Thursday, August 27, 2015

Why can Data be Recovered After Formatting?

Someone once asked, "If a quick format just marks bits as writable and a normal format writes zeroes to the entire disk, why do people bother with DBAN and why are multiple passes ever required? Why can data be recovered after formatting?

It used to be possible by reading the residual magnetism left by the previous bits. This is not so much of an issue now that the tracks and bits that hard-drives write are so small. It is almost impossible to recover any meaningful data off of a zeroed drive with modern disks.
This next section is only true for Windows XP (as Psycogeek pointed out, Vista and later Windows systems do zero out the hard-drive if you do a full format).
That being said, your definitions of quick format and normal format are off. A normal format does not zero out the disk, that would take too long. The difference between the two is that a normal format looks for bad sectors on a drive while a quick format does not.
So it is best to use a tool like DBAN to do at least one pass if you want to make sure data is not recoverable. And if you are doing one pass, then why not do a few more just for fun?

No comments: