Talk:Disk formatting
From Wikipedia, the free encyclopedia
| This article is rated C-class on Wikipedia's content assessment scale. It is of interest to the following WikiProjects: | |||||||||||
| |||||||||||
/unformat undoing formatting
It's relatively untrue that formatting will cause you to lose all your data, a simple /unformat [drive] will usually restore all of the files. — Preceding unsigned comment added by 67.51.19.86 (talk • contribs) 17:57, 15 September 2005 (UTC)
- That might be true of what the page calls "high-level formatting", but I doubt it's true of "low-level formatting". In any case, the "Recovery of data from a formatted disk" section says "As in file deletion by the operating system, data on a disk are not fully erased during every high-level format."; I've changed the second paragraph to say "...some of this data might be recoverable with special tools" (I wouldn't recommend reformatting a disk with an arbitrary file system type and expecting all your data to come back easily). Guy Harris (talk) 23:13, 31 May 2012 (UTC)
- It's still wrong. The data is still there. You can't have any 'might be true' in this document. The facts need to be culled for this article, otherwise the article has no point. Try looking up EnCase to see how data is recovered. Look into Peter Gutmann's discussion. Data is not lost - it's only unindexed if you're just formatting and no more.
Quick Format and NTFS
== == "Never use quick format when formatting a NTFS Drive. There is a chance the drive could become corrupted. Maybe not a big chance, but it is there. Better safe than sorry."
Is there any information/links that back up this claim?
- I'm removing it now. No reference was provided, and it doesn't belong in this article anyway. The article doesn't say what either quick format or ntfs means. --Ropez 08:33, 23 April 2006 (UTC)
No unformatting utility can recover data from a partition that was formatted by the /u parameter. This is not the most secure way of destroying the previous data, instead use something like DBAN to destroy old data, however no disk wiping software guarantees 100% destruction of stored data. Only physically destroying the hard drive itself along with the magnetic particles will guarantee complete security. "No unformatting utility can recover the data, but this is not the most secure way of destroying previous data". This sentence is contradictory as it is.--Ricardo Dirani 14:30, 16 May 2006 (UTC)
While I'm no expert in this field, I do happen to know that it's possible to recover data that has been overwritten a certain amount of times due to minute residu of the overwritten data on the disk - that's about the extent of my knowledge for this particular case. So, while software might not be able to recover the data, someone with the knowledge and technology - and actual drive - could recover the data.
Ah, here's a relevant article: MFSTM. Laogeodritt 14:42, 11 June 2006 (UTC)
- I would not trust the MFSTM article, as it stands at the moment. See the links I posted in Talk:MFSTM, especially this one , and also the arguments discussed in the data recovery article. Mtford 19:59, 15 August 2006 (UTC) == ==
Over writing
I removed this:
", or even better, a low-level format must be performed. This is actually incorrect.
The data can still be recovered through physical means (by consulting data recovery specialists); to prevent this, the drive must be securely wiped, although even this is not a perfect guarantee. Only physically destroying the hard drive itself along with the magnetic plates will guarantee that the data is truly gone, but if you only break it into pieces, the data may still be recoverable if the appropriate method is used"
Anyone who wants this, or similar, put back in, should link to a company, or software, or hardware, that can recover data that has been overwritten. See also Gutmann_method where Gutmann himself debunks the myth about overwritten data being available. DanBeale 11:06, 29 March 2007 (UTC)
- Thank you for adding this note, and the link to Gutmann's own Epilogue statement, where he wrote too many have completely misunderstood what he'd written; and at a time when HDDs were nothing at all like they are today! Daniel Feenberg, whose article is listed as criticism of the so-called "Gutmann Method" there, actually e-mailed me and asked I review his paper. Apart from one of the last sentences which seemed to be a bit too personal about Gutmann himself, in general I'd agree with his assessment of the topic. Even if GOV agencies had some of the equipment paranoid citizens believe they do, they simply cannot afford to waste all the time it would take to find a few bits and pieces of data completely out of any context! BTW, the reason Feenberg contacted me was that he'd found my own web page here: http://thestarman.pcministry.com/asm/mbr/WIPE.html "How To Permanently Erase Data from a Hard Disk". Daniel B. Sedory 10:24, 15 April 2007 (UTC)
- Oh, I forgot to say this: One thing that really irks me are those who throw about the phrase "low-level format" when speaking of hard disks. Many ignorant people continue to promulgate the idea HDDs should not only have this done to them, but that it's even possible; which it def. is NOT for anyone without access to an HDD factory for any modern (like over 12 years or more now) HDD, so I'm quite happy to see anything like that removed from this article! Daniel B. Sedory 10:43, 15 April 2007 (UTC)
Recovery of data from a formatted disk
In the last paragraph, the article states the DOS FORMAT command completely overwrites every sector when run on a floppy disk by writing F6h bytes to each sector. Each sector of a floppy contains 512 bytes which is 200 in hex. Where did he get F6? F6 = 246 in decimal or 11110110 in binary. 246 is an unusual number as most numbers in computing are powers of 2.
Also, the old dos version of format would only write zeros to the sectors if you used the /u (unconditional) option, otherwise the data could be recovered with the unformat command.
The help files on Windows Vista claim that the format utility deletes all data on the disk, unless the quick format option is selected, in which case it creates a new file table without overwriting the disk. The command line format program also has a /p: option which writes a 0 to every addressable sector on the drive multiple times (you supply the number of passes after the /p:). However bad sectors are still a problem as there is no way to determine if the drive was successfully able to overwrite them. If not, bad sectors could potentially contain an image of data previously stored there. David J. Dreier 18 October 2007.
- F6 is the value written to every byte on the disk. Like this : F6F6F6F6F6F6... I will rephrase the sentence in the article.
--Xerces8 (talk) 17:25, 22 November 2007 (UTC)
- David, although Xerces8's recent edit, in which he added "byte value" before "F6h", is helpful, the key idea would have been "filling each sector" with 'F6h' bytes; not just writing it once.
- Do you know which version of DOS wrote zero-bytes during a FORMAT (and not 'F6' bytes)? Have you performed any tests to verify that? That's something I'm unaware of, but could test in the future as I have access to various versions of DOS from a collector friend. Is there anything on the Net or in a manual that specifies what certain versions of DOS write? I've done many tests with the FORMAT command, but don't recall seeing anything except 'F6' bytes during a FORMAT.
- I'd also like to point out for everyone that until VISTA's apparently recent true data deleting function (I've yet to examine that myself), only the formatting of floppy diskettes (and possibly rather small partitions on hard disks), truly wiped all data (that was possible for it to overwrite) from a medium. Performing a FORMAT on large hard disk partitions (of FAT32 and NTFS for example), leaves a great deal of data behind. As the article states, it's only what is OVERWRITTEN that is truly deleted. Daniel B. Sedory (talk) 02:23, 27 November 2007 (UTC)
- I've added information about this to the article -- complete with a screen-capture (made myself years ago for an old listserv) explicitly showing even FORMAT /U failing to always overwrite. Note that in my case, the partition was only 8 MB in size, and also, I was running MS-DOS 6.22a at the time, meaning the partition type would have been either FAT12 or FAT16 (can't remember which it was, but since FAT12 supports up to 32 MB, it could have been either). Also note that while I was using NDOS 8.0 as a COMMAND.COM shell replacement at the time, NDOS 8.0 had no built-in or external replacements for FORMAT.COM or UNFORMAT.COM; so the versions of FORMAT and UNFORMAT used in the screen capture werein deed truly MS-DOS 6.22a's. 71.160.20.130 (talk) 09:40, 6 March 2010 (UTC)
- F6h is the value typically used for floppies and hard-disks on IBM-PC compatible machines, but other vendors have used other values in the past. For example, 8-inch CP/M floppies typically came pre-formatted with a format filler value of E5h, this was also implemented in Digital Research formatting tools, and thereby this value also found its way to Atari ST and some Amstrad/Schneider formatted FAT media. Amstrad also used a format filler value of F4h. Today, harddisks are sometimes initialized with a value of 00h, wheras FFh is typically used on flash disks.
- The BIOS (and DOS) retrieves the value to use from the DPT (INT 1Eh), a data structure typically set up by the BIOS at boot time, but which can be taken over and changed by disk tools later on. Some DOS tools allow to override this value.
- While I would like to learn about any other values used historically (if there are more), the most interesting question is: Why F6h specifically (or whatever else)? As far as I remember, this was originally either just an artifact of the low-level formatting process or/and (if it was variable) "a bit pattern which was particularly good to distinguish for early controllers". I remain vague here as (without looking this up) I don't remember the details of FM/MFM controllers after such a long time, but perhaps it's still a pointer good enough for someone else to find and describe the exact technical reason for this value. --Matthiaspaul (talk) 07:15, 2 August 2012 (UTC)
Best Buy Geek Squad
I am a bit confused over this low level format. As per this article, low level format erases all data and this data is irrecoverable. But i had a discussion with the "Geeks" of "Best Buy", who told me that there data recovery software can retrieve up to 600 GB of data (including over written one) from a 120 GB HD even if a low level format is performed. So, which statement should i believe in?
- Oy vey. I'd suggest that you take a lot of things Best Buy's "geeks" tell you with a grain of salt. Nothing like this can be done with software alone if data is truly overwritten, ever. Period. It was once possible, with older low-density hard drives, to strip them to their bare metal, mount their platters in special microscope equipment housed in clean room laboratories, and partially retrieve overwritten data. With modern hard drives, recovery of overwritten data is simply not possible -- unless the CIA or DIA knows something, in which case they aren't talking, and thus only the CIA/DIA can do it. Read this. Also, don't forget to sign your additions (with four tildes) in the future. :) 71.160.20.130 (talk) 10:16, 6 March 2010 (UTC)
why doesn't format wipe all data?
How can it be that a ("non quick") format does _not_ wipe all data? How exactly is the testing for bad sectors done? If it is done by writing data to each sector and then testing if what's been written is the same what has been read, how can it be that any data is not overwritten and retains on the disk? Anyone who can solve this mystery??? 195.135.137.107 (talk) 15:16, 27 November 2007 (UTC)
In windows 'long' format, testing for bad sectors is done by reading each sector, not writing to it. Modern drives include error correction and sector remapping in the drive controller. If you try to read a sector that's failing, the drive will attempt to recreate the missing data (http://en.wikipedia.org/wiki/Reed%E2%80%93Solomon_error_correction) and write it to a spare sector. It will then update the drive map so that the bad sector is marked bad and there's a pointer to the new 'spare' sector. So simply reading every sector is enough to make the drive 'fix itself'
Also this is a more likely reason why 'zero wiped' drives are still considered sensitive by government agencies. If any bad sectors appears in the life of the drive they're automatically mapped out and never used again. They won't be overwritten if the drive is zero-filled. Any data in those sectors can still be recovered by putting the drive controller into a special diagnostic mode and telling it to directly read the mapped out bad sectors.
118.90.57.194 (talk) 21:23, 14 September 2011 (UTC)
I can't understand one paragraph
Hello, I dont have Englisn as mother tongue. The last sentence: From the perspective of preventing the recovery of sensitive data through recovery tools, the data must either be completely overwritten (every sector) with random data before the format, or the format program itself must perform this overwriting; as the DOS FORMAT command did with floppy diskettes, filling every data sector with the byte value F6 in hex.
Does it mean that the DOS FORMAT can prevent data from being recovered? If I want to keep my data from format-recovery, what should I do? Format it from NTFS into FAT32 then once again back to NTFS?Does it work? —Preceding unsigned comment added by 222.71.122.88 (talk) 04:50, 3 February 2009 (UTC)
"Reformat"
The term "Reformat" would logically mean "to format again", as formed by the suffix "Re-" with the word "format". However, the term "Reformat" is not officially accepted by Merriam Webster's Dictionary, nor by Ask.com's Dictionary. This is possibly due to the term not being any different from the term "Format"; both definitions are the same. —Preceding unsigned comment added by 99.41.247.244 (talk) 21:56, 15 August 2009 (UTC)
Qualified over-general statement, added link, corrected history
I've modified the history section to
- Qualify the reference to the host seeing sectors
- Indicate that sectors are fixed length
- Include links for both CKD and ECKD
- Correct history to reflect that the 3350 was the last drive to directly support CKD and that the disk subsystems after the 3390 continued to simulate CKD.
- Added a reference to support of sector orientation in z/Linux and z/VM. Was this last TMI? Shmuel (Seymour J.) Metz Username:Chatul (talk) 12:56, 29 June 2010 (UTC)