Unformat Disk and RAID Recovery

The common conception of formatted disks is that once a format operation has been run, a disk is a "blank slate," with absolutely no residual data left behind. But the notion that formatting a disk irrevocably eradicates all data on the disk is not always accurate. In fact, R-Studio, a powerful data recovery tool, can easily recover important data from most formatted disks. To understand why, let us briefly discuss how files are stored on disks, how computers format disks, and how to "unformat" such a disk to recover the files on it.

To use disk space efficiently, the information about the file and file's contents are stored on the disk separately. This is similar to an index or table of contents at the beginning or end of a book. On a disk, there is a table that stores information about files, such as filenames, folder paths, creation and modification timestamps and, most importantly, where the actual file content is located on the disk and where it begins and ends. For Windows, there are two supported file systems: FAT and NTFS. The file tables for these systems are called the File Allocation Table (FAT) and Master File Table (MFT), respectively. While there may be some information about the file and folder structure located elsewhere on the disk, the bulk of this type of information is stored in the FAT or MFT.

What Happens When You Format a Disk
When you format a disk, one of two processes will unfold. When a quick format is performed, the system will create a new file table to replace the existing FAT or MFT. The previous file table will be partially or completely overwritten, destroying information such as filenames, folder structure and the physical location of the data, but the data will still be there. This data will remain untouched until it is overwritten by another application.

When a full format is performed, the computer overwrites the table of file records with a new one, as it does with the quick format. Additionally, it will check the disk for bad sectors. A full format is typically recommended in preparation for the installation of a new operating system. Disks that are formatted using Windows XP or earlier version of Windows will leave the data intact. However, Windows Vista, Windows 7 and presumably later versions of Windows will overwrite the entire disk with zeros in order to completely wipe the disk clean, rendering the data irrecoverable.

To review, a format operation primarily deals with the file table, leaving the rest of the data untouched. Disks that have been quick formatted by any operating system or full formatted by Windows XP or earlier can easily be recovered. The key is to run the recovery before the data is overwritten by another application or system operation. Disks that have been full formatted by Windows Vista or later can typically not be recovered.

Note: A full format as performed by Windows Vista and later is also known as a "secure format", since it completely erases residual data so it cannot be recovered by identity thieves or hackers. If you are looking for a tool that is dedicated to reliable, secure erasures and disk formatting, try R-Wipe & Clean.

Unformatting a Disk with R-Studio
R-Studio uses a revolutionary technology called IntelligentScan (UNFORMAT) in order to scan formatted disks for current and previously existing partitions on a disk. Once detected, R-Studio can effectively "unformat" the disk so you can once again access the files and data located on the partition. R-Studio is able to recognize the file system that existed prior to a format, even if it has been formatted to a new file system. For example, if you reformat an NFTS partition as a FAT32 partition, R-Studio will be able to discover both file systems after performing a scan. Recognized partitions can be processed like real logical disks, allowing you to recover files from them.

Additionally, R-Studio features a "raw file search" that allows it to search for known file types, such as Microsoft Word documents or JPEG files from a digital camera, based on their file signatures. This is useful in cases where the partition cannot be recognized, but the data is still present on the disk. R-Studio will scan the disk for common data patterns and recover the crucial parts of the files, in spite of the filenames and folder structure being irretrievably lost.

R-Studio's powerful file recovery and unformat technology is overlain with an extremely user-friendly interface. Recognized partitions that have been recovered are color-coded to distinguish them from current partitions. In most cases, the partition you are looking for will be shown in yellow. You can also see the partition's file system, start point and size to verify that it is the partition you wish to recover. You can also preview individual files found on the partition to further ensure that it contains the important data that you are looking for.

As mentioned above, R-Studio also includes an Extra Search for Known File Types feature that can be used as a last resort if partitions cannot be recognized. This can be utilized by simply checking the appropriate box before beginning the scan, as illustrated below. You may read more about R-Studio's features in the article "File Recovery Software. Why R-Studio?".

To demonstrate how R-Studio can unformat a disk, this tutorial will walk you through the recovery of a disk that has been reformatted from NTFS to FAT32. In this example, the logical disk that we'll be scanning is F:\.

1. Right-click the disk and select Scan... from the shortcut menu.
Unformat_Disk_1.png
Click image to enlarge

2. Review the Scan options and click Scan.
Unformat_Disk_2.png
Click image to enlarge

In most cases, the default settings will suffice. But in order to illustrate the raw file search technology, we'll be enabling the Extra Search for Known File Types option in this tutorial. For more information on the other Scan options, see the Disk Scan section of R-Studio's online help.

3. Wait as R-Studio performs the disk scan. The progress of the scan will be shown graphically, for your information.
Unformat_Disk_3.png
Click image to enlarge

Once the scan is complete, R-Studio will display recognized partitions on the left. These are partitions that previously existed on the disk prior to being formatted.
Unformat_Disk_4.png
Click image to enlarge

In this example, we only have one recognized partition: Recognized0. But in the case that there are two or more recognized partition, you would need to preview the contents in order to determine whether or not it was the partition you were looking for.

4. Double-click the partition to enumerate files on it. R-Studio will show the selected partition's file/folder structure.
Unformat_Disk_5.png
Click image to enlarge

5. Double-click a file to preview it. This lets you verify that the files you want to recover are on the recognized partition.
Unformat_Disk_6.png
Click image to enlarge

If everything seems okay, select the files you want to recover and click the Recover Marked button.

6. Review the Recover Options. Again, the default settings will suffice, though you may want to specify the output folder where the recovered files will be saved. Click OK.
Unformat_Disk_7.png
Click image to enlarge

For more details on the remaining Recover Options, see the Basic File Recovery section of R-Studio's online help.

R-Studio will start recovering files, showing its progress.
Unformat_Disk_8.png
Click image to enlarge

When the data recovery is finished, R-Studio will display the results of the file recovery operation in its log along the bottom of the window.
Unformat_Disk_9.png
Click image to enlarge

The recovered files are now saved to the output folder we specified on the Recovery dialog box.

Note: If recoverable files are detected, but cannot be placed within a recognized partition, they will be placed in the folder called "Extra Found Files". These are files where the filenames and folder structure have been lost completely, but the underlying data is still intact. Thanks to the IntelligentScan (UNFORMAT), these files can be recovered, though they will be assigned an automatically generated filename. You can preview these files to see if they are of interest to you.

To learn more about file recovery from a formatted or damaged logical disk, see the Disk Scan section section of R-Studio's online help.

Also note that, because data on a formatted disk usually remains intact, data can be recovered from a RAID, even if one disk has been formatted. To achieve this, you can create a virtual RAID which includes the formatted disk. Although R-Studio may not recognize the partition while creating the RAID (as it does for most RAID recovery cases), upon scanning the virtual RAID, the partition will usually be detected.

For more information on working with RAIDs, see our RAID Recovery Presentation and the Volume Sets and RAIDs section of R-Studio's online help.

Conclusion
In summary, we've learned that data can be recovered from a disk even if it has been formatted. R-Studio provides two primary tools for recovering data from formatted disks and partitions, both of which are very powerful. In most cases, R-Studio can simply "unformat" a disk by detecting and restoring the partition that existed prior to formatting. Alternately, R-Studio can recover files by performing an Extra Search for Known File Types. This locates recoverable data even if the partition where the files were previously located cannot be detected. Using one or both of these technologies, R-Studio lets you salvage your important data from a purposefully or inadvertently formatted disk.

© Copyright 2000-2014 R-Tools Technology Inc.