Be aware that formatting your hard drive does not guarantee that the data stored inside has been destroyed, and only low level formatting (secure erase) guarantees this. In fact, even if you physically destroy a hard drive (eg by manually scraping platters), there will still be chunks of data that could be recovered with the proper methods.
Recover data from formatted hard drive
You don’t need to be a computer forensic analyst to recover data from hard drive or SSD that has been formatted in the traditional way, as this process simply deletes the data and its index, but does not modify the written data. Specifically, a low-level formatting of the disk differs from the normal fast format in that it rewrites all sectors of the disk, thus ensuring that information that may have been completely wiped out.
On the contrary, if this information has not been rewritten, it is still physically in disk storage, and with the proper methods all data could be recovered (as long as it has not been written to disk since. that they have been formatted). And best of all is that you can do it yourself from home, and you will only need specialized software for this (with a quick internet search, you will find a bevy of paid software that promises to do this. and which, in fact, works in most cases).
What this type of software does is scan each of the sectors of the storage unit to see what it has written; Of course, as there is no index because it is lost during formatting, it is a slow process because you have to go and check sector by sector what is in each of them and then assemble them ( the process in an SSD is much faster than in a mechanical disk, especially if it contained very fragmented information). Because of this, you will not be able to restore every file to where it was, and you will just get a list of files that the program managed to “stitch” together that can be recovered (what you can do is copy these files to another storage medium, because let’s say what you are doing is recovering the raw files with no defined location).
Como supondrás esta manera de recuperar datos de un disco duro formateado (o simplye archivos que hayas borrado por error y quieras recuperar) in her house. Obviously this works as long as the hard drive is in good condition and the type of format applied is normal formatting and not low level, but how do you manage to recover data from physically destroyed hard drive or after? a low level format?
What if the hard drive is physically destroyed?
Many people, concerned about the privacy of their data, attempt to destroy a hard drive before throwing it away (not talking about the criminals who do the same with hard drives before a predictable police investigation). Those with more advanced technical knowledge even perform low level formatting of the drive, but even with this there are ways to recover deleted or destroyed data.
The way to do it is, essentially, impossible without the proper equipment, which is why obviously it is not something that we can do at home and, at the most, we will have to enlist the services of specialized companies. whose prices are quite high. (around 1,200 dollars per TB of information).
Basically, the task is to “piece together the information” by checking sector by sector to see if a one or zero was written, manually and one by one, and then put together the “puzzle” information that would make up the files. As you will understand, the sci-fi part of the CSI-like series is to insert the disc into a machine and have it do all the work for you in a matter of minutes, because things are much more complicated. and may involve days of work. job.
Data can become unrecoverable
In any case, if the hard drive or SSD is physically destroyed, there will at least be parts of the information that are unrecoverable and have been lost forever and, in fact, it is much more likely to be able to recover information. from a mechanical hard drive destroyed than an SSD, because as you know the information is stored in the NAND chips instead of physically (with physical peaks and valleys representing ones and zeros) on the plates of ‘a disk.
Modern computer hard drives contain a large amount of data, including the operating system and applications, as well as user data (which is what you generally want to recover in these cases). The drives also contain backup storage for virtual memory and operating system meta information such as directories, file attributes, and allocation tables, so the chances of recovering the data you are looking for are quite thin.
The most common ways to leave data unrecoverable are as follows:
- Physical destruction of the device, such as sanding down plates or driving a screwdriver into the NAND chips of an SSD.
- Demagnetize a mechanical hard drive to randomize magnetic domains (essentially bring it closer to strong magnets).
- Replace all data on the drive multiple times (this includes low-level formatting, specifically).
In other cases, you can almost always recover data from hard drive or SSD using the methods we have listed earlier in this article.
