus	Computer Security	3	08-03-2006 09:44 PM
Partitioning external Hard Drive with data on it.	tonsofpcs	Computer Memory and Hard Drives	1	10-28-2004 12:05 AM

03-07-2008, 11:25 PM	#2 (permalink)
tlarkin VIP Member Join Date: Apr 2006 Location: Kansas City, MO Posts: 5,944	data is not gone until completely over written, and even then it can still sometimes be retrieved.

03-08-2008, 01:12 AM	#3 (permalink)
nyhk Silver Member Join Date: Aug 2007 Posts: 152	well, if data is overwritten, i think you need a miracle to get it back about the question, yes after a format you need a bit more work to get data back than deleting the partition.

03-08-2008, 01:22 AM	#5 (permalink)
nyhk Silver Member Join Date: Aug 2007 Posts: 152	a format only overwrites a small portion of the drive, "the index" If the entire drive is overwritten with new data, you cannot get it back.

03-08-2008, 01:49 AM	#7 (permalink)
nyhk Silver Member Join Date: Aug 2007 Posts: 152	The index is how the filesystem keeps track of all the files, where they are on the disk etc. The mbr holds the partition table on a normal disk. So deleting a partition is just a small modification to this table, and can easily be recreated. I'm not sure how tlarkin will recover overwritten data. Not even professional recovery firms can do that

03-08-2008, 06:11 AM	#8 (permalink)
tlarkin VIP Member Join Date: Apr 2006 Location: Kansas City, MO Posts: 5,944	There are data foot prints in cache, memory, and unwritten sectors. While, it may not be probable, its definitely not impossible. That is why when secure data on a failed drive or a drive that is replaced, is physically destroyed rather than zero'd out. I've take a few crow bars to HDs before that contained medical information on it.