HDD GURU FORUMS
http://forum.hddguru.com/

Why some files can't recovered?
http://forum.hddguru.com/viewtopic.php?f=10&t=34847
Page 1 of 1

Author:  hack3rcon [ January 18th, 2017, 10:27 ]
Post subject:  Why some files can't recovered?

Hello.
I have a questions. As I know regular format not remove anything and my questions is that if regular format can't remove anything then why a partition formatted and no files or...copied in it still some files can't recovered?
Please tell me if I wrong.

Thank you.

Author:  hack3rcon [ January 20th, 2017, 4:14 ]
Post subject:  Re: Why some files can't recovered?

Any idea?

Author:  sourcerer [ January 20th, 2017, 6:05 ]
Post subject:  Re: Why some files can't recovered?

It is a bit hard to understand your question. Could you explain your question in more detail? If english is not your native language, perhaps also write the question in your native language?

Author:  hack3rcon [ January 21st, 2017, 3:53 ]
Post subject:  Re: Why some files can't recovered?

sourcerer wrote:
It is a bit hard to understand your question. Could you explain your question in more detail? If english is not your native language, perhaps also write the question in your native language?


Consider a partition that formatted via windows formatting tool and not file copied to the partition. When you recovered the partition then some files can't recovered. why?

Author:  sourcerer [ January 21st, 2017, 16:11 ]
Post subject:  Re: Why some files can't recovered?

The FAT and NTFS filesystems which are used by Windows can use most of the partition space both for data and meta-data (directories, allocation table, ...). Therefore, formatting can also destroy some meta-data.
With a FAT filesystem, I guess you mostly loose the file-allocation table at the beginning of the partition, which contains the information how the blocks of a file are chained together. If you do not have any fragmentation, and you can recognize the beginning and end of the fileformats, then some tools can recover that, but if you have fragmentation (the blocks are not consecutive), you have lost the information which blocks belong together to a file.
If I remember correctly, it could be even worse with NTFS, because the meta-data is always spread across the whole partition.
Perhaps the graphs on page 29 explain it better: https://www.kernel.org/doc/ols/2011/ols2011-suzaki.pdf

Author:  hack3rcon [ January 23rd, 2017, 5:18 ]
Post subject:  Re: Why some files can't recovered?

sourcerer wrote:
The FAT and NTFS filesystems which are used by Windows can use most of the partition space both for data and meta-data (directories, allocation table, ...). Therefore, formatting can also destroy some meta-data.
With a FAT filesystem, I guess you mostly loose the file-allocation table at the beginning of the partition, which contains the information how the blocks of a file are chained together. If you do not have any fragmentation, and you can recognize the beginning and end of the fileformats, then some tools can recover that, but if you have fragmentation (the blocks are not consecutive), you have lost the information which blocks belong together to a file.
If I remember correctly, it could be even worse with NTFS, because the meta-data is always spread across the whole partition.
Perhaps the graphs on page 29 explain it better: https://www.kernel.org/doc/ols/2011/ols2011-suzaki.pdf


But, someone said that Formatting never remove anything.

Author:  sourcerer [ January 23rd, 2017, 6:19 ]
Post subject:  Re: Why some files can't recovered?

Formatting does not overwrite much, but it does overwrite some things. So you should not rely on formatting to really delete your data, but you should also not rely on formatting to preserve your data in a recoverable state. It's not all black or white, it's gray ...

Author:  hack3rcon [ January 24th, 2017, 2:05 ]
Post subject:  Re: Why some files can't recovered?

sourcerer wrote:
Formatting does not overwrite much, but it does overwrite some things. So you should not rely on formatting to really delete your data, but you should also not rely on formatting to preserve your data in a recoverable state. It's not all black or white, it's gray ...

I can't understand. If it is not remove anything then why Metadata is corrupted and if it is remove everything then why you can recover?

Author:  sourcerer [ January 24th, 2017, 2:43 ]
Post subject:  Re: Why some files can't recovered?

It overwrites some things. You can still recover some things, but some things are overwritten.

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/