Data Volume Reformatted

An all too common mistake is accidentally reformatting the wrong partition. The extent of the data lost depends upon the file system being used and the volume of data written to the new volume afterwards.

In all cases no further data should be written to the volume, as the only method of retrieving the previous files is through data recovery. Some file system types may give very little chance of recovering data, while some will do minimal damage to the old data, unless new files have been copied to the volume.

System Areas Reinitialised

When a file system is reformatted the system areas are reinitialised, which creates a clean data volume. In file systems such as NTFS and XFS only those system areas necessary to produce a working volume are reset. This allows the majority of files to be recovered from a newly reformatted NTFS and XFS data volume, with extremely high success rates possible for these types of data volume.

For a FAT file system, this includes clearing the File Allocation Tables, which destroys the allocation for all files and directories. Other file systems such as UFS, and Linux Extended volumes, all inodes are deleted in the process, rendering the previous file and directory structure inaccessible. For HFS and HFS Plus data volumes, the default catalog and data extent areas are deleted. While some parts of the catalog may remain, in practical terms, this also renders the previous file system data structure inaccessible.

Writing New Data Files is Destructive

Any new data written to the volume will lead to further damage of vital data structures with the possibility of overwriting file allocation or contents. The more data that is written to the newly formatted volume the higher the level of damage that will occur to the previously stored data files.

Reformatted Data Recovery Options

In the best cases such as a newly reformatted XFS or NTFS data volume an almost complete recovery can be made. However, once data is written to the volume, the level of the data recovery possible is reduced.

However for classic Unix style file systems and HFS Plus data volumes, the file system structures and metadata is lost. The only option available in such situations is a raw data trawl of unused space looking for the start of files with known data signatures. This solution will only be successful for files where the data has been stored contiguously.

Deleted or Partition Expansion Failure

With ever larger hard disk drives available expanding the storage space in a computer is now very commonplace. This includes adding additional drives or swapping drives in a RAID for larger ones through rebuilding the data at each step. The temptation after installing extra storage space is to rearrange data and even change the partitions which existed on other drives.

Caution must be exercised when rearranging the data partitions, as one simple mistake may or misfortune could result in data being lost. Understanding exactly which disks contain what data before you start is important if you are going to delete any partitions. Extending or growing partitions, while a common practise can in some cases cause a volume to become corrupted, also potentially losing data. In both cases, best option is not to run any tools or attempt a recovery yourself, but call in data recovery specialists, such as DiskEng, who can advise you on the best course of action.

Deleted Data Volume

Deleting the wrong data volume is an all too common scenario, but it need not cause a total loss of the files held on that partition. When a data volume or partition is deleted, entries held at the start of the hard disk are clear, allowing that space to be reallocated as free space for new partitions to be created. The data volume is not altered by this action, so it is important not to panic and make a mistake.

In some cases deleting a partition may result in an operating system message about an unused disk, which should be reformatted. Be absolutely sure after deleting a volume that creating a new data volume on this disk is what you require. Reformatting a data volume will destroy important metadata structures from the previous partition, which with some file systems may lead to a total loss or data, or a data trawl as the only viable option.

File systems such as NTFS and XFS can produce excellent data recovery results after the volume has been reformatted, as a few metadata entries are overwritten during the process. Any new data written to a reformatted volume will reduce number of files which can be successfully recovered from the original file system.

Expanding Data Partition Failure

Deleting a volume from a disk and then expanding or growing another partition to use that space is now a common procedure. There are many utilities designed to perform this task, which are robust and efficient. However, misfortunate such as a power failure, system crash or file system corruption of the original volume could lead to situation where this process fails, resulting in corruption, whereby the volume can’t be mounted by the operating system.

If this happens, it is essential not to run any tools to fix the problem, as they may lead to even further corruption for the data, which may result in severe data loss. Expanding a volume is usually a fairly simple process, which requires a few key metadata structures to be altered. If this process fails, it is rare that it will cause corruption severe enough to render the data unrecoverable. The wisest choice is therefore to contact a data recovery company, who have the expertise to recover your data files.

Hard Drive is Running Slowly

There are numerous reasons for a hard drive to start running slowly, ranging from the most serious, due to a hardware issue, through file system issues, to software, virus or operating system problems. It is not always easy to determine the cause of the problem, but the one thing you can’t do is ignore it, as it is unlikely to fix itself.

Hardware Issues Risk Total Failure

Often the first stages of a hardware failure will also be accompanied by unusual sounds. These could be clicking and scraping noises or even an odd high pitched metal sound. The best prepared users will already have all their data backed up, but for those who aren’t, it is important to take notice of these signs before that lead to data loss, and need for data recovery.

By the time you start to notice a slowdown and hear unusual noises, it may already be too late to make a complete backup of your data before a failure occurs. All this said, it is also quite possible for a hard disk to start make some odd noises, but continue to work perfectly for years. However, if your drive starts to make clicking noises, total failure is almost certainly imminent as this is usually a sign of unreadable disk sectors, and hard disk data recovery will be required.

File System and Operating System Issues

The operating system deals with all read and write requests between the computer and the hard disk, but in rare instances it is possible for important system data on the file system to become corrupt, and lead to issues with accessing data held on the drive. If left unchecked, situation can become worse. Such problems could be the result of a system crash, power failure or even a virus infection.

When data is written to a file system, the operating system will usually allocate the first available data blocks, and continue writing in a contiguous chunk, until it finds old data, at which time a new area of used space is required. This leads to fragmentation, and on NTFS which has data compression enable, the background process used to compress the file, can lead to further fragments being created. With multiple processes being run, the chances of fragmentation are also increased. Without regular defragmentation, a drive can end up with even a file of only a few megabytes being spread across many areas of the disk, which will slow down access times.

What Steps to Take

If you value your data, you have a responsibility to ensure the file system is in the best condition possible, such as taking care to not install malware and viruses. Regular defragmentation not only helps the speed of access, but can also increase the chances and quality of data recovery in the event of a failure.

If your drive starts making strange noises, it is important to take action. In the event of clicking noises, we recommend powering down the drive and seek a professional data recovery solution. The operating system is very aggressive in attempts to re-read damaged sectors, which can quickly lead to further damage, which can soon spiral out of control.

Hard Drive Has Been Deleted

A common problem which users suffer is the accidental or malicious, deletion or reformatting of a hard drive partition. When this happens, it is important not to panic and make an ill considered attempt to recover the deleted data, which could compound the issue, even leading to total loss of data.

Partition Only Deleted

The deletion of a partition need not be disastrous, but it is important not to make a further mistake. The use of free do-it-yourself utilities are not guaranteed to recover your data, and in the worst cases could cause damage. This is particularly true when the deleted data volume is a spanned or striped set of partitions. Some users erroneously believe that after the deleting a data volume, they can gain access to the data by recreating the partition, but this leads to the partition being reformatted. Once you make a mistake, do not compound the issue by making a rash decision.

Partition Reformatted

Once a partition has been reformatted, the consequences can be anything from only minor damage, to complete loss of data. Copying data to a newly reformatted partition will compound the issue further, by overwriting important system areas of the volume.

Can I Get My Data Back?

The answer to this question is not simple, as it depends upon a couple of very important factors, such as the file system, and the volume of any data written to it afterwards. Many file systems when they are formatted, overwrite the most important system areas of the volume that are required to allow the retrieval of the old data; this includes many Unix and the HFS+ file systems.

The good news is that for NTFS and XFS file systems, an almost complete recovery of the old data may be possible, although writing new data to the volume will diminish the quality of the results which are possible. This is known as Unformatting, a process which our data recovery software at DiskEng has performed many times with excellent results. FAT file systems can also be Unformatted, but the quality of results is also affected by how much fragmentation was present in the files held on the volume.