Recover files from hard drive after formatting. Recovering files after formatting using Auslogics File Recovery

Youtube

Sometimes the user finds himself in situations where he has to format it on purpose or accidentally. HDD or partition on your computer. As a result of formatting, all information from the partition subjected to this procedure disappears. Most often, this happens involuntarily, or data from the hard drive is erased without the user’s knowledge. What to do if the formatted media contains valuable information that must be restored?

Is it possible to recover data from a formatted drive?

A formatted partition or disk can be restored if you get down to business in time. Moreover, you can perform this procedure yourself, completely free of charge.

The task of formatting is to clean the media of all files, viruses and errors on it. A partition formatted in the desired file system makes it possible to increase the performance of your computer.

Types of hard drive formatting

Any formatting consists of the following main steps:

When manufactured at the factory, any hard drive is subjected to low level formatting. At this stage, its physical structure is created. Such markings cannot be changed during the operation of the disk.
The second stage is the creation of several sections on the storage medium. They can be created in almost any number, depending on the disk capacity. The user can independently create such sections.
High level formatting. These are actions to delete files from the media. It is divided into fast and complete.

First, you need to understand what processes occur during formatting of partitions. Without this knowledge, it is difficult to carry out high-quality restoration hard drive . When you try to format any partition, you are prompted to select the method by which you will format it. this action. That is, you can specify whether quick or full formatting will be performed. From the right choice depends and final result all the work.

Let's consider what the difference is between these methods, and whether it is possible to recover information after such operations:

Quick formatting. If you check the box for selecting formatting methods, only the file table will be overwritten. The files themselves will remain untouched. They will only disappear from the visibility of the system. After such actions, it is quite possible to recover information from the hard drive even by means of operating system.
Full formatting allows you not only to hide files, but also analyzes the state of the disk, corrects detected errors and damage. After this, a new file table is formed. Recovering a formatted disk is only possible using a special program. However, in this case there is no guarantee that after such actions all data will be restored.

Attention! If it happened random formatting partitions or the entire disk, new files cannot be written to a supposedly empty disk. The more new information is recorded, the less likely it is that the lost data can then be recovered.

Recovering a formatted hard drive

Let's look at the procedure for restoring information from a disk after formatting. The Handy Recovery program will help us with this.

Main characteristics of the Handy Recovery program:

Complete recovery of data deleted after formatting from any hard drive partitions and removable media.
Working with compressed disks NTFS.
Deep partition scanning.
Ability to create an image for a delayed recovery procedure.
The program indicates the probability of successful recovery of any selected file.

How to work in Handy Recovery

After starting the program, a window opens in front of the user asking you to select the disk from which information needs to be recovered.
You must make a selection and then click the “Analyze” button. Another window will open, displaying the structure of the entire computer.
In order to find all files on the selected media, it is necessary to conduct a so-called advanced analysis. To do this, click the corresponding button at the bottom of the window.
A selection of file types to recover will appear. For example, if you do not need any service files or documents, but want to return photos, videos or other data, then check the boxes only opposite required types files.
If you want to install certain extensions for a certain type of file, then the folder opens by clicking on the “+” sign next to it, and the necessary extensions are indicated there. Actions are confirmed with the “Ok” button.
After the analysis, the program will create additional folder“Unnamed deleted files”, and in it - the “Images” folder. The found files will be located in these folders. The program allows you to restore them to disk. To do this, you can simply right-click on the desired file and select the “Recovery” command that appears.
In the window you need to specify the location to save these files. In the same way you can restore not only separate files, but also the entire folder.
Based on the scan results, you can create an image of the recovered disk. This will simplify the user's actions when repeatedly accessing this data. The next time you start the program, you will be able to continue working with the recovered information.

A quick format is formatting a drive without physically destroying the information stored on the drive, allowing a data recovery tool to get back everything, up to last file? Wrong! The Quick Format command destroys enough information to make recovery difficult and unguaranteed. Let's take a closer look at what happens when you format a drive using the Quick Format command; what can be recovered after and what cannot, and why.

Quick formatting in Windows

So let's see what happens when you quickly format a drive in various Windows versions. Let's start with Windows 7, as the most popular operating system at the time of writing this article.

Majority hard drives, used in desktop and laptop computers and running under Windows, formatted in the NTFS file system. Since XP, Windows cannot be installed on a disk that has a different file system (for example, FAT), so NTFS is the most popular file system when we're talking about about hard drives.

NTFS has a unique and very logical approach to organizing information. In this file system, *everything* is a file. As a result, NTFS stores information about user files such as photographs and documents, in special file systems named $MFT. This file contains entries that identify other files on the disk and contain pointers containing the physical addresses of all the clusters on the disk occupied by this file. To return necessary files, a data recovery tool typically attempts to recover and analyze $MFT. The rest is simple: the tool will "parse" this file and discover all other files on the disk based on the entries contained in $MFT.

What happens when Windows quickly formats a drive? Although no information is actually erased, the system creates an empty $MFT file certain size. The new $MFT is 32Kb in Windows XP, 64Kb in Windows Vista, 256 KB in Windows 7. Each MFT entry is 1 KB long, so a 32 KB MFT can contain information about up to 32 files.

When you start placing files on this created drive, Windows automatically adjusts the MFT size so that it can fit the information about each file and folder created. As a result, $MFT fragments quite quickly. Thus, typical system may have $MFT files containing from 3 to 10 fragments, stored in random places on the disk.

When you quickly format a drive, Windows creates an empty $MFT file in a fixed position. Obviously, the new $MFT overwrites the beginning of the old file with the same name. As a result, the first records in the old $MFT are lost (overwritten). Considering small size If $MFT is empty, the number of files that become unrecoverable is relatively small. Additionally, the first 27 entries indicate system files, which are not so important for data recovery purposes. That is, there are really few unrecoverable files left.

Based on size empty file$MFT created by different versions of Windows, we end up with the following number of unrecoverable files:

Windows XP: The new $MFT is 32 KB. 27 entries point to system files, which means 32-27=5 files are unrecoverable.
Windows Vista: The new $MFT is 64 KB, meaning 37 files are unrecoverable.
Windows 7: The new $MFT is 256 KB, meaning 229 files are unrecoverable.

There is one more thing that is often (if not always) overlooked by non-professionals. If you take an NTFS drive that was quickly formatted in Windows XP (with $MFT of 32 KB in size) and connect it to a Windows 7 PC, the system instantly, automatically, without warning, increases the size of $MFT to the size provided by Windows-7, then there are 256 KB, making the first 229 files unreadable. This is one of the reasons why professional data recovery labs always connect the drive via hardware device, blocking the record. Alternatively, the drive could be mounted as a physical device, which would prevent Windows from mounting the volumes.

The following table shows how many files become unrecoverable after quick formatting disk in different versions of Windows. The numbers in each cell indicate the number of files that cannot be recovered given a given combination of factors.

Data recovery in Windows XP

Data recovery in Windows Vista

Data recovery in Windows 7

Alternative File Recovery Methods

As you could see, traditional methods data recovery that relies solely on the file system ( source file$MFT) may not always recover all files originally stored on NTFS disk. However, there are alternative methods, allowing you to successfully restore missing files, even if they are no longer visible on the file system.

RS Partition Recovery uses an innovative recovery algorithm based on Content-Aware analysis. Content-Aware analysis performs a full disk scan, searching for files based on signatures, that is, looking for files that can be identified by permanent signatures. For most popular file types such as office documents, most images, video formats, databases, Email etc. identifying signatures are already included in the utility's built-in database.

This type of analysis also has its limitations. Signature search works great when identifying files that are stored in one part of the disk contiguously. If the file is fragmented and its parts are scattered throughout the disk, a signature search may not yield results. According to a recent study, the level of fragmentation of user-created important files such as emails, photographs, videos or office documents is relatively high. Thus, it was found that about 16% JPEG files, 17% Word documents, and 22% of AVI videos are fragmented. Email databases are among the most highly fragmented files (up to 58% of such files are fragmented).

However, this is not a reason not to use Content-Aware analysis. The actual likelihood of encountering a fragmented file recovery is extremely low, since these files are usually stored on the hard drive and are rarely modified. And even if you end up with multiple corrupted or incomplete files, such as .jpg photos, you can always use RS File Repair to fix (repair) the damaged file.

And folders or after hard formatting disks and logical partitions. It's okay if an accidental deletion simply places files in the Recycle Bin or even empties it. You can recover such data using simple utilities. But what to do if the disk or partition has been formatted? Now we will consider best programs to restore files after formatting, since this problem is solved purely in software.

How are disks and logical partitions formatted?

First of all, you need to understand what the process of formatting a hard drive and its partitions is. There are two types: quick formatting (clearing the disk table of contents) and full (so-called low-level) formatting.

Let’s make a reservation right away that data recovery can only be done with quick cleaning. If a complete formatting has been performed, no program for recovering files from the hard drive will help.

Let's look at options for formatting disks and logical partitions. Quickly clearing the table of contents only involves overwriting the file allocation tables. In other words, the system is given an indication that the disk or partition is empty, although in fact the deleted data is still physically present there. Just like after emptying the Recycle Bin, during the quick formatting process, the files are renamed in such a way that they are not visible to the system, much less to the user. IN in this case The first letter in the file name is changed and replaced with the “$” symbol.

As for low-level (full) formatting, the situation here is much worse. The data on the disk is completely erased, so that no program for recovering deleted files will find absolutely nothing on it. The difference between these two processes can be represented by simple example. Let's say we have some kind of foggy glass surface on which something was previously written. If the moisture simply dries, the inscription will become inaccessible. Sometimes, if you breathe on it again, the inscription may appear again. This is a quick format. If you walk over such a surface with a sponge with detergent, wiping everything thoroughly, no matter how hard you try, you will not see the inscription again. This is full formatting.

Of course, this is a rather rough example, however, it almost accurately reflects the formatting process. Here you need to understand that any program for restoring files after formatting can only work if the table of contents is quickly cleared.

Is it possible to recover files after formatting?

Naturally, after a quick formatting, you can restore the files. This is why file recovery programs are created. They work, in principle, based on the search for renamed files (as mentioned above), as well as on entries in the MFT (Master File Table) allocation tables, extracting the necessary byte sequences from there.

As for what exactly any program for recovering files from a flash drive or hard drive is capable of, each application of this type has its own capabilities. Some software products are designed purely for recovering multimedia files, others are exclusively for office documents, and still others can restore files regardless of type using a search by extension.

What needs to be done before recovery?

Before you launch, say, a program to recover deleted files from a flash drive, hard drive or logical partition, it is strongly recommended to take into account some important points. First of all, you shouldn't use logical drive, logical partition or removable USB drive, to which data is supposed to be restored to save new information. It is also advisable not to open the Internet browser as it may save temporary files.

The situation is that even if the renamed deleted file is still present on the disk, it can be recovered. But if information is overwritten in this place (sector or cluster), then no program for restoring and formatting files will cope with its direct task, no matter how hard you try.

Next, before recovery, it is advisable to check the disk for errors or for the presence bad sectors. Of course you can use standard means Windows OS with Automatic Repair Job system errors, but it’s better to turn to professional utilities like Victoria. If there is sufficiently severe damage to the surface of the hard drive, you will have to seek help from unique program HDD Regenerator, which is capable of restoring bad sectors by magnetization reversal method.

Recuva

File recovery programs are quite varied. They have different capabilities and purposes in terms of restored categories. Recuva is considered one of the most powerful and advanced applications.

The Recuva software product is a disk file recovery program that is distinguished not only by its rich functionality, but also ease of use. Users of any skill level can understand it.

When launched, the application displays a window indicating the types of files to be recovered (music, videos, documents, etc.). After selecting a category, the scanning process simply starts. In this case, the application requests the location of the files you are looking for. If you are not absolutely sure or the user simply does not remember exactly where the files were previously located, you can use a line that indicates that the location is unknown.

At the end of the scanning process, a full list, which indicates the state remote file. In this case, you can only restore those files whose status is marked as “Good”. Among the advantages of the application, it is worth noting that it contains the function preview, but the downside is the fact that you can only select one from the list of categories at a time.

Please note that during the recovery process it is better not to use the original location where the desired file was stored. It is better to use a removable hard drive or any other USB drive and specify the path to it.

By the way, although it is believed that no program for recovering files from a hard drive gives a 100% guarantee of successful recovery, this application is capable of a lot. And, as practice shows, it even restores some files that other programs simply ignore due to their poor condition.

Pandora Recovery

There's another one interesting program. You can recover deleted files from your hard drive using the Pandora Recovery application.

The application is quite simple. The program itself for recovering files after formatting is intended exclusively for hard drives and logical partitions with FAT32 and NTFS file systems. Although the application can work with removable USB media such as regular flash drives, and even more so with memory cards (as stated by the manufacturer), it nevertheless often refuses to do so.

On the other hand, among the advantages we can note the presence of a special “Wizard” in it, which allows several simple steps configure search. The search, however, is quite slow, so you will have to wait. At all this utility designed more for beginners than for experienced users.

Undelete Plus

An interesting solution is the simple Undelete Plus application. Despite its apparent simplicity, it can be used, for example, as a program to recover deleted files from a flash drive or memory card of any format.

When launched, the program scans the selected disks or partitions, and then displays a complete list of files that can be recovered. Feature this application is that you can set a customizable filter in it, which will sort the data by type or, say, by the date of deletion or the location where it was originally saved.

PC Inspector File Recovery

As already mentioned, file recovery programs are quite widely available. And one of the most powerful utilities is PC Inspector File Recovery.

It will be difficult for the average user to figure it out the first time, but experienced users can appreciate all the possibilities that this offers. software package. Not surprising, because the application can work with FAT12/16/32 and NTFS file systems. Among other things, the program easily recovers information from SATA hard drives and IDE, scanning at the sector level. This approach allows you to find absolutely all fragments of files that survived after formatting, which cannot be determined by regular scanning. Naturally, this application can also be used as a program for recovering files from a flash drive. For example, restoring a photo from a memory card of a modern camera using this utility is as simple as possible.

Free Undelete

Free Undelete is another one free application to recover lost data. The program is one of the most primitive and is designed only for FAT32 and NTFS file systems.

Unfortunately, there is no preview function here, and recovery of multiple files at once is not provided. In each individual case, manual confirmation is required, that is, selecting several files at a time simply will not work. But as a last resort for novice users, the application will certainly be useful.

SoftPerfect File Recovery

This application is another tiny utility with minimum size, which is convenient to store on a Flash drive.

Of course, it is far from professional utilities, but it can even work with NTFS5 file systems. Unfortunately, the program does not show the extent of damage to the deleted file. But, as already mentioned, its small size and fairly high performance make this program very popular among beginners, so to speak, as a last resort.

Diskinternals Uneraser

Diskinternals Uneraser is one of the most powerful and interesting utilities of its kind. It may not be able to scan hard drives by sector, but it can easily restore data even if the hard drive has crashed. Moreover, it starts even from damaged hard drives without any problems.

The application interface is very simple and somewhat reminiscent of standard Windows Explorer. In addition to the fact that the application can work with multiple file systems, it can also be used as a tool for creating an image of an entire logical partition.

Among the disadvantages, we note that this utility is paid. In addition, it simply does not work with versions of Windows OS higher than XP and 2003 Server. But for other “operating systems” in the case home use If the hard drive is damaged, it will do.

What's better?

Of course, we have not reviewed all file recovery programs, however, to summarize, it can be noted that simple utilities are perfect for home use. But if you search comprehensive solution, when you need to take into account every little detail, it is naturally better to use the professional utilities mentioned above. Overall, it's worth just trying each one. software in use, and then do it own conclusions regarding its functionality and ease of use.

If an accident happens and files are lost, it doesn’t matter how it happened - accidental deletion, hard drive failure, or simply a file system failure during reinstallationWindowsto the wrong disk. We all think about how to get our precious data back. But for choice the right way, first you should find out what they aredata recovery programs .

Very often developers similar programs deliberately cut down on functionality, leaving only the ability to search for erased files on various media, while making them completely free and as easy as possible to use. A striking example -Recuva. The program's capabilities are enough to eliminate most common problems.

If the problem is more serious, you need to find a damaged or deleted hard section disk orUSBmedia, and without going beyond the range of certain sectors - here more advanced programs such as PC INSPECTOR File Recovery or GetDataBack can help us.
As a rule, such software is already shareware at best. This is understandable - the abundance of features and unique operating algorithms cost money, but at the same time they guarantee a high percentage of successful recovery of lost files.

The user’s task comes down to choosing software that is suitable specifically for your tasks and the level of knowledge available to you.

In our example, to recover lost data after formatting a hard drive, we will use the professional utility GetDataBack, which is designed for a wide range of tasks, but also - no less important - has clear interface and a very good translation into Russian of specific terms.

There are two different versions GetDataBac programsk- for disks with the NTFS file system and with the file systemFAT. The user is only required to guess what version of the file system was on the disk before formatting. Usually this is NTFS, butFATused on flash drives.

Since the recovery process itself is simplified to answering the Wizard’s questions, we will only have to launch the program and select actions from the proposed options.

In the first window of the Wizard, we will need to select our option for data loss - this is either a file system failure, for example, due to disk programs likeAcronis Disk Director, or unintentional installation of Windows on an already existing section with data. In the latter case, select “Significant file system losses” and so on.

In our example, we will consider the option when Windows installation We accidentally formatted a disk that has data on it and now we want to recover files from it.

In this case, the most suitable item is File system loss. Mark this item in the selection window and click “Next”.

Step 1: Selecting disks for recovery.

Next, the Wizard will prompt you to select a disk on the left side of the window on which we will search for deleted data. Do not forget - this is the physical disk of your computer on which the lost data was located.

Even if you see a damaged partition in the drop-down list of partitions on a physical disk, it is better to select the entire hard disk, as done in the screenshot.

We will not consider all other settings, for example, selective scanning; usually this is not necessary. Therefore, it is better to scan the entire disk, leaving the default values.
But let’s pay attention to the “Settings” sectionin which we note the points:

“Recover deleted"
“Allow duplicate files”

Only now you can begin the scanning process itself by clicking the “Next” button. The progress of the search for data available for recovery is displayed as a ticker.

After the scan is completed, a list of found file systems will open, select it and click “Next”.

In this window we will be able to see the files that are available for recovery.
If necessary, their contents can be viewed directly from the program interface to make sure that the files are not damaged.

Hetman Partition Recovery is the flagship product from the line of programs for recovery deleted documents . Thanks to the advanced data recovery algorithm, Hetman Partition Recovery reliably retrieves both digital documents and other types of files from formatted hard drives, memory cards and USB flash drives. Supporting file NTFS systems and FAT, the program is universal solution for all occasions.

Price: RUB 2,999

NTFS Recovery™ 2.8

If your documents were located on formatted or remote partition NTFS, use Hetman NTFS Recovery. You'll save big by getting essentially the same functionality as Hetman Partition Recovery, with the exception of FAT support. With Hetman NTFS Recovery you can recover documents from damaged, inaccessible or unreadable drives with a 30% discount on the Hetman Partition Recovery price.

Price: RUB 1,999

FAT Recovery™ 2.8

If you need to recover documents from formatted, damaged or inaccessible USB drives, memory cards, then use Hetman FAT Recovery. The tool is identical to Hetman Partition Recovery and offers the same features except support NTFS partitions. File system FAT is widely used on embedded and external media information about what the program does the perfect tool to recover documents from various devices.

Price: RUB 1,999

Office Recovery™ 2.6

Designed specifically for recovering deleted documents and spreadsheets created in Microsoft Office, Open Office And Adobe Acrobat, the program is certainly best choice for working with large volumes of documents. Supporting DOC, DOCX, RTF, XLS, XLSX, PDF, ODT file formats, Hetman Office Recovery quickly recovers documents deleted with "Shift" + "Delete" or deleted from the "Trash". Thanks to built-in document integrity checking, Hetman Office Recovery recovers 100% working files.