I would like to understand what does formatting really remove.
When launching a computer, something shows up, resembling DOS. This can't possibly be stored on a hard drive ? Where is it stored then ?
I read that there is a boot sector on the hard drive, is there some leftover on the hard drive after formatting it ? Does it really ends up with 0 bytes left on a drive ?
That's really three different questions, with a long, hard road to full understanding.
Let me try to compress that into smaller, simpler ideas...
Think of a hard drive like a reference book with an index at the back to quickly look up relevant sections. Then remove the index. The book is still readable, but only in a more linear fashion. It's harder to find the right chapter, but not impossible.
If you quick format a drive, all you are really doing is removing the 'index' - all the actual data is still there. At this point, if anything were to try to write to the disk, it wouldn't 'know' the old data was there & so would build a new 'index' & write over any old data.
A full format would overwrite the actual data itself - though it may still be recoverable with advanced techniques.
When you boot a computer with a wiped or totally blank hard drive, what you see is a tiny operating system (actually a standalone program, but it acts like a small OS, to all intents & purposes) that is kept in the actual computer hardware, not on the hard drive itself - which just tells the machine where to look next for instructions.
The boot sector is a small sector of the hard drive that contains an instruction telling the computer where to look next for a fully bootable system.
There are 3 questions here.
I would like to understand what does formatting really remove.
Regarding formatting: There are a few methods to format. One is called Quick format. All it does is mark the partition formatted as empty without actually removing the data. The normal format will mark the partition as empty, and in addition write 0's to the entire partition. This will still allow an unformat program to recover data, but it is going to take more time. Then there are also programs that can secure wipe a disk by writing lots of random data to the disk in more than one cycles making it very hard for an unformat program to recover data.
Keep in mind, that once a drive has been formatted, and shows up as empty (even with the quick format method) once you start writing data to it, it will overwrite data on the location where data previously was stored. This will make it hard for an undelete program to recover that specific data.
When launching a computer, something shows up, resembling DOS. This can't possibly be stored on a hard drive ? Where is it stored then ?
Then, the text screen you see when you start a computer is called the BIOS. The BIOS (Basic Input Output System) is the operating system that communicates with your hardware and allows Windows or any other Operating System to interact with your hardware. Given that it sometimes needs to determine when hardware is dying, the BIOS has a text interface and a SETUP program to interact with it. This text interface is what you see when you start up a computer. Do note, MOST BIOSses have a function to show an image instead to not confuse the user.
I read that there is a boot sector on the hard drive, is there some leftover on the hard drive after formatting it ? Does it really ends up with 0 bytes left on a drive ?
The Bootsector of a harddrive is a specific location on the harddrive that only is changed when altering the partitions. The bootsector determines which partition to boot from if you attempt to boot from this particular harddrive. Formatting does NOT affect the bootsector. Altering only the bootsector will still make the harddrive work correctly, except that you can't boot from it.
I would like to understand what does formatting really remove.
When a computer "formats" a disk, or a partition, that means creating a filesystem volume. A "volume" is basically a place where files are stored; for old floppy disks, the entire disk was basically the volume. For hard drives, a volume was stored in a partition, and one disk could have multiple partitions (meaning that it would have multiple volumes).
Basically, formatting ends up creating a blank table. When I say "table", you can think of a chart with rows and columns. Each row refers to a filename. Each column identifies a file fragment. For instance, "the first fragment of this file is at sector 1000". "The second fragment of this file is at sector 2000". The formatting process creates a blank table, and then that table gets filled in as files are created. With DOS, the filesystem type was named after this table, which was called the "File Allocation Table".
If you're not worried about old data, and who might access old data (which might be a concern if that data is confidential/sensitive), then your best bet is to do a "quick format", which just creates the minimum details for the filesystem volume that keeps track of files. If you have a choice between a "minimal"/"quick" format and a "full"/"extended" format, then the latter format is likely to do something to each disk sector that is part of the filesystem volume. That may mean erasing each sector, or just trying to do some other check to make sure the sector is physically usable.
When launching a computer, something shows up, resembling DOS.
Like LPChip's answer, I'm presuming that you mean the "system startup" process. On older machines, this was commonly called the Basic Input/Output System, abbreviated as BIOS. There are certain standards about how a BIOS worked, so that computer software (like the operating system) could interact with parts of the computer. Many newer systems use a newer standard, called (U)EFI ((Unified) Extensible Firmware Interface). I haven't found any term that the industry has widely used to describe both the BIOS and the (U)EFI standards, so I just made up the term "system startup".
The primary reason I would think you might be calling this as "resembling DOS" is the use of text mode. (Good ol' CP437!) However, from what I've read, I've had some impression that (U)EFI can be controlled with a command line (maybe with just some implementations).
This can't possibly be stored on a hard drive ? Where is it stored then ?
This is typically stored entirely in some chips. On older systems, these were ROM (read-only memory). However, when new technology (like bigger hard drives) became incompatible with the chips, people had to physically replace the chips to support the newer technology. In the late 1990s, people started using writable memory, which they often called "flash memory". Such memory is not intended to be written to very frequently.
When you change configuration options in that system startup softare, your configuration's details get stored into some other memory, commonly called CMOS. That is a small bit of memory (different from your RAM), stored on the motherboard.
I read that there is a boot sector on the hard drive, is there some leftover on the hard drive after formatting it ?
Systems using the BIOS standard would check hard drives to see if the 511th and 512th bytes contained these bits: 0101 0101 1010 1010
If so, the disk was considered "bootable", and the BIOS would tell the CPU to start following the instructions located on the first byte of the disk. The first 512 bytes of the disk were called the "Master Boot Record" ("MBR"). Code stored in the MBR had to be rather small, because the 511th byte had to be 01010101 if the computer was going to boot. Actually, what most of this bootable code would do is to check the 447th through 510th bytes using a standard called the "partition table". Bytes in that table would specify where there was a partition (or more than one partition). Commonly, the first partition would start on the second Cylinder of the hard drive. (With old hard drives, the term "cylinder" referred to a physical characteristic of the hard drive. That meaning was a bit lost when Logical Block Addressing often made the numbers correspond less to the disk's physical design.) The main job of the code in the MBR would be to check the partition table to see where the filesystem volume started, and then start running code from that location.
(U)EFI is a bit more complicated, understanding the more complicated GPT structure.
In any case, formatting has nothing to do with this. Formatting is related to data within the partition (often starting on the second cylinder, which was often called Cylinder number 1, because the first Cylinder was often called Cylinder number zero). So formatting should not affect the initial boot code that the MBR uses on the disk. However, formatting may affect the code that the computer tries to use after the MBR's data is used.
Does it really ends up with 0 bytes left on a drive ?
You mean 0 bytes used up? Absolutely not. There are absolutely bytes used up on the drive. The partition stores the filesystem volume, which contains the table that will be used to keep track of filenames and where the file's fragments get stored. Commonly there are other details, such as a "label" (which is a name you can assign to the filesystem volume). This ought to be a relatively small amount of the disk's total data, but this is a part of the disk that gets used up.
When you ask your operating system how many bytes are available, the operating systems typically report how many bytes can be used to store files. That is the data that most people are interested in. The operating system is not reporting the bytes that are used to store the file table, nor bytes outside of the partition (like the MBR).
However, since the table is empty, all bytes that can store file fragments are available, and zero of those are used up. The contents of old files might be on the disk, if the disk was quick-formatted. (A program like TestDisk may be able to help find such contents.) However, when you ask the operating system to store new content in new files, the operating system will use those areas of the disk (because the table doesn't say that those areas of the disk are storing any file fragments that we care about). So, the old data can get overwritten by new data (which will cause TestDisk to be able to recover that old data when it happens). Note that even if the contents of the files are saved, details like the names of those files might have been overwritten when the disk was formatted. (I say "might" because there are different ways to store files. Some of those ways of tracking data might involve a table that has a consistent size, using up space to keep track of sections on the disk even when those sections aren't storing files yet. Other methods might vary the table's size depending on what data is stored on the disk, so an empty disk may have a small table. So maybe some of those filenames are still physically stored on the disk, but the operating system isn't keeping track of that old data, and so that data is also likely to be deleted when the operating system finds a benefit to doing so.)
Does formatting really remove everything on a physical hard drive? I would like to understand what does formatting really remove.
Based on actual experiments (rather than guessing or referencing another source), what old data that is overwritten will depend on how you perform this "format".
When a partition is created and formated by Linux (using GParted) (for either NTFS or Ext4) or "quick" formated by Windows 7, only a minimal number of sectors are overwritten sufficient to initialize the filesystem. Sectors that are unallocated (and free to be used by user files) are untouched and retain old data.
When a partition is created and formated by Windows 7 (not using the quick option), all sectors in the partition are overwritten. The old data in sectors that are unallocated (and free to be used by user files) are ovewritten with zeroes. There will be no "unformat" possible to recover old data and files.
When launching a computer, something shows up, resembling DOS. This can't possibly be stored on a hard drive ? Where is it stored then ?
You are probably referring to either the BIOS or UEFI program, which would be (typically) stored in a flash memory chip (on the motherboard).
You can easily verify that this standalone program (which is not an operating system) is local to the PC and not on any HDD or SSD by restarting the motherboard with no drives connected. (Of course disconnect the drives while the PC is not powered.)
I read that there is a boot sector on the hard drive, is there some leftover on the hard drive after formatting it ?
There is a boot program that exists in the first sector of the drive (e.g the MBR, Master Boot Record), and another boot program at the beginning of each bootable partition.
The MBR is a simple boot program that loads the boot program of the partition that is marked "active".
The active partition's boot program will be installed by the filesystem. It could be another intermediate loader for a boot program capable of actually loading an operating system (e.g. GRUB).
Does it really ends up with 0 bytes left on a drive ?
It's not obvious what you're asking.
Note that there will be sectors that are not allocated to any partition that will never be written by any kind of format. There could be as many as 1024 (partition creation by Linux) or 2047 (partition creation by Win7) unused sectors between the MBR and the first partition. There could also be unused sectors in between partitions. The actual number of sectors could vary, depending on where the previous partition ends, and where the "adjacent" partition begins, which will depend on the type of partition alignment (e.g. on a "cylinder" or per megabyte).
Older hard drives had a mechanism to move the head in discrete steps; information about where each sector starts was stored in the same "data stream" as the contents of the actual sectors. To write sector #5 of a track, the drive would start in "read" mode until it saw a marker "This is the start of sector #5", switch to write mode, write a little blank space followed be a secondary-start marker, start spewing out all the bytes in the sector, and then switch back to read mode when that was done.
If a track wasn't known to have a suitably-placed set of sector markers (as would be the case with a totally-blank unformatted disk), it would need to be formatted before use. To do that, the drive would switch on write mode, write a gap, and then repeatedly write a sector header, a slight gap, a secondary-start header and a sector's worth of arbitrary data, and another gap. After doing that, the drive would switch to read mode and ensure that all the sectors were readable (if the gaps between sectors were too long, the last sector might overwrite the first; if the gaps are too short, variations in drive speed might cause a later sector-write operation to extend into the next sector).
Doing a "low-level" format on such a drive would pretty well erase any information on it, but would take longer than a typical "high-level" format command which simply ensures that every sector is readable without bothering to rewrite sector headers of sectors that are.
Modern drives require formatting markers that are put onto the platters using specialized equipment which is more precisely calibrated than anything in the drive. Doing a low-level format on such drives would be impossible without extra equipment. Overwriting the data in all sectors would probably render most of it unrecoverable, but some drives have special logic to detect when areas of the disk seem to be going bad and relocate information that would normally be stored in such areas, elsewhere. If a sector containing confidential data gets relocated because the drive thinks it might be on a flaky part of the disk, subsequent attempts to erase that sector might destroy the later copy while leaving the original untouched.
No, firstly formatting is a process performed on a partition and not the drive as a whole so it doesn't affect the partition table, other partitions or the MBR on the drive. What you are seeing sounds like the bootloader, this is a small program which is executed directly by the bios which then has the task of selecting and executing the operating system kernel, in this case the partition having been formatted means the bootloader can't find the kernel to execute.
That said even if the process applied to the entire drive it's a mistake to think formatting actually removes the file contents from the drive as it actually does no such thing. What happens when the drive is formatted is that metadata like the file allocation table, superblocks etc is cleared and an empty structure is written in it's place.
The actual contents of the files are unaffected by the formatting process itself. An analogy would be blanking out the table of contents of a book the chapters would still be there even though there is no table of contents to list them.
Software exists which can ignore the metadata and look directly for the actual footprint of the files themselves on the drive and it is fairly trivial in most cases to recover files unless some of the space occupied by the file has been reused and overwritten by new data.
If you actually wanted to destroy the data on the disk there are methods though which would be appropriate depends on factors like the type of drive (SSD's have easier ways to secure erase than HDD's for example), for magnetic drives another factor is just what level of destruction is desired. There is a difference between destroying data so it can't be recovered by a commercial hard drive and trying to destroy it to the point highly sensitive forensic analysis equipment can't recover any trace of the data.
EDIT: Note unless the machine has been bricked by an interrupted BIOS update or similar even a machine with a entirely blank drives installed will show something when you try to power it on. The BIOS isn't stored on any drives it's a small program stored in a small solid state memory chip on the motherboard itself.
