How to Recover Formatted Data with Partition Recovery Software?

Preview

What should I do if the partition is “formatted” in  business work?

Especially in actual cases, it is often encountered that the data involved in the partition is damaged. How to recover files after formatting a partition?

In this article, you will learn the best way to recover formatted data with partition recovery software.

There are three types of hard disk formatting : quick format, high-level format, and low-level format. Each of the above formats works differently, and the damage caused is also different.

1.Quick format: Rebuild the file management system and keep the data area unchanged.

2.High-level format: Rebuild the file management system and clear the data area .

3.Low-level format:

Media check, disk media testing, dividing tracks and sectors.

Number each sector (C/H/S) and set the crossover factor.

Cover the entire hard drive data storage area and is often used to destroy confidential hard drive data.

Analysis to Recover Data from Formatted Partition

The data can not be recovered after high-level format and low-level format, so this article mainly discusses to recover formatted partition data after performing a quick format operation.

According to the principle of quick format partition, the original file management system of the partition has been deleted and then overwritten by the file system data written later, and the file name, time attribute, related file status identification and other file attributes of the file are stored in the file system. , so the data cannot be recovered through conventional deleted data recovery. Partition data can be recovered through file signature recovery technology, that is, different types of file data can be recovered according to the file content structure.

After quick format , the newly written partition file system will not completely cover the deleted file system of the original partition. There may be leftover directories in the file system, so the investigators can recover data as more as possible by the leftover file system.

Steps to Recover Formatted Data with Partition Recovery Software

Partion Recovery Software: DRS  Data Recovery System

Source: VHD Virtual Hard Disk

Step 1 . Virtual Hard Disk Simulation

• Right-click “This PC”, select “Manage”, select “Disk Management” toenter Windows 7/8/10 Disk Manager.
• Select “Create VHD”(logical storage is equivalent to physical disk) in the “Action” section of the navigation bar, then set the path, size and other related information according to the relevant selection.

• Initialize the virtual disk, then right-click the virtual disk area and select“New Volume”to create a partition according to the prompts, and then copy enough data in the partition (This can make the recovery effect closer to the actual situation).

Step2. Perform the Quick Format Operation for a Particular Partition

Step 3. Select a partition recovery software to perform signature recovery and leftover directory recovery — DRS Data Recovery System from SalvationDATA

• Open the DRS software and select “File Recovery & File Carving”.

• Add an image file of the virtual hard disk, select the partition for formatting, select “Deep Scan” (Deep Scan in DRS supports signature recovery and leftover directory recovery to proceed simutaneously) , and select “Scan” .

Step 4 .  File Confirmation & Storage

• Leftover directory recovery, the investigators can see the file directory name and related attributes.

• Signature recovery; restore according to file type, confirm file name and other related file attributes;

• Save all recovered files.

Notes

1. Pay attention to the following points when the partition prompts to format

• Prompt formatting dialog box, click “Cancel” ;
• Use data recovery tools to quickly scan and recover;
• If the data cannot be recovered by the quick scan, the investigators need to adopt the FSR (File signature Recovery & Extraction technology);
• If the recovery process is stuck, the partition of the hard disk is affected by bad sectors. It is recommended to select the valid target files to recover one by one or make a disk duplication(disk-to-disk image).

2. How to easily ensure that the partition is formatted?

• It can be ensured based on the file creation time of the file system in the partition.

• You can view the partition data through a bottom layer similar to winhex, and ensure whether the partition has actual data through the storage of the underlying data or not.

3. After the partition is formatted, if you want to recover data, remember not to write data to the partition;
4. After the partition is formatted, the file directory of the original partition may be overwritten and destroyed. Leftover directory recovery of the original partition is beneficial to restore the original directory structure (File storage information of original partition);
5. The data recovered from the leftover directory is not all data, remember to combine signature recovery.
6. Since the signature recovery is performed according to the file type, for some special files, it is necessary to first analyze its file structure and then manually add the file signature flag, finally restore the files through signature recovery.

7. For some small files (the file storage location is the MFT file record), after the partition is formatted, they may be completely overwritten and cannot be recovered.