Formatted it? Don't copy any new file.
Data Recovery After Formatting & Deleted File Recovery
A format doesn't always mean the files are gone for good, but using the device afterwards can lower the recovery chance. Stop using it and don't copy any new data.
- +25
- Years of experience
- +50K
- Cases handled
- 99%
- Success rate after diagnosis
Empty space may not actually be empty.
Can files be recovered after a format?
- 01
Hard drive or SSD
The disk was formatted or a partition was deleted by mistake.
- 02
Flash or SD card
Photos or files disappeared after a format.
- 03
Deleted files
Important photos, documents or videos were deleted.
What happens after the format matters more than the format itself.
Recovering photos and documents after a format
In many cases the data stays recoverable if no new data has been written over the old space. The result varies by device type, format method and how much the device was used after the loss.
Inspect the case
Choose the path
Safe recovery
Supported devices & brands
The devices and file systems we inspect after a format
A format is not one single operation. What survives depends on the file system, the type of format and the medium itself. So the inspection starts by establishing those three before anything is read.
Windows disks on NTFS
A quick format writes a small new file table over the start of the partition only, and records from the old file table ($MFT) often survive where they sat. A full format is a different case entirely, because it passes over the whole partition.
Flash drives and cards on exFAT or FAT32
These file systems keep no journal, and the allocation table is small and quickly rewritten. Recovery usually falls back on file signatures, and fragmented video is the hardest part of it.
Macs on APFS and HFS+
Erase builds a new APFS container, and a snapshot or a Time Machine copy may still hold the files intact. On Apple silicon and T2 machines, Erase All Content and Settings destroys the encryption key, and that alone can change the verdict on the case.
Linux servers and NAS volumes on ext4
mkfs writes fresh inode tables over the old ones, but backup superblocks and journal remnants can rebuild part of the directory tree with its original names.
Deleted partitions, GPT and MBR
Deleting a partition, or running clean, changes a handful of sectors at the front of the disk, while the file system itself stays where it was further in. The first move is to locate the old partition boundaries, not to recreate them.
SSD and NVMe after a format
After a format the system may issue TRIM commands that actually clear the pages, rather than only marking the space as free. That is why the disk is taken out of service at once, and tested for whether it now returns zeros before any attempt.
How a post-format case is handled
- 01
Read the medium once, into a full image
The medium is connected through a write blocker and imaged sector by sector in the lab. Everything after this runs on the image, and nothing is written to the original.
- 02
Look for the old file system first
We search the image for records of the previous file table, boot sector copies and earlier partition boundaries. When they are found, files come back with their original names and paths, which is the best possible outcome in these cases.
- 03
Signature analysis for what no longer has an index
Space no longer covered by any index is read by format signatures: RAW and JPEG images, documents, video. The contents return without names or folders, sorted by type and by internal date where one exists.
- 04
Verify, then hand over on a separate medium
We open samples of every type to confirm the files are intact and not just names, and remove duplicates. The result is handed over on a separate drive, with a statement of what did not appear in it.
Start from the action
What exactly happened?
The word 'format' describes very different actions, and each has a different outcome.
- 01
Quick format
Creates a new file system, removing or replacing parts of the indexing data, but that is not always the same as writing over every sector. The odds depend on the medium and on what was written afterwards.
- 02
Full format or secure erase
May write across the disk or send removal commands to the medium, at which point the odds fall sharply. We need the tool's name, the type of operation, and how long it took before any estimate.
- 03
Deleting or creating a partition
File data may still be there, but the partition start and file system information have changed. Do not create further partitions and do not try to 'repair' the partition table on the source.
- 04
Installing a new operating system
Windows or macOS writes system files, updates and temporary files over parts of the old space. Files may return from regions that were not overwritten, while the folder structure in the installation area is damaged.
- 05
Ordinary deletion or emptying the bin
It does not necessarily mean the file's contents vanished at once, but continuing to use the machine can write over them. Stop applications, syncing and downloads, and do not install recovery software onto the same disk.
The decisive factor
The medium changes the outcome
HDD
A great deal may survive a quick format if nothing was written over it. File-system metadata can be analysed or files located by their structure, with the possibility of losing names and folders if the metadata was damaged.
SSD and NVMe
TRIM commands may be sent for space that became unused, reducing the chance of recovery. An HDD outcome cannot be applied to an SSD, and no promise is justified before the system, the operation and the drive's state are known.
Memory cards and flash
The outcome depends on the controller, the file system, and use of the card after formatting. New shooting can overwrite older clips quickly, and some videos need reassembly even when their raw data returns.
An encrypted drive
The old contents may be encrypted with BitLocker, FileVault or another device's encryption. Recovering sectors technically does not bypass encryption: the recovery key or password is still required.
Between the extremes
Common cases and likely outcomes
- 01
An HDD quick-formatted and not used since
One of the cases that deserves prompt examination. The structure or a large share of files may return, but nothing is guaranteed before an image is taken and analysed.
- 02
Windows installed after the format
Some regions may have been overwritten by the system and its updates. The outcome varies from folder to folder, and files may return without names or with damaged parts.
- 03
The partition was deleted and the disk shows unallocated
Do not create a new volume and do not format it. Only the partition table may be missing, and the start and end of the structure can be analysed on an image.
- 04
An SSD was formatted and kept in use
The odds fall because of TRIM and later writing, but assessment needs the system details and the type of operation. We use neither 'impossible' nor 'guaranteed' before examination.
- 05
A camera card formatted, then shooting continued
Clips may be overwritten in sequence, so newer recordings return while older ones are damaged. Stop shooting and identify the date and the files you need.
- 06
The disk asks to be formatted without the user formatting it
This is not necessarily an 'after format' case: the file system may be corrupt or the disk unstable. Do not agree to the prompt; the case is assessed as a logical or physical fault.
Plainly
What to expect from the result
These are the real possibilities, not a single scenario.
- Folders and names may return intact if the metadata survived.
- Files may return with generic names and without their original paths.
- Some files may return incomplete or unopenable because parts were overwritten.
- More than one version of the same file may appear.
- Finding a file does not mean it is intact; a documented sample is opened before the result is accepted.
- If a region was genuinely overwritten, no tool returns the old bits from it.
What we need for the initial assessment
- 01
Medium type
HDD, SSD, NVMe, USB, SD or something else.
- 02
Make, model and capacity
And the operating system in use.
- 03
Exactly what was chosen
Quick format, full format, reset, partition deletion, or unknown.
- 04
File system
The old and the new, if known: NTFS, exFAT, APFS or HFS+.
- 05
Time and use
Time since the loss, how much use, and files copied afterwards.
- 06
What was installed onto it
Whether an operating system or recovery software was installed on the medium itself.
- 07
Encryption
Whether BitLocker, FileVault or a password was in place.
- 08
Priorities
File types, folders and the period you need.
- 09
What was tried
The software or repair commands that were run.
FAQ
The chance depends on what you did afterwards.
Not always; data may stay recoverable if it hasn't been overwritten.
It's possible in many cases; the result depends on how the device was used after the format.
It can be harder because of how data is managed, so the case should be inspected first.
They may, if the file-system metadata survived. If it was overwritten, content may be recovered by file type without the original name or path.
Whatever was not overwritten may be recoverable. Updates, downloads and new use reduce the old space available, and the outcome varies from folder to folder.
The count alone is not the measure; what matters is the type of each operation and what was written afterwards. Do not repeat it and do not create new partitions.
Priority can be set, but finding the folder depends on the file-system structure surviving. Sometimes the whole space must be examined to locate its files.
Remnants of the encrypted container may exist, but opening it needs the recovery key and enough structural integrity for the encryption. Raw files cannot simply be found.
If it is stable another machine may recognise it, but it may also offer to format it or start automatic operations. When the data matters, it is better to prevent writing and take an image properly.
A quick format usually leaves data recoverable, while a full format greatly lowers the odds because it writes across the whole disk.
A large part of the data may still be recoverable if not much has been written since; stop using the disk and bring it in for inspection.
Don't format it; the fault is usually in the file system and the data can often be extracted before any repair.
Next step
Send case detailsStop before the data gets overwritten.
Send the device type, the format method and what happened afterwards. These details help us assess the chance accurately.