Skip to content

Formatted a Drive or Lost a Partition? Read This

By Srinivasan Krishnappa · Ransomware & database recovery engineer · 656+ ransomware recoveries
6 min read
Need this solved now? We have already solved 656+ ransomware and data recovery cases. Call +91 74187 05822, WhatsApp us or email info [at] asittech.com. Free assessment; no data, no charge.

Formatting a drive by mistake, reinstalling an operating system on the wrong disk, or seeing a partition vanish are among the most common data loss events. In many of these cases the data is still on the disk, and the outcome depends mainly on what is written to the drive afterwards.

What a quick format does

A quick format writes new file system structures and leaves most of the old data blocks in place. Files are no longer listed, but their content often remains until new data overwrites it. A full format is different: on modern versions of Windows it also writes zeros across the volume, which makes recovery of that data unrealistic. If you are not sure which type you ran, say so when you ask for help.

Lost partitions and RAW drives

A partition that disappears is often an entry that has been removed from the partition table (MBR or GPT), and the volume behind it may be intact. A drive that shows as RAW, or that asks to be formatted, usually has damaged or missing file system structures. In both cases the files themselves are frequently still there, which is why the advice is not to accept a prompt to format.

Stop using the drive now

Every new file written to the drive can overwrite recoverable data. Stop using the disk as soon as you notice, and if it is the system drive, shut the computer down, because an operating system writes to the disk continuously, through updates, swap files and logs. Do not install recovery software onto the affected drive, and do not save recovered files back to it.

What not to do

Do not create a new partition, run a disk repair or a file system check, or click Initialize when Windows offers it. Each of these writes to the very areas that describe your data. Avoid restoring an old image over the drive as a test. And be careful with tools that promise to fix the partition table in a single step, as a wrong guess about the old layout can leave the disk in a worse state.

A safer way to work

The safest approach is to make a complete image of the drive first, then search the image for the previous partitions and file system structures. Recovery is then attempted on the copy, so the original disk is never written to and you can try again if the first approach misses something. If the drive has bad sectors or is clicking, imaging needs specialist equipment, and repeated attempts can shorten the life of the disk.

What you can realistically expect

After a quick format with little activity afterwards, a large share of files is often recoverable, though folder names and file names may be lost if the structures were overwritten. Files that were fragmented, very large files and data that was overwritten are less likely to come back complete. SSDs are more difficult, because trim and garbage collection can erase freed blocks in the background. Results cannot be guaranteed, and we tell you what looks realistic after an initial assessment.

Check the result properly

When files come back, open a sample of the important ones, not only the list of names. A file that has the right size but does not open is still lost. Keep the recovered data on a different drive, and once you are satisfied, set up a backup so that the next mistake costs minutes and not days.

Formatted drive recovery →

Facing this problem? Contact us now.

We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.

  • ✓ Free assessment before you pay anything
  • ✓ No data, no charge
  • ✓ NDA on request

Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST

Request assessmentEmergency