|
Before an operating system can use a drive it needs
to be formatted. The format process typically
creates file system structures such as a boot sector, a File
Allocation Table (for the FAT file system) or a Master File Table (MFT,
for the NTFS file system).
A boot sector points to the location of other file system
structures such as the aforementioned MFT, and stores file system variables
such as the cluster-size. All values in the boot sector that address
a location are expressed in 'number of clusters' (for example, if
the location for the MFT says 64, this means that the MFT can be
found in 64th cluster).
| Note:
if a boot sector is corrupted, depending structures (such as
the FAT or MFT) can not be located. In such an event Windows may display the message
'Drive is not formatted, do you want to format it now?'.
This type of damage does NOT require unformat recovery
software: you can repair the boot sector (perform in-place
repairs) by running DiskPatch. |
If a drive was accidentally formatted, data recovery
may still be possible. The result however depends on a number of
things:
For FAT type file systems: file fragmentation is a major
influence. Fragmented files are likely to emerge corrupted, and
un-fragmented files will likely be fine. The format process destroys
a number of important bookkeeping structures on a FAT type
partition: the FAT (File Allocation Table) and the root directory.
The absence of these structures makes recovery complicated.
For NTFS type file systems: fragmentation is of little
consequence. The format process only re-initializes a part of the
MFT, most of the MFT remains intact. Using the information stored in the
MFT, even fragmented files can be
recovered intact.
Consult this
page for more information on data-recoverability.
Unformat software is
almost as old as the IBM compatible PC itself. Even in the early days
of personal computing inventive programmers, such as Peter Norton, created utilities to
retrieve files from formatted partitions. Those early unformat tools tried to retrieve the
files by re-registering them in the file system (in-place
recovery). This in contrast to most of today's tools, which recreate the file on a different drive (salvage
by copying). The latter is considered safer; editing the file
system directly always includes the risk that you make matters
worse. So, although today's 'unformat' software technically does not
really undo a format, it's
still referred to as unformat software.
The early day unformat utilities employed several methods: the first
method was to save a mirror-image of the file system structures near the end
of the drive. If an unformat was required, this mirror-image was copied
back over the (damaged) file system structures. This often resulted
in messy situations because the mirror-image was never completely
up-to-date.
Alternatively the unformat software
scanned the disk for directory entries and would rebuild a FAT based
on it's scan results. This also often resulted in an unstable and unreliable
file system since the unformat software assumed all files were
un-fragmented (FAT was the dominant file system those days).
Today's unformat software, like iUndelete
and iRecover, scans a drive and then
rebuilds the file system in memory only! This 'virtual' file system
is displayed in some form, usually a Windows Explorer type listing is used. From this
window files and folders can be selected
and copied to a safe location. After data was salvaged, the accidentally
formatted drive can be used again.
|

|
|
copy files and folders to
safety by selecting them from the explorer type results
window. |
Unformat type recovery is also useful in situations
where a file system is badly damaged; too damaged to rely on
existing file system structures. Possible causes of such damage are
BIOS bugs, Operating System bugs (like the 128 Gb / 48 bit LBA bug),
or crashing of low level disk software such as defragmentation
software or partition and file system resize tools (such as
PartitionMagic, the cause of the infamous PqRP).
Note that low quality file- and data recovery software may
not be able to recover data if no valid boot sector exists! Such
software may rely on data in the boot sector to determine the
cluster-size: it can only 'unformat' if you reformatted the drive
with the exact same file system using the exact same file system
parameters. DIY DataRecovery.nl file- and data recovery software has
no such dependencies; necessary parameters such as cluster-size are determined
automatically, no matter what type of damage exists. This allows
recovery from badly damaged file systems.
|