recover data from a drive that has been low level formatted [closed]

Question

I low level formatted the wrong drive. I used the WDC DLG diag to write zeros to the drive. Is it possible to recover the data from the drive?

model hard drive wdc wd5000BEVT

Answer 1

Assuming a full overwrite with zeroes (not cancelled part way through), it is impossible with any currently known technology to recover the data. Per NIST Special Publication 800-88, for magnetic spinning drives over 15GB, overwriting with zeros is complete erasure:

Advancing technology has created a situation that has altered previously held best practices regarding magnetic disk type storage media. Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.

Today, in other words, the track density is so tight that there is not enough stray magnetic flux to make any kind of guess what the old data may have been, it will all indicate "zero".

Multiple-pass and random data overwrite policies such as found in the National Industrial Security Program Operating Manual (DoD 5220.22-M) date back to the mid 1990s or even 1980s and were written based upon the technology of that time (such as floppy disks). Technology moves much faster than the related lore around it.

An ability to recover a wiped drive has never actually been demonstrated. See The myth of the 3-pass DoD data destruction policy and Overwriting Hard Drive Data: The Great Wiping Controversy. In Can Intelligence Agencies Read Overwritten Data? Daniel Feenberg concludes that, "Gutmann's claim [that intelligence agencies can read overwritten data] belongs in the category of urban legend." He points out:

Another fact to ponder is the failure of anyone to read the "18 minute gap" Rosemary Woods created on the tape of Nixon discussing the Watergate break-in. In spite of the fact that the data density on an analog recorder of in the 1960s was approximately one million times less than current drive technology, and that audio recovery would not require a high degree of accuracy, not one phoneme has been recovered.

If the zeroing procedure skipped remapped blocks, it may be possible to recover a few blocks (hundreds, maybe a few thousand). In practice, this would amount to very small 512 byte pieces of random files. With a thousand such blocks, you'd only recover about 512k of random data. Not even a single music track would survive, and that's if all the blocks belonged to a single file. The dead blocks would also date back to when they were remapped, and the new blocks would be zeroed.

Answer 2

Oh no, I'm sorry to say but if the zeroing completed then everything is probably gone, if you stopped it halfway through you can definitely get the files back that weren't zeroed.

You could try testdisk/photorec and spinrite. If you can restore the file system with testdisk then boot into windows and run chkdsk to repair the filesystem.

If it wasn't two-pass then you might even have a shot at getting something back from under all those zeros!