Why were these files unrecoverable?

[Asusrocks]

Ok i hope someone can give me some profesional advice here cuz im kind of frustrated.

A person brung me their laptop for data recovery. As he explains it, he accidentally formatted his Data D: partition. Upon trying around 4 different data recovery programs, It didnt show me any data to be recovered (only some drive config files). He later on told me that he accidentally formatted the same partition TWICE. I read around and read some sites that stated you have to be careful in writing anything to the formatted disk after you accidentally format it(So it wont overwrite anything)in order to better your chances of recovering the files. What he did is right click on the partition D: and clicked format, and then he did it again (idk why :screwy:). My question is did formatting that SECOND time screw up the chance of recovering the files? Or does anyone know what could of contributed to his files not showing up on Data Recovery Utilities?

** Note: His C: Drive was his primary OS Drive which had Win Vista. Im certain the data D drive(which had the missing files) was a logical disk, although i did not check.
*I had no other choice, other then to refer him to a professional data recovery lab service (Which cost hundreds of dollars)

[{PGA}AfterShock]

Illegal software, of any kind, is not up for discussion at OCForums. Read the rules before posting further.

Jon
Forum Moderator

[WarriorII]

You need to be able to "look" at the whole disk.

When a hdd gets formatted, no matter how many times, quick or full it should just format the "bootable files" area and leave the "data area" alone. (up to XP - not sure about vista)

Unless your friend used a 3rd party software and did a zero wipe / or used a factory utilities disk for that hdd. Such as Seagate, Western Digital etc... & "zeroed out" the hdd.

The "data" should be there.

There's a couple programs you can use.

[Mr.Guvernment]

r-tools i like

you cant just right click / format in windows, you need to choose right click / format then a new window comes up with info, asking what you want to do, add a name, size etc, then youhave to finally click okay and if there is data it tells you you will lose everything, so they did it on purpose likely for some weird reason.

[jayfella]

afaik - when a file is deleted - there is just one digit in the files that is either a 1 (existant) or zero (deleted) - it doesnt matter how many times you formatted as warriorII said.

What WarriorII is explaining is that if you write zero values over the entire contents of the disk - it is pretty much unrecoverable (though im told it is still possible) - but that doesnt happen when you format it.

[Asusrocks]

thanks for the info, I was pretty much using Demo Software like Seagates DIY, GetDataBack, Unistal NTFS Recovery and other 3rd party data recoveries, where if the files were givin the slight chance of showing I would of purchased the software and ended my recovery with it

To Mr. Guvernment : I know what you mean, the reason i only mentioned right click>Format is becuz thats all he told me

[WarriorII]

GO HERE:
http://www.ntfs.com/products.htm

FREE NTFS reader.

It READS NTFS - it ONLY write to FAT & FAT32, so format a thumb drive to fat32, so you have something to copy your files to.

This is where a USB HDD comes in handy.


EDIT:

Format -
Boot Record is rewritten
Fat 1&2 are "Zero'd out"
Root Directory is rewritten
Data Area is NOT touched

UNLESS a 3rd party formatting software is used to NUKE the hdd.
:attn:

[Asusrocks]

GO HERE:
http://www.ntfs.com/products.htm

FREE NTFS reader.

It READS NTFS - it ONLY write to FAT & FAT32, so format a thumb drive to fat32, so you have something to copy your files to.

This is where a USB HDD comes in handy.


EDIT:

Format -
Boot Record is rewritten
Fat 1&2 are "Zero'd out"
Root Directory is rewritten
Data Area is NOT touched

UNLESS a 3rd party formatting software is used to NUKE the hdd.
:attn:

hey thanks for the website i think that software would come in handy. All i gotta do now is test it to see its accuracy. But I didnt understand what you meant by the information underneath EDIT?

[WarriorII]

hey thanks for the website i think that software would come in handy. All i gotta do now is test it to see its accuracy. But I didnt understand what you meant by the information underneath EDIT?

That's what happens when you format a hdd.

The data area is not over written, only the root & boot directories are overwritten.

your data should be there.

[Asusrocks]

ok so the NTFS Reader should automatically show me the OLD Boot record and root directory? then what i dont understand, is how come none of the data recovery software i used showed any data? and all he did was format the partition. that and if you format the drive and you go to write information on it, how is the sequence of data written? I ask this becuz all data recovery software says NOT to write data on the drive which needs recovering

[WarriorII]

....all data recovery software says NOT to write data on the drive which needs recovering

Ok, see if I can say this simply.

You write a one page essay. (your hdd & OS installed)

You erase the first paragraph. (the boot records) :eek:

nothing else is erased.

Now, you want to write a different essay on the same sheet of paper.

you start to write in the blank area (where the first paragraph was)

you run out of space, so you THEN start to overwrite the remaining data. (rest of the essay)

the more new data you write, the more old data you overwrite. (until it is completely gone)

If you are writing new data to the hdd, you stand to lose more data.
Pull the hdd, install a different hdd to run from as a primary, plug the other in as a slave to be recovered.

I hope this makes sense to you.

Use the NTFS - DOS reader and see if you can even see any data on the hdd.

[Asusrocks]

well written metaphor, that explained it much better. But once you format the hdd and start writing information on it again, is it set to use all the blank space first, before overwriting the old info? or is it a random thing where the new data could be writtin in any spot?

[Mr.Guvernment]

i beleive it is random.