Remo low level bullshit - Page 1
Forum section: electronics / general

author: MrMobodies
author_rank: Super Contributor
timestamp: October 01, 2020, 04:12:16 am
content: I found this tool claiming to recover data from drives that have been low level formatted.See pictures at bottom.https://www.remosoftware.com/recover-files-after-low-level-formatQuoteI'd thought I'd give this "powerful" "extra-ordinary" tool a go to see what happens on a drive that I just low level formatted.Nothing. No partition found. Not possible this way as I'd thought.QuoteSopowerfulit can magically restore things that aren't there anymore.

author: Cyberdragon
author_rank: Super Contributor
timestamp: October 01, 2020, 05:52:43 am
content: It is sometimes possible to recover data from a wiped drive (albeit, not cleanly, there will be data corruption). For example, if a file has been "permanently deleted" the data is not destroyed immediately, just pointers removed. Even after a format, there can still be residual magnetization (not enough to effect normal operation) that can be detected to recover data. That's why antiviruses often come with "secure delete" functions to overwrite and scramble the data to be destroyed several times to ensure there's no trace. But recovering wiped data usually involves extensive stuff, even taking the platters out and putting them into a special drive to read traces of wiped data.For an SSD, delete probably works the same but a format is probably a clean wipe (not sure though).

author: ConKbot
author_rank: Super Contributor
timestamp: October 03, 2020, 08:04:42 pm
content: Just sounds like normal data recovery software with "low-level" errantly tacked on. Low level formatting(actually having the disc define cylinders and sectors on a platter) hasn't been a thing that gets done outside the factory to hard drives in a good long time now. Marketing wank, but not particularly egregious to the point of calling it false advertising.

author: MrMobodies
author_rank: Super Contributor
timestamp: October 04, 2020, 07:39:33 am
content: Quote from: ConKbot on October 03, 2020, 08:04:42 pmQuoteEasily restore your data from formatted.Notfrom low level formatted.I see, that is how they carefully word the advert in such a way that I believe to wriggle their way out of legal trouble.Yes, in a matter of minitues, to good to be true marketting bullshit.That took 3 hours for a slow 500gb drive like any other recovery would take.

author: Ranayna
author_rank: Super Contributor
timestamp: October 05, 2020, 04:09:56 pm
content: Since Windows 7, the default format under windows will fully write to the disk. I do not know what is written, but formatting (*not* quick format!) will wipe your data.A quick format, if i remember correctly, just rewrites the MFT and therefore will leave recoverable items, but the files will be fragmented and jumbled, and filenames will be lost.Nowadays, the terms (full) formatting and low level formatting are used interchangably. I don't think i have seen true low level formatting since the days of SCSI drives, and even then i'm not sure if that was an actual low level format.The last line reveals the truth, in horrible spelling:QuoteI wonder if that is deliberate...

author: PlainName
author_rank: Super Contributor
timestamp: October 05, 2020, 10:19:28 pm
content: QuoteAre you sure that isn't "sincebeforeWindows 7"? I remember having to always tick the quick format box, but I also know that the last few drives I've installed (as far as I can accurately remember) had it pre-ticked.

author: Halcyon
author_rank: Unknown
timestamp: October 06, 2020, 03:26:20 am
content: Quote from: dunkemhigh on October 05, 2020, 10:19:28 pmOlder versions of Windows and DOS never actually wrote over each sector, even on a full format. All it did was perform a disk check as it went. Since Windows 7, it actually zeros out each sector. There is no recovering from this using any software tool. Even hardware which is able to recover over-written data is extremely expensive and rarely works outside a lab environment.

author: PlainName
author_rank: Super Contributor
timestamp: October 06, 2020, 11:50:50 am
content: QuoteAh, OK!

author: Nominal Animal
author_rank: Super Contributor
timestamp: October 06, 2020, 06:43:52 pm
content: Quote from: Halcyon on October 06, 2020, 03:26:20 amVery true. For spinny-disks, it involves analysing the analog signal from the read heads for both the payload data and the ECC data for each sector, then using all sorts of signal processing to suggest possible interpretations and statistical analysis to find out likely erased contents. I'm not sure if and/or how it is possible/done for flash (SSDs et cetera).They say that with extremely sensitive read heads and lots of processing, it is possible to uncover overwritten data from spinning rust: not just zeroed, overwritten with new, unrelated data. This is ultra-expensive, and I believe requires liquid nitrogen cooled equipment (to get the signal-to-noise ratios needed). This is whyshredding– overwriting the entire drive several times over with random data – is used in security-sensitive situations.(In olden days before journaling file systems like Ext3, Ext4, XFS, JFS, ZFS etc., one could use theshredutility to shred individual files in this fashion. Note that you need to use a cryptographically secure PRNG, though. With current file systems, and even with old filesystems on RAID or Flash with integrated wear levelling (SSDs, SD cards, USB memory sticks, etc.), overwriting the file does not necessarily overwrite the old file data, so only full-disk shredding is reliable nowadays.)

author: PeterJ
author_rank: Newbie
timestamp: March 21, 2021, 03:43:17 am
content: I believe there is no longer any such thing "low level format " that end users can doCould be done back in the 90s?Hard disk tolerances have been reduced to such all amounts that initial disk formatting can only be done in the factory with a special machine . called a "servo writer "best too use linux tool ddrescue.Buy old hard drives on ebay to practice data recovery on - as ddrescue is unforgiving in any mistakesddrescue can skip past damaged parts of the hard disk and come back to it later ...