Home | Products | Download | Purchase | Support

DIY DataRecovery.nl

Unformat type recovery

Before an operating system can use a drive it needs to be formatted. The format process typically creates file system structures such as a boot sector, a File Allocation Table (for the FAT file system) or a Master File Table (MFT, for the NTFS file system).
A boot sector points to the location of other file system structures such as the aforementioned MFT, and stores file system variables such as the cluster-size. All values in the boot sector that address a location are expressed in 'number of clusters' (for example, if the location for the MFT says 64, this means that the MFT can be found in 64th cluster).

Note: if a boot sector is corrupted, depending structures (such as the FAT or MFT) can not be located. In such an event Windows may display the message 'Drive is not formatted, do you want to format it now?'. This type of damage does NOT require unformat recovery software: you can repair the boot sector (perform in-place repairs) by running DiskPatch.

If a drive was accidentally formatted, data recovery may still be possible. The result however depends on a number of things:
For FAT type file systems: file fragmentation is a major factor. Fragmented files are likely to emerge corrupted, and un-fragmented files will likely be fine. The format process destroys a number of important bookkeeping structures on a FAT type partition: the FAT (File Allocation Table) and the root directory. The absence of these structures makes recovery complicated.
For NTFS type file systems: fragmentation is of little consequence. The format process only re-initializes a part of the MFT, most of the MFT remains intact. Using the information stored in the MFT, even fragmented files can be recovered intact.

Consult this page for more information on data-recoverability.

Unformat software is almost as old as the IBM compatible PC itself. Even in the early days of personal computing inventive programmers, such as Peter Norton, created utilities to retrieve files from formatted partitions. Those early unformat tools tried to retrieve the files by re-registering them in the file system (in-place recovery). This in contrast to most of today's tools, which recreate the file on a different drive (salvage by copying). The latter is considered safer; editing the file system directly always includes the risk that you make matters worse. So, although today's 'unformat' software technically does not really undo a format, it's still referred to as unformat software. 

The early day unformat utilities employed several methods: the first method was to save a mirror-image of the file system structures near the end of the drive. If an unformat was required, this mirror-image was copied back over the (damaged) file system structures. This often resulted in messy situations because the mirror-image was never completely up-to-date.
Alternatively the unformat software scanned the disk for directory entries and would rebuild a FAT based on its scan results. This also often resulted in an unstable and unreliable file system as the unformat software assumed all files were un-fragmented (FAT was the dominant file system those days).

Today's unformat software, like iRecover, scans a drive and then rebuilds the file system in memory only! This 'virtual' file system is displayed in some form; in general a Windows Explorer type listing is used. From this window files and folders can be selected and copied to a safe location. After data was salvaged, the (accidentally) formatted drive can be used again.

copy files and folders to safety by selecting them from an explorer-like results window

Unformat type recovery is also useful in situations where a file system is badly damaged; too damaged to rely on existing file system structures. Possible causes of such damage are BIOS bugs, Operating System bugs, or crashing of low level disk software such as defragmentation software or partition and file system resize tools (such as PartitionMagic, the cause of the infamous PqRP).

Note that low quality file- and data recovery software may not be able to recover data if no valid boot sector exists! Such software may rely on data in the boot sector to determine the cluster-size: it can only 'unformat' if you reformatted the drive with the exact same file system using the exact same file system parameters. DIY DataRecovery.nl file- and data recovery software has no such dependencies; necessary parameters such as cluster-size are determined automatically, no matter what type of damage exists. This allows recovery from badly damaged file systems.

DIY DataRecovery. All rights reserved | about