What is a Full Format
A full format refers to completely erasing and reformatting a storage device such as a hard drive or SSD (solid state drive). It overwrites all sectors on the drive with zeros or random data to make any previous data unrecoverable (Source: https://www.lifewire.com/how-to-erase-a-hard-drive-using-diskpart-2626157).
This differs from a quick format, which simply erases the index of where files are located on the drive. The data itself remains intact and recoverable with the right tools. A full format takes much longer since it physically overwrites all data (Source: https://www.howtogeek.com/125215/what-does-quick-format-mean-when-formatting-a-drive/).
Full formats can be done on Windows, Mac, and Linux operating systems using disk utility tools like DiskPart, diskutil, or shred. The process overwrites all sectors, making previous data unrecoverable without very advanced forensic tools (Source: https://www.lifewire.com/how-to-erase-a-hard-drive-using-diskpart-2626157).
Formatting vs Erasing Data
There is a common misconception that formatting and erasing data are the same thing. However, there is an important difference between the two processes (Source):
Formatting a drive simply prepares it for use by organizing the storage into readable sectors and creating a file system structure. Formatting does not actually erase or overwrite any data on the drive. The previous contents still reside on the disk, but the operating system no longer maintains their file structure or allocates the clusters that previously contained files and folders. So formatting alone leaves data intact but inaccessible via normal means.
Erasing data, on the other hand, involves deliberately overwriting the existing data on a drive. This renders the original contents unrecoverable. Erasing can be done in several ways – a full overwrite with zeros or random bits, multiple passes to ensure data cannot be recovered, or using drive erasing algorithms that meet certain security standards.
So in summary, formatting prepares the drive for reuse but does not inherently erase data, while erasing (also called data sanitization or disk wiping) actively overwrites data to ensure it is scrubbed from the disk.
Common Misconception: Formatting Deletes All Data
Many people think formatting deletes all data. If you ask someone on the street what happens when you format a drive, they will likely tell you that formatting erases everything on the drive. This is a very common misconception that formatting wipes a drive completely clean.
However, this is not actually the case in most situations. When you format a drive in a typical way, such as quick formatting or using the default options, the drive is not erased in a secure manner. The majority of the data remains intact and can be recovered using data recovery software.
The misunderstanding comes from the fact that formatting makes data inaccessible to the operating system and apps. But just because you cannot see or access the files anymore does not mean they are gone for good. The data itself still resides on the physical drive, even after formatting.
How Formatting Works
Formatting an internal hard drive or external storage device like a USB drive does not completely erase all the existing data. Instead, formatting recreates the file system on the drive without overwriting the existing data blocks. When you format a drive, the operating system goes through and sets up a fresh file system – this involves creating a new file allocation table, marking the disk as empty and available to store new files.
However, the existing files and data blocks are not actually erased. The format process simply marks all those data sectors as available for new data to be written over. Until they get overwritten, the original data remains intact on the drive. Forensic data recovery tools can scan drives and rebuild the file system to recover formatted data, as long as it has not yet been overwritten. So formatting does not securely erase data, it just prepares the disk for reuse by designating all storage sectors as blank and available for the operating system to write new files.
When Data Is Erased
Formatting a drive does not inherently erase the existing data on it. Instead, it resets the file system structure so the drive appears empty to the operating system. The actual data still physically remains on the disk until it gets overwritten by new data.
When a file is deleted or a drive is formatted, the operating system simply marks the existing data as free space available for new data. The old data itself is not erased right away. It remains intact until new data is written over it. Essentially, old data gets erased when new data overwrites it.
Some formatting tools, however, can be configured to actively overwrite existing data during the formatting process. This overwriting renders the old data unrecoverable even with advanced forensic tools. For example, utilities like Diskpart on Windows or dd on Linux can be used to overwrite all data with null characters when formatting a drive. This achieves a more complete erase prior to reuse.
Cited from: https://www.quora.com/How-much-data-is-lost-on-a-hard-drive-when-formatting
Recovering Deleted Data
Formatted data can often be recovered with the right tools and skills. When a drive is formatted, the file system information telling the operating system where files are located is erased. However, the actual data usually remains intact until it is overwritten by new data. Special data recovery software can scan the drive and rebuild the file system to make previously formatted files accessible again.
There are several leading data recovery programs that can effectively recover deleted files from a formatted drive, such as EaseUS Data Recovery Wizard, iCare Recovery, and FonePaw Data Recovery. These tools scan the raw data on the drive and reconstruct the file directories and metadata that was erased during formatting.
The better the software, the higher the chance of recovering a significant portion of the formatted data. However, results depend on various factors like the formatting method used, if any new data has overwritten the deleted files, and the overall drive condition. The sooner data recovery is attempted after formatting, the better. Advanced users may also attempt manual data recovery using Linux tools like Testdisk.
Secure Formatting Methods
There are tools available that can securely erase data by overwriting it multiple times, making the original data unrecoverable. Programs like Dban (Drive Erase) utilize special algorithms to repeatedly overwrite the hard drive with random data.
Dban and similar software perform multiple passes – typically 3 to 7 overwrite passes. Each pass writes randomized 1s and 0s over the entire drive. This ensures that the original data is completely overwritten bit by bit and can not be recovered by forensic tools. The more overwrite passes, the more secure the formatting.
As noted in a popular data erasing tool, “Active@ Live CD,” these methods of secure erasing ensure that data can not be recovered even by government agencies or advanced data recovery services. The data is essentially wiped clean from the hard drive through these multiple overwrites.
When Formatting Is Sufficient
For personal devices like laptops or desktop computers used at home, a simple format is typically enough to prevent casual data recovery. As explained on Reddit, “Windows formatting is not intended to offer any kind of security. Definitely not enough for a potential corporate adversary. If it’s a HDD, use encryption if you actually care about real security” (source). The standard Windows quick format and full format options erase file pointers and overwrite the master file table, making data difficult but not impossible to recover.
The sensitivity of the data should be considered. For a home PC that does not contain highly confidential financial records, medical information, or other sensitive data, a full format is likely sufficient. As one Quora user explains, frequent formatting does not damage computers and “is actually recommended as a way to clear out accumulated digital cobwebs and keep things running smoothly” (source).
Precautions
Before selling or disposing of storage devices, it’s important to take precautions to protect your data. Simply formatting a drive does not completely erase data. With the right recovery tools, someone may be able to recover deleted files even after a full format (Magoshare, 2022).
If the data on your device is sensitive or confidential, take extra steps to securely erase it. Use professional data destruction software that overwrites the drive multiple times to make data unrecoverable. Or remove and destroy the physical drive if the data is highly confidential (NBC News, 2012).
Before selling a used device, be sure to remove any personal files, uninstall licensed software you can’t transfer, and reset the device to factory conditions. Additionally, enable encryption features if available. This helps protect data if the reset fails or isn’t performed properly (LinkedIn, 2014).
With the proper precautions, you can securely wipe personal data from a storage device before sale or disposal. Carefully research the right methods for your situation, especially if sensitive information is involved.
Summary
In summary, formatting alone does not permanently erase data on a storage device like a hard drive or USB drive. When you format a drive, it clears the directory structure and marks the existing data as available to be overwritten. However, the underlying data remains intact until it is overwritten by new data.
If you need to securely erase sensitive data, using the standard formatting tools built into your operating system is not sufficient. Specialized disk utility software utilizes secure erase algorithms to completely overwrite data making it unrecoverable. Some examples include DBAN, Active@ KillDisk, and Parted Magic.
The key takeaway is that a quick format on a storage device simply clears file references and does not actually remove or erase the underlying data. Only rewriting over the entire drive with new data or using a secure erase tool can guarantee the data is completely deleted and unable to be recovered.