This is an all too common problem, which can easily happen accidentally or through a malicious act by a user or malware installed on the computer. If this should happen, it is important not to panic as an ill-considered attempt at recovering the files may make the situation a lot worse, maybe even causing a total loss of data.
The best course of action after a partition has been deleted or reformatted is to send the hard disk drive to a professional data recovery company. This is particularly important for a data volume which has been reformatted, as considerable expertise and knowledge is required to affect a successful recovery.
Deleted Partition Only
When a partition is deleted, the only action taken is to remove the entry from the partition table, without destroying any information held within the file system. Although it is possible to download many free or cheap do-it-yourself utilities, they are not guaranteed to recover your data and if not used correctly could even damage information, leading to an unnecessary loss of data.
If a deleted data volume was spanned or striped across a set of partitions, the dangers of something going wrong are considerably higher. We have seen instances where users have erroneously believed that they can regain access to the data by recreating the partition. However if the operating system is allowed to recreate the partition it will reformat the space occupied by the partition. If you make a mistake it is best to calmly consider the options, as a rash decision to attempt to recover the data yourself could result in losing data which could have been easily recovered.
The consequences of reformatting a partition can differ significantly depending upon the file system which has been used. Any change of partitioning scheme or type of file system may also seriously complicate the problem of recovering the data held on the deleted partition.
Should you start copying data to the newly reformatted partition it will further compound the issue, as additional important system areas and data blocks of the volume will be reused. How badly this will affect the chances of recovering data is partially dependent upon the file system used and how much data was written to the newly formatted volume.
Are My Files Recoverable?
If the partition was deleted, the answer is almost always yes, as it is normally a fairly easy process to search for the data volume. However, for a reformatted volume this is not a straightforward question to answer, as already alluded to. The type of file system and the volume of any data written to it afterwards are main factors which determine how successful any data recovery will be. When many file systems are reformatted, they will overwrite almost all of the system areas of the volume that would be required for retrieving the old data; Most Unix and the HFS Plus file system fall into this category.
If you are using an NTFS or XFS file system the news is much better, as it may be possible to affect an almost complete recovery of the old data. Should any new data have been written to the volume it will reduce the overall quality of the results which are possible. All FAT file systems can be Unformatted, although the additional problem of fragmented files will reduce the quality of results which are possible. The process used for recovering files in this situation is known as Unformatting. At DiskEng we have considerable experience of unformatting data volumes using our in-house data recovery software.