Data Recovery from mistakenly formatted drive

Have you ever "mistakenly" formatted yours or your friend's Hard Drive ? And you wonder how to recover data of the Hard Disk ? Lets go through various steps and learn how to recover your data.

• What is format and what are different kinds of format? What happens to a file when the disk containing it is formatted?

Ans. Format in common terms can be defined as the process of deleting all the information (software/media etc stored in the drive) but this is not necessarily true.

Formatting is done at two levels:

a)Low-level format: Low level format is done at the factory level. It is the process of marking the start of a recording location or basically the start of a sector. So if after writing the data in a disk we low level format it again we are bound to loose everything on the data as with the recording location changed, thee file system will not know where the file is located. Even third-party softwares can not help in that case.

b)High level format: High level format is what is the process of implementing an empty file system on top of a ‘low level formatted’ disk,also known as quick format in layman terms(because it ia a fairly fast process). The disk may be optionally check for bad sectors and problems in the hard disk, this is known as a full format. Source: wikipedia

• What happens to the files on the computer when a disk is formatted and how the recovery tool is able to retrieve them ?

http://ezinearticles.com/?What-Happens-To-A-File-Once-You-Hit-Delete&id=508001

Ans. When a drive is formatted, only the link to the file i.e. entry in the file system is deleted and not the file itself. If the file is quickly formatted, only a new empty file system is imposed on the existing one. So if the hard disk be compared to a book and the pages as the files, and if a file aka page is to be deleted only the entry from the index is deleted. So when the file is deleted, the file system marks the corresponding sector as empty but the file is not itself deleted. And if it is formatted, the index is overwritten.

So depending on the usage of the disk it may or may not be over written over time. Also depending on the time elapsed between the date of delete and the date of recovery, chances vary that the file may not be over-written.

Also many data recovery tools are available over the net to recover files from a mistakenly formatted drive. Some even boast that they can retrieve them even upto after ten over- writes. Let us now see how file recovery tools work.

The software goes sector by sector and searches for files in that sector, it then compares with the file system available with the OS and whatever is not there the software shows it to the user and whatever the user selects is copied to a location where the OS can access the files.

• Softwares that are available online and how they work:

There are many paid softwares available on the net such as:

a)Digital Rescue Premium

b)Advanced disk recovery

c)Recover my files

d)Data recovery wizard

e)Total Recall

We tried various softwares that promised to be free but in the end many of them either only gave the preview of the deleted file or they recovered data of a limited amount.

We then tried one software called ‘EASEUS’ but it recovered only 1 GB data for free...can be downloaded from http://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm. It is available for various and all kind of operating systems.

Broadening our search we came across the software PC INSPECTOR FILE RECOVERY which can be downloaded from http://www.snapfiles.com/get/pcinspector.html.

It is a good software and is quite useful for data recovery. The problem in retrieving these deleted files is that since the file name is stored in the file table, so with the file name deleted, the file is retrieved and is named after the cluster where it was found. Commercial software may be able to retrieve the name also but the two softwares we tried were not able to do so. However, the demo versions of the commercial software were at least able to show us the names of the deleted files. How so ever, even the non-commercial softwares can retrieve file names if they were deleted from the drive.

Recuva and PC inspector file recovery were the major softwares we used.

For a pen drive:

Our original pen drive consisted of the following files:

Format completed.

Now we will try to recover the deleted files using two softwares:

1.Recuva:

Let us go through the steps one by one.

Another option can be to cancel this prompt and use this program as an advanced user which is not recommended for first time users. Cancelling the promt takes you straight to the prompt where you only have to select the directory name all files are searched unlike the prompt below.

The default value in the above prompt is pictures,but since we are not sure what all files were there in the pen drive,we will search for all files and not for any specific types of file.

The default search drive is the C:\ or the drive in which your os is installed. But we need to put it as F:\ since it is the external drive.

Now Recuva starts searching for deleted files in the specified drive,since it goes sector by sector it is a very slow process.

It shows the found files in this above window,since the pen drive we used is relatively new and haven’t been written on too many times, it is clear that no will over-written clusters exist. If any over-written clusters are there,the green dot on the left of the file name becomes red and in the comments it shows over written clusters exist.

Now using the recover option on the left hand side of the screen and choosing where we want to store the recovered files,we start the recovery process. Make sure that the recovered files aren’t stored on the same drive as the deleted files because before copying, we don't want to over-write them.

Recovered.

But now lets see what all gets recovered:

Unfortunately, the .py files and the .txt files are lost when we use recuva. The file name is changed because of the fact explained earlier.

2) PC inspector file recovery(it may not work properly for PDs as it is a HDD oriented software:

We will recover deleted files with the help of this software.

All the external drives are listed in Logical drives whereas the internal drives are shown under the physical drive tab.

Since, files are stored differently on a pen drive or basically on a solid state drive,instead of recognizing the drive on its own,we need to manually search for “LOST” data instead of “DELETED” files.

The good thing about this software is that we can limit the number of clusters also.

Scanning for directories….

Lost files are showed in the files which are found in the same cluster are stored in a separate folder.

The files which were deleted are showed in the above window.

The way to recover it is quite easy, select all right click and select recover files.

Now let us recover formatted data from a Hard Disk.

The recovered files are shown in the above picture.

With RECUVA :

Now recovering from a hard disk is quite similar to recovering from a pen drive. But since the hard disk was very large (500 GB), it took a lot of time for the software to go sector by sector and look for deleted files in every cluster.

But some softwares were faster than the other softwares .

To be more specific PC Inspector file recovery was faster than RECUVA, but if by mistake the process gets cancelled and we restart the process, PC inspector file recovery becomes very slow.

Also the process of recovering from SDDs and HDDs is essentially the same but the speed of recovery from a drive of same size may vary.

PERSONAL EXPERIENCE:

The experience was horrifying, not only for us but for our laptops as for the 500 GB hard disk, the laptop remained on for around 20-23 hours at a stretch!

Also while using PC Inspector file recorvery software, the time shown in the starting to recover data was Around 40000 hours! And it was recovering at a rate of 400 minutes per half an hour. And due to some errors, we had to restart the process again and again. It took us a lot of time to recover data from the HD through Recuva.

After the searching process was finished, copying the found files obviously took less time. :D

But the overall experience was fun and we learnt something new and very useful.

Compiled by Geet Gupta and Utkarsh Gupta.