I'm trying to recover some data from a hard drive that a friend attempted to format without making a backup. The drive is currently not recognized in "My PC." In disk management, the only option is "Delete Volume" when the drive is right clicked. I would like to perform an NTFS quick format to reduce data loss.
How will deleting the volume affect my data?
Notes:
Deleting the volume doesn't affect the data. With proper tools (not DiskMgmt), the volume can be recreated at exactly the same spot and will have exactly the same contents.
But the problem is that your data was already lost when creating the volume – all previous FAT or NTFS metadata was overwritten by formatting, because that's what formatting a volume does. Similarly, any attempts to format the volume again will only keep destroying what's left.
(General rule: The more you alter the disk, the more likely you are to overwrite some of the original data that you wanted to recover. Therefore, formatting it is the complete opposite of what you want. If you really want to maximize your recovery chances, do not alter anything on the disk at all.)
Most of the actual file data is still there on disk, but there is no longer any information about where it is, i.e. which sectors belong to which files (because the "formatting" procedure throws it away, and formatting it again will not bring anything back).
You might be able to recover many files by using tools such as PhotoRec which scan the entire disk for anything recognizable (only common formats such as MP3/JPEG/Zip). Because this method doesn't rely on having the old file table, it'll work even after the accidental quick-formatting – but it will leave you with a ton of unnamed files that you'll have to sort through, and many of them are likely to be incomplete (fragmented).
I found a few resources that said a "quick format" does not overwrite data on the disk, rather it just removes the reference data. So Delete Volume will only delete the reference data basically? – Craig
Yes, but also kind of no.
There are two kinds/levels of "reference data" that you're thinking about:
1) the partition table knows where volumes (partitions and their filesystems) are,
2) the filesystem lives within the volume and knows where individual files are.
When you 'delete' a volume, it only removes volume reference data from the partition table. This is easy to undo because it's just one partition, and it consists of a single contiguous area that occupied the whole spot – easy to guess where it was.
When you quick-format a volume, it only removes filesystem reference data from the volume. Now that's difficult to undo because you must find many thousands of individual files scattered all over the disk, some of them even fragmented, and all of them will be nameless when recovered.
