Does anyone know what happens, in detail, when you format a hard drive. I was always under the impression that it simply erased all data on the hard drive - here is the problem, I have been reading that it is possible to recover data from a formatted hard drive and that a hard drive only has a low level format once in its life time when it is in the factory?
Any info would be greatly appreciated,
Mark
About erasing data:
When you delete a file in Windows, it removes it from the file system, but leaves it on the physical media itself. It can do this because it doesn't access files directly.. it uses an index to locate files. When files are removed from this index or the file itself is marked as unavailable, Windows no longer has access to the file.
There are programs which ignore the file table and look directly from the data in the file structure itself. These are the programs most people will talk to you about and have a pretty good success rate for data recovery as long as the file hasn't been deleted for a long time and the file system hasnt' been written to much. Using either method though, your data is still recoverable because it hasn't been written over, sector by sector.
About formatting your data
When it comes to formatting, quick formatting works in a simliar way (the one that takes several seconds) by deleting and recreating the partition. A 'regular' format takes much more time, but it doesn't destroy any more data. The extra time it takes is *only* because it does a sector-by-sector read scan to verify the drive is in good, physical shape.
Unconditional formatting (also known as zero filling) is a little more involved, but it writes zeroes to each sector. This, for all intents and purposes, deletes the data permanently. Every bit of your data is written over with a zero and this makes it impossible to recover using your typical file recovery tools. This is also mistakenly called "low level formatting", but low-level formatting is something else (more below). In
theory it is possible to recover this data, but getting anything more than extremely tiny bits of information is impossible, as far as I can tell. Keep in mind I don't do data recovery for a living, so I'm basing that on just what I understand about it (which is very little, honestly).
Low-level formatting is a hardware-performed format which is only done by the manufacturer. It can also re-number sectors, tracks, write new firmware etc. I'm unsure how it compares to an unconditional format. While it may achieve a simliar result for the destruction of data, low-level formatting is NOT zero filling and can NOT be done by software. It's a common misconception that I, myself, I had for a long time.
Recovering your data from an unconditional formatting:
Imagine your data represented by ones and zeros, each determined by its magnetic polarity (positive/negative). The disk surface is covered with microscopic, magnetic particles. Zero isn't actually an absolute zero... it could be .00000008 or .00000014. Also, one isn't actually an absolute one... It might be more like .99999998 etc...
Now, let's say we have a brand-new drive and we add a tiny amount of data to it. When we add data, we polarize a particle so it is no longer a zero, but now a one. Let's say that data stayed there for months before we zeroed the drive.
The surrounding particles (your data) will be weakened by your data's magnetic force. So instead of the surrounding zeroes being .00000003, maybe they are .00000439 now. The magnetic strength of the particles that your data comprises of will also be weakened. instead of .99999997, it might be .99999921. For someone who has a lot of patience, enormous skill and fantastic equipment, it is possible to use the relationships between magnetic polarity strengths to reconstruct your data. It would be an amazingly improbable process and would require a tremendous amount of work. Successful recovery using this method is theoretical though and its really far-fetched to believe that your data is in danger after an unconditional format / zero fill. Wipe programs that do multiple passes when writing zeros to your data supposedly help protect against this type of data recovery, and I'm sure they do. But my understanding is one pass is effective enough for your personal information (credit, identity etc.). I would treat sensitive corporate/government information differently though, but I have a feeling they would rather just physically destroy the drive than spending hours wiping each drive.
