1

I'm trying to recover some data from a hard drive that a friend attempted to format without making a backup. The drive is currently not recognized in "My PC." In disk management, the only option is "Delete Volume" when the drive is right clicked. I would like to perform an NTFS quick format to reduce data loss.

Disk 4

How will deleting the volume affect my data?

Notes:

  • Windows 10
  • External USB-attached 160 GB drive
  • The drive was recently defragmented!
Craig
  • 83
  • 1
  • 8
  • 2
    Quick (or any) format can only *decrease* your chances of recovering data. Any action that alters the drive can decrease your chances and/or amount of data you will be able to recover. – Kamil Maciorowski Jul 30 '19 at 14:06
  • 2
    Possible duplicate of [How do I recover lost/inaccessible data from my storage device?](https://superuser.com/questions/241817/how-do-i-recover-lost-inaccessible-data-from-my-storage-device) – Kamil Maciorowski Jul 30 '19 at 14:08
  • @KamilMaciorowski Where exactly is the answer to my question in that post? – Craig Jul 30 '19 at 14:15
  • 1
    Where it reads "The most important thing is to STOP using it, any type of I/O can ruin your chances of a recovery". – Kamil Maciorowski Jul 30 '19 at 14:18
  • @KamilMaciorowski That is not an answer to my question. I asked "How will it affect my data" and that quote gives me no insight into how. That quote is what led me to ask the question in the first place - I already know writing magnetized ones and zeros over the files will not be good. – Craig Jul 30 '19 at 14:47

1 Answers1

2

Deleting the volume doesn't affect the data. With proper tools (not DiskMgmt), the volume can be recreated at exactly the same spot and will have exactly the same contents.

But the problem is that your data was already lost when creating the volume – all previous FAT or NTFS metadata was overwritten by formatting, because that's what formatting a volume does. Similarly, any attempts to format the volume again will only keep destroying what's left.

(General rule: The more you alter the disk, the more likely you are to overwrite some of the original data that you wanted to recover. Therefore, formatting it is the complete opposite of what you want. If you really want to maximize your recovery chances, do not alter anything on the disk at all.)

Most of the actual file data is still there on disk, but there is no longer any information about where it is, i.e. which sectors belong to which files (because the "formatting" procedure throws it away, and formatting it again will not bring anything back).

You might be able to recover many files by using tools such as PhotoRec which scan the entire disk for anything recognizable (only common formats such as MP3/JPEG/Zip). Because this method doesn't rely on having the old file table, it'll work even after the accidental quick-formatting – but it will leave you with a ton of unnamed files that you'll have to sort through, and many of them are likely to be incomplete (fragmented).

I found a few resources that said a "quick format" does not overwrite data on the disk, rather it just removes the reference data. So Delete Volume will only delete the reference data basically? – Craig

Yes, but also kind of no.

There are two kinds/levels of "reference data" that you're thinking about:
1) the partition table knows where volumes (partitions and their filesystems) are,
2) the filesystem lives within the volume and knows where individual files are.

When you 'delete' a volume, it only removes volume reference data from the partition table. This is easy to undo because it's just one partition, and it consists of a single contiguous area that occupied the whole spot – easy to guess where it was.

When you quick-format a volume, it only removes filesystem reference data from the volume. Now that's difficult to undo because you must find many thousands of individual files scattered all over the disk, some of them even fragmented, and all of them will be nameless when recovered.

u1686_grawity
  • 426,297
  • 64
  • 894
  • 966
  • I found a few resources that said a "quick format" does not overwrite data on the disk, rather it just removes the reference data. So _Delete Volume_ will only delete the reference data basically? – Craig Jul 30 '19 at 14:27
  • 1
    @Craig: Well, that's the problem – it overwrote the "reference data" that you _needed_ to locate the real files. Quick-formatting again will only overwrite the same spot, and it definitely won't bring anything back. – u1686_grawity Jul 30 '19 at 14:28
  • I've used Recuva to find files and I think that just scans the drive for files. Problems can arise when it is fragmented, but the disk was recently defragged. Unless I'm missing something here. What do you think? – Craig Jul 30 '19 at 14:30
  • 1
    If it was recently defragmented before formatting, then PhotoRec should be able to recover most of the files (of the most common types). – u1686_grawity Jul 30 '19 at 14:34
  • 1
    Note that there are two levels of "reference data": 1) the partition table knows where volumes (filesystems) are, 2) the filesystem is part of the volume and knows where individual files are. When you delete a volume, it removes reference data from partition table, and that's easy to undo by just guessing where the volume was – it's a single contiguous area anyway. When you quickformat a volume, it removes reference data from the filesystem, and that's difficult to undo because now you must find many thousands of small files scattered all over the disk, some of them even fragmented. – u1686_grawity Jul 30 '19 at 14:49
  • 1
    (Not to mention, the _directory layout_ is part of the filesystem's "reference data". Even if you can find and recover the file contents, without it you won't know their names and what folder they were in.) – u1686_grawity Jul 30 '19 at 14:52
  • The explanation of the difference between a partition table and a volume was enlightening. Thank you. – Craig Jul 30 '19 at 15:01