Data Recovery Case File · Formatted & Logical Faults · There Was Another Way

The Format That Was Not Necessary

His enquiry was four lines and describes something that happens constantly. "A few weeks ago I tried to format an external hard drive so I could use it on a new laptop. I ended up deleting all the stuff on there." Two things worth saying, in order of usefulness. The data is very probably still present, because a quick format does not erase anything. And — for anyone about to do the same thing — the format was almost certainly unnecessary, because a drive that will not cooperate with a new machine can usually be read another way entirely.

The decode: what the format did, and the question that decides everything

What a quick format actually does: writes a new, empty filing structure at the start of the volume and marks the whole data area as available. It does not visit the data area or overwrite it. So every file that was on that drive is still physically present, unlisted rather than removed — which is why "I deleted all the stuff" describes what he saw rather than what happened.

The question that decides how much comes back: what has been written since. He formatted it several weeks ago, and the crucial thing is whether he then started using it. A drive formatted and set aside is intact. A drive formatted and then filled with new files from the new laptop has had material written over the top, and what survives depends on how much. Every gigabyte written since is a gigabyte of the old contents potentially replaced.

Why the old structures usually survive too: the encouraging technical detail. Filesystems keep backup copies of their key structures at known positions away from the start of the volume, and a new format writes over the beginning without necessarily disturbing those. Where a backup copy survives, the previous filing structure can be rebuilt and files come back with folders and names intact — a much better result than carving, which returns content without names or organisation.

Now the part worth knowing for next time. A drive that a new machine will not use is not usually a drive that needs erasing. Where the drive is formatted for a different operating system, a driver on the new machine will typically read it, and the correct sequence is to read it, copy the contents off, and only then reformat the empty drive. Where the drive is simply old or unsupported, the same applies — get the data onto the new machine first. The format is the last step, not the first. Formatting offers itself so readily, and is worded so much like a repair, that the order gets inverted constantly.

The one instruction now: stop using that drive entirely, including as the destination for anything from the new laptop. It is the only place the old material exists.

On the bench

The drive was removed from use immediately, since the previous contents remain only until something writes over them and continued use as a working drive is what consumes them. It was imaged write-blocked before any reconstruction, and the previous filesystem structures located and rebuilt on the image — filesystems maintain backup copies of their key structures away from the start of the volume, which a new format frequently leaves untouched, and rebuilding from one returns files with folders and names rather than as an unnamed heap. Signature carving swept the unallocated regions alongside, and files were validated by opening.

The outcome

The drive imaged write-blocked, the previous structure rebuilt from its surviving backup copy and carving run alongside. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone who formatted a drive to make it work somewhere new: your files are very probably still there, because a quick format writes an empty structure and marks the space available rather than erasing anything. What decides how much comes back is only what has been written since, so stop using it. And for next time — read the drive on the old machine and copy everything off first. The format is the last step.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.