Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I made some monumental level of screw ups recently with a 3TB disk. I accidentally pulled out the cable and RAWed my disk. I then played around with Partition magic and couldn't get things back due to a conflict between the default of MBR and the GPT partitioning I had used to set up the disk.

Then I got impatient at all the messing around I was doing and just went ahead reinitilaized the disk with GPT which recreated partition tables etc and when I started the disk I was prompted to do a quick format. I rushed through the dialog and said "no" thinking "no" I don't want to format at all when I should have said yes as that would have just wiped the file tables.

By saying "no" the disk manager went ahead and started a "full" format, which i couldn't cancel. After about a minute or 2 I deliberately crashed the machine to stop the format so I didn't 00000 out my data.

I thought all was lost and figured every file on the disk was now probably at best a partial and at worst just gone. But then I used WinHex and was able to successfully recover "all" my data.

Unreal.

So my question is where does a full format start? The disk was reasonably new and had never achieved capacity maybe 65%. I had also never defragmented the drive. In my mind this would mean there would be a ton of 0000 at the end sectors of this disk.

I had however expected the full format to start at the first sectors of the disk thus immediately wiping data / being destructive. But it appears since nothing was lost, that a full format actually starts at the end sector and works it's way down.

Is this right and is it deliberate for idiots like me who accidentally start a format they didn't want?

If it is I would like to suggest it's a very clever bit of fore thought on someones behalf.

share|improve this question
    
You don't indicate how much progress the full format made. If it was only 3% complete that would explain your data not being lost. –  Ramhound Apr 11 '13 at 11:29
    
So are you saying a full format starts at the last sector? –  rism Apr 11 '13 at 11:58
    
What type of file partition are we talking about? A format to a NTFS partition would be different then a FAT32 partition. –  Ramhound Apr 11 '13 at 12:07
    
@Ramhound Windows 7 NTFS –  rism Apr 12 '13 at 10:13
    
NTFS file system works like a journal. You write everything you want to write the commit the change. Likewise if you want to delete everything you mark byte to be deleted then commit the change. Besides even if the format had been complete your data likely would have been recoverable, for the simple fact, no other change would have been made to the disk. This is an over simpleification of how NTFS actually works there is much better documentation you can read to learn how it works in greater and percise detail. –  Ramhound Apr 12 '13 at 10:51

1 Answer 1

Even the full format does not 0 out the hard drive. The full format erases the equivalent of the tables of contents and then it reads every sector on the hard drive to make sure it works marking sectors bad when necessary. It is possible some files got overwritten in the process but the vast majority should be there.

TestDisk or PhotoRec

Might able to retrieve your data.

share|improve this answer
    
The data was already recovered. It helps if you read the question before you post an answer. "But then I used WinHex and was able to successfully recover "all" my data....But it appears since nothing was lost" –  Ramhound Apr 12 '13 at 10:48
    
I have already recovered my data thanks but your opening sentence is interesting. It directly conflicts with my understanding of what a full format is. The only way to know is to actually test it I think. I will get a spare drive from the office and see and post results. For instance, this command: format e: /fs:NTFS /p:2 would do a 2 pass zero out of the disk in Windows. But is this the command that the disk management UI in Win7 is using for a full format? What you've written describes what I thought was a quick format..... but so much confusion on the web so now I'm not sure. Will test. –  rism Apr 13 '13 at 1:21
    
A quick format does not read every sector on the hard drive to verify it is ok, but a full format does. –  cybernard Apr 13 '13 at 15:49
    
@rism I checked and the /p:2 flag does in fact zero the drive, but most people don't use that flag. –  cybernard Apr 13 '13 at 20:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.