Depending on the methods used to format your hard drive, your data may not actually be gone. If you have ever had experience formatting hard drives and other digital storage media, you might agree that performing a format with the default “quick format” option selected is more convenient than the alternative, which takes at least three times longer to complete. However, if you are using Windows Vista or later, and your intention is to completely erase your data, then the alternative option—a full format—would be more thorough. Otherwise, formatting a hard drive using the quick format option (or an earlier version of Windows) will not actually erase all of its stored data.
When you choose to format a hard drive, you are essentially only removing the pointers to the data as the partition table is either cleared or rebuilt. These pointers are necessary for your computer’s operating system to be able to read and understand the data so that you can properly access your files. Once the partition table is cleared or rebuilt, it is then ready to accept new data in place of where the old data used to be. When new data takes the place of old data, we call it “overwriting,” which is the action that is responsible for true and absolute data loss.
An easier way to understand this is to imagine the hard drive as a large apartment complex and each pointer as a residential address. The data on your hard drive are like residents of those addresses. Formatting a hard drive is like sending out eviction notices to all of the residents en masse. After a hard drive has been formatted, the ‘evicted residents’ appear gone, but the memory of those residents still exist until their ‘apartment units’ are leased to a ‘new resident.’
Whether or not my analogy helps your understanding, the important detail is that most of the data on a hard drive can be recovered in the event of an accidental or intentional format. Recovering the data can be tricky, however, as it requires the use of special software to ‘carve out’ and restore the recoverable data. Not all data recovery programs are capable of recovering every file type. A photo or video recovery software, for example, will not be able to recover text documents, spreadsheets, and other file types.
If ever you find yourself in a situation that requires extensive data recovery, I recommend using a free data recovery software called PhotoRec. Despite its misleading name, PhotoRec can recover more than just lost photos; it can recover other lost files including video, audio, text documents, program files, archives, databases, and more from hard disks, CD-ROMs, and flash memory drives. And even more good news: PhotoRec is supported by all popular operating systems (Windows, Linux, & Mac OS)!
While PhotoRec is an excellent tool, many users may find it difficult to use. (A step-by-step guide on how to use PhotoRec can be found here.) If your interest in recovering lost data pertains to a potential or pending litigation, you should seek advice from a digital forensics expert immediately. In most cases pertaining to eDiscovery and the securing of digital evidence, an extensive data recovery operation alone may not be sufficient for use in legal proceedings. A legitimate digital forensics investigation operates under strict guidelines and procedures to ensure that all existing data is found, preserved, and that any data recovered is admissible in court or other legal proceedings. Taking action without the advice or assistance of an expert could reduce your odds of prevailing in litigation.
