Anyone still running Windows 7?
in Software ·
driftingbadger17 said:After formatting a drive, you can actually recover over 90 percent of your data using simple, widely available tools.
Sent from my Samsung Galaxy S
Of course, a significant portion of data on a formatted drive can be recovered—provided we are talking about a quick format. A quick format doesn't actually wipe the information; it simply deletes the pointers.
However, even with a quick format, a malicious program (like a virus) cannot run
unless you perform a "restore" first using something like Recuva, TestDisk, or a similar utility.
Once a quick format is performed, a mass of bytes remains on the disk. To the operating system, however, this heap of bytes is essentially meaningless because the OS no longer knows how to interpret them. To extract anything useful from that mess, you need specialized tools like the aforementioned TestDisk or Recuva.
If you have a virus sitting on a formatted disk, it is more than harmless; the operating system simply fails to recognize it as an executable program. The OS won't run it, even if it wanted to.
Then there is the practical issue of actually using the drive.
The more you use the disk, the more you overwrite those old sectors.
Consider it this way: you have Windows installed on the drive, looking something like this:
10011001010010000101000000000000000000000000000000 000000000000000
Those zeros at the end represent free space, while that string of ones and zeros represents Windows along with the virus.
When you format the disk, you lose the map telling you what those ones and zeros signify.
If you then install new Windows files, the disk looks like this:
01110001010000101110100000000000000000000000000000 00000000000000
A completely different pattern.
At that point, you haven't just lost the definition of the original bits; you've lost the actual bytes themselves.
In such a scenario, Recuva won't be able to help you at all.
The reality is that while those ones and zeros physically exist on the disk somewhere, once you write new data over them, they are gone forever.
Now, regarding the rumors of viruses surviving a format.
There are several possibilities, but none of them involve a complete format of the drive.
One possibility is that the virus has embedded itself in the MBR.
Another is that it has infected the BIOS, which has nothing to do with the hard drive itself.
A third possibility is that the virus hijacks the formatting software, meaning you haven't actually formatted the disk at all—you just think you did.
There is no fourth option.
