If you like crime investigation series (CSI style) you have surely seen that experts manage to recover data from a hard drive or SSD that has been previously formatted or that has even been partially physically destroyed. This is not science fiction but it is a reality, and in this article we are going to tell you how they manage to carry it out.
You should know that formatting your hard drive does not guarantee that the data stored inside it has been destroyed, and only low-level formatting (secure erase) guarantees this. In fact, even if you physically destroy a hard drive (for example by scratching the platters manually) there will still be pieces of data that could be recovered with the proper methods.
Recover data from a formatted hard drive
You do not have to be a computer forensic analyst to recover data from a hard drive or SSD that has been formatted in the traditional way, as this process simply removes the data and its index, but does not modify the written data tracks verbatim. . Precisely, a low-level formatting of the disk differs from the normal fast format in that it rewrites all the sectors of the disk, thus guaranteeing that the information that may have been completely eliminated.
On the contrary, if that information has not been rewritten, it is still physically in the disk storage, and with the appropriate methods, all the data could be recovered (as long as it has not been written to the disk since it was formatted) . And the best of all is that you can do this yourself from home, and you will only need specialized software for it (with a quick search on the Internet you will find a multitude of paid software that promises to do it and that, in fact, works in most cases).
What this type of software does is to scan each one of the sectors of the storage unit to see what it has written; Of course, since there is no index because that is lost when formatting, it is a slow process because it must go checking sector by sector what is in each of them and then put them together (the process in an SSD is much faster than on a mechanical disk, especially if it had very fragmented information). For this reason, you will not be able to restore each file where it was and you will simply get a list of the files that the program has managed to “put together” and that can be recovered (what you can do is copy these files to another storage medium, because let’s say what you do is recover the raw files without a defined location).
As you will suppose, this way of recovering data from a formatted hard drive (or simply files that you have deleted by mistake and want to recover) is not worth a chapter of “CSI” since simply paying for the software license, any user can do it in his house. Obviously, this works as long as the hard disk is in good condition and that the type of format applied is normal and not low-level formatting, but how do you manage to recover data from a physically destroyed hard disk or after a low-level format?
What if the hard drive is physically destroyed?
Many people, concerned about the privacy of their data, try to destroy a hard drive before throwing it away (let’s not talk about criminals who do the same with hard drives before a foreseeable police investigation). Those with more advanced technical knowledge even perform low-level formatting of the drive, but even with that there are ways to recover deleted or destroyed data.
The way to do it is, essentially, impossible without the appropriate equipment, which is why obviously it is not something that we can do in our homes and, at most, we will have to hire the services of specialized companies whose rates are quite high (on the order of 1,200 euros per TB of information).
Basically the task consists of “putting the pieces of information together” checking sector by sector if there is a one or a zero written, manually and one by one, and then putting together the “puzzle” of information that the files would make up. As you will understand, the part that is science fiction of the CSI-type series is to insert the disk into a machine and have it do all the work for you in a few minutes, since things are much more complicated and can involve days of job.
Data can become unrecoverable
In any case, if the hard drive or SSD is physically destroyed there will be at least parts of the information that will be irretrievable and that will have been lost forever and, in fact, it is much more likely to be able to recover information from a mechanical hard drive destroyed than an SSD, since as you know the information is stored in the NAND chips instead of physically (with physical peaks and valleys representing the ones and the zeros) on the plates of a disk.
Modern computer hard drives contain a large amount of data, including the operating system and applications, as well as user data (which is usually what you want to recover in these cases). The drives also contain a backing store for virtual memory and operating system meta information such as directories, file attributes, and allocation tables, so the chances of recovering the data you are looking for are quite slim.
The most common ways of leaving data unrecoverable are as follows:
- Physical destruction of the device, such as sanding plates or driving a screwdriver into the NAND chips of an SSD.
- Degaussing a mechanical hard drive to randomize the magnetic domains (bring it closer to powerful magnets, essentially).
- Overwrite all data on the drive multiple times (this includes low-level formatting, precisely).
In other cases, you can almost always recover data from the hard drive or SSD using the methods that we have listed earlier in this article.