Data Volume Reformatted

An all too common mistake is accidentally reformatting the wrong partition. The extent of the data lost depends upon the file system being used and the volume of data written to the new volume afterwards.

In all cases no further data should be written to the volume, as the only method of retrieving the previous files is through data recovery. Some file system types may give very little chance of recovering data, while some will do minimal damage to the old data, unless new files have been copied to the volume.

System Areas Reinitialised

When a file system is reformatted the system areas are reinitialised, which creates a clean data volume. In file systems such as NTFS and XFS only those system areas necessary to produce a working volume are reset. This allows the majority of files to be recovered from a newly reformatted NTFS and XFS data volume, with extremely high success rates possible for these types of data volume.

For a FAT file system, this includes clearing the File Allocation Tables, which destroys the allocation for all files and directories. Other file systems such as UFS, and Linux Extended volumes, all inodes are deleted in the process, rendering the previous file and directory structure inaccessible. For HFS and HFS Plus data volumes, the default catalog and data extent areas are deleted. While some parts of the catalog may remain, in practical terms, this also renders the previous file system data structure inaccessible.

Writing New Data Files is Destructive

Any new data written to the volume will lead to further damage of vital data structures with the possibility of overwriting file allocation or contents. The more data that is written to the newly formatted volume the higher the level of damage that will occur to the previously stored data files.

Reformatted Data Recovery Options

In the best cases such as a newly reformatted XFS or NTFS data volume an almost complete recovery can be made. However, once data is written to the volume, the level of the data recovery possible is reduced.

However for classic Unix style file systems and HFS Plus data volumes, the file system structures and metadata is lost. The only option available in such situations is a raw data trawl of unused space looking for the start of files with known data signatures. This solution will only be successful for files where the data has been stored contiguously.

Comments are closed