Talk:Disk formatting

From Wikipedia, the free encyclopedia

It's relatively untrue that formatting will cause you to lose all your data, a simple /unformat [drive] will usually restore all of the files.

Contents 1 Quick Format and NTFS 2 Over writing 2.1 Recovery of data from a formatted disk 3 why doesn't format wipe all data?

[edit] Quick Format and NTFS

== == "Never use quick format when formatting a NTFS Drive. There is a chance the drive could become corrupted. Maybe not a big chance, but it is there. Better safe than sorry."

Is there any information/links that back up this claim?

I'm removing it now. No reference was provided, and it doesn't belong in this article anyway. The article doesn't say what either quick format or ntfs means. --Ropez 08:33, 23 April 2006 (UTC)

No unformatting utility can recover data from a partition that was formatted by the /u parameter. This is not the most secure way of destroying the previous data, instead use something like DBAN to destroy old data, however no disk wiping software guarantees 100% destruction of stored data. Only physically destroying the hard drive itself along with the magnetic particles will guarantee complete security. "No unformatting utility can recover the data, but this is not the most secure way of destroying previous data". This sentence is contradictory as it is.--Ricardo Dirani 14:30, 16 May 2006 (UTC)

While I'm no expert in this field, I do happen to know that it's possible to recover data that has been overwritten a certain amount of times due to minute residu of the overwritten data on the disk - that's about the extent of my knowledge for this particular case. So, while software might not be able to recover the data, someone with the knowledge and technology - and actual drive - could recover the data.

Ah, here's a relevant article: MFSTM. Laogeodritt 14:42, 11 June 2006 (UTC)

I would not trust the MFSTM article, as it stands at the moment. See the links I posted in Talk:MFSTM, especially this one [1], and also the arguments discussed in the data recovery article. Mtford 19:59, 15 August 2006 (UTC) == ==

[edit] Over writing

I removed this:

", or even better, a low-level format must be performed. This is actually incorrect.

The data can still be recovered through physical means (by consulting data recovery specialists); to prevent this, the drive must be securely wiped, although even this is not a perfect guarantee. Only physically destroying the hard drive itself along with the magnetic plates will guarantee that the data is truly gone, but if you only break it into pieces, the data may still be recoverable if the appropriate method is used"

Anyone who wants this, or similar, put back in, should link to a company, or software, or hardware, that can recover data that has been overwritten. See also Gutmann_method where Gutmann himself debunks the myth about overwritten data being available. DanBeale 11:06, 29 March 2007 (UTC)

Thank you for adding this note, and the link to Gutmann's own Epilogue statement, where he wrote too many have completely misunderstood what he'd written; and at a time when HDDs were nothing at all like they are today! Daniel Feenberg, whose article is listed as criticism of the so-called "Gutmann Method" there, actually e-mailed me and asked I review his paper. Apart from one of the last sentences which seemed to be a bit too personal about Gutmann himself, in general I'd agree with his assessment of the topic. Even if GOV agencies had some of the equipment paranoid citizens believe they do, they simply cannot afford to waste all the time it would take to find a few bits and pieces of data completely out of any context! BTW, the reason Feenberg contacted me was that he'd found my own web page here: http://thestarman.pcministry.com/asm/mbr/WIPE.html "How To Permanently Erase Data from a Hard Disk". Daniel B. Sedory 10:24, 15 April 2007 (UTC)

Oh, I forgot to say this: One thing that really irks me are those who throw about the phrase "low-level format" when speaking of hard disks. Many ignorant people continue to promulgate the idea HDDs should not only have this done to them, but that it's even possible; which it def. is NOT for anyone without access to an HDD factory for any modern (like over 12 years or more now) HDD, so I'm quite happy to see anything like that removed from this article! Daniel B. Sedory 10:43, 15 April 2007 (UTC)

[edit] Recovery of data from a formatted disk

In the last paragraph, the article states the DOS FORMAT command completely overwrites every sector when run of a floppy disk by writing F6h bytes to each sector. Each sector of a floppy contains 512 bytes which is 200 in hex. Where did he get F6? F6 = 246 in decimal or 11110110 in binary. 246 is an unusual number as most numbers in computing are powers of 2.

Also, the old dos version of format would only write zeros to the sectors if you used the /u (unconditional) option, otherwise the data could be recovered with the unformat command.

The help files on windows vista claims that the format utility deletes all data on the disk, unless the quick format option is selected in which case it creates a new file table without overwriting the disk. The command line format program also has a /p: option which writes a 0 to every addressable sector on the drive multiple times (you supply the number of passes after the /p:). However bad sectors are still a problem as there is no way to determine if the drive was successfully able to overwrite them. If not, bad sectors could potentiall contain an image of data previously stored there. David J. Dreier 18 October 2007.

F6 is the value written to every byte on the disk. Like this : F6F6F6F6F6F6... I will rephrase the sentence in the article.

--Xerces8 (talk) 17:25, 22 November 2007 (UTC)

David, although Xerces8's recent edit, in which he added "byte value" before "F6h", is helpful, the key idea would have been "filling each sector" with 'F6h' bytes; not just writing it once.

Do you know which version of DOS wrote zero-bytes during a FORMAT (and not 'F6' bytes)? Have you performed any tests to verify that? That's something I'm unaware of, but could test in the future as I have access to various versions of DOS from a collector friend. Is there anything on the Net or in a manual that specifies what certain versions of DOS write? I've done many tests with the FORMAT command, but don't recall seeing anything except 'F6' bytes during a FORMAT.

I'd also like to point out for everyone that until VISTA's apparently recent true data deleting function (I've yet to examine that myself), only the formatting of floppy diskettes (and possibly rather small partitions on hard disks), truly wiped all data (that was possible for it to overwrite) from a medium. Performing a FORMAT on large hard disk partitions (of FAT32 and NTFS for example), leaves a great deal of data behind. As the article states, it's only what is OVERWRITTEN that is truly deleted. Daniel B. Sedory (talk) 02:23, 27 November 2007 (UTC)

[edit] why doesn't format wipe all data?

How can it be that a ("non quick") format does _not_ wipe all data? How exactly is the testing for bad sectors done? If it is done by writing data to each sector and then testing if what's been written is the same what has been read, how can it be that any data is not overwritten and retains on the disk? Anyone who can solve this mystery??? 195.135.137.107 (talk) 15:16, 27 November 2007 (UTC)