hi to all
in this days trying different tools this happen to me….
i use a 1Gb NTFS pendrive, after a simple complete format performed by windows7 i didn't found inside with the different carving/datarecovery tools
i try with encase foremost scalpel ontrack easy recovery get data back and other but i didn't found nothing od nothing….
my qeustion is…how is it possible? you think i have forget something?
thanks to all
the problem is "a simple COMPLETE format"
a complete format overwrites sectors,
since all data recovery softwares (and carvers) rely on files that were deleted or orphaned on the filesystem without being overwritten, with a complete format (or any activity that overwrites sectors) you won't be able to recover anything.
8| what? you are sure? is to simple delete all evidence files? i not do a wipe but a complete format by windows non with a professional eraser….i think this is strange
a single pass of overwrite is enaugh to make a file impossible to recover.
ok now i try a different things i do a rapid formatt and there is the same situation…what happened now?
A quick format should be recoverable from.
As a simple exercise, fill the disk with jpegs, then a quick format. Then try a raw recovery, or data carving tool, this should find the jpegs. With a 1GB stick, and only a few files, the format may clear down the complete $MFT which will make traditional recovery / undelete techniques fail.
One point to note is how long the format takes. If it takes more than 1 min, it is probably doing a complete format (blanking each sector), less than 1 min, then it will just be rewriting indexes, MFTs etc
If I understand correctly NAND gate based USB drive also have an issue how they write to the storage blocks. Before writing they must "erase" everything on the block in question . . . Rewrite or complete formats, nothing remains.
There was a thread somewhere here about that discussion.
For the record, the behaviour of windows format has changed.
Pre-Vista behaves one way, Vista and later behave DIFFERENTLY.
Here
http//
Old behaviour
http//
New behaviour
http//
The format command behavior has changed in Windows Vista. By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and in earlier versions of the Windows operating system, the format command does not write zeros to the whole disk when a full format is performed.
jaclaz
ok ok and so from now i can't recover nothing from a vista formatted device?? or i can use other technics
if it's a full format, you cant recover anything