A formatted drive may have lost its file-system structures, some of its file contents, or both. The useful first question is what happened to this particular device after the loss. Stop ordinary use of the affected storage, record the known actions, and check for a usable backup from another device. If the drive may be evidence, let the authorized responder decide collection and power-handling steps before attempting recovery.
Choose the first route
Write down the device model, whether it is a hard disk or solid-state storage, the operating system, the formatting application and options, and whether files were written afterward. Use records you already have; reconnecting the device simply to fill a worksheet can change its state. Mark unknowns explicitly.
| Situation | Useful next step | What to avoid |
|---|---|---|
| A verified backup contains the needed version | Restore to separate healthy storage and check important files. | Overwriting the affected source before deciding whether other data or evidence is needed. |
| The device was dropped, is noisy, disconnects or has physical damage | Seek a recovery laboratory assessment; describe symptoms and earlier attempts. | Repeated scans, opening the enclosure or repeated power cycling. |
| A healthy device was accidentally formatted | Ask a specialist about an acquisition or recovery plan appropriate to its media and format history. | Installing recovery software or saving results onto the source. |
| An incident, dispute or investigation is involved | Follow the incident lead and preserve an action record. | Treating ordinary file recovery as a forensic examination. |
Microsoft’s Windows File Recovery guidance explains why further computer use can overwrite space associated with deleted files. Its supported scope is local storage; cloud services and network shares need their own recovery routes.
Understand what “formatted” leaves uncertain
A quick format and a full format can have very different effects. In Microsoft’s documented Windows format command, the quick option replaces file-table and root-directory information; the overwrite option zeroes the volume before any additional passes. Other operating systems and utilities have their own behavior. Record the actual tool and options rather than inferring the result from the word “format.” Windows format documentation explains these distinctions; it is a reference for identifying an earlier action, not a recovery instruction.
On an HDD, surviving content still depends on which areas have been overwritten and whether the device can be read reliably. On SSDs and other storage supporting TRIM or unmap, the operating system can notify the device that blocks are no longer needed. Subsequent device processing can make old contents unavailable. A quick format therefore offers no general promise of recoverability. Changing a TRIM setting afterward cannot be assumed to reverse earlier processing. Microsoft describes delete notifications and their scope.
Encryption adds another dependency: intact encrypted bytes may be unusable without the correct key and required metadata. Preserve access to any recovery key through an approved private process. Record that a key exists in the intake brief; keep the secret itself out of a general worksheet.
Agree on a recovery attempt
Ask a provider which symptoms and devices it handles, how it protects the original, whether it will work from an acquired copy, and what circumstances require hardware work. Request the assessment fee, approval threshold, return arrangements and treatment of unrecovered or partially recovered files in writing. A scan finding filenames is a different result from delivering usable contents.
For a healthy, low-consequence personal device, a supported recovery tool may be an option. Read its exact source and destination requirements first and prepare a separate destination with enough space. If the only copy is important or the device is unstable, resolve the specialist assessment before experimenting. This page deliberately provides a decision record rather than commands that modify an unknown drive.
Check the delivered files
Keep the recovered output separate from the source. Compare the expected projects, dates and file types with what arrived. Open representative files in their normal applications, inspect full images or documents, and check any linked assets. For a critical collection, agree on broader validation with the provider instead of relying on a small sample.
A checksum recorded after recovery helps identify that recovered copy during later transfers. It proves agreement with the original only when a trustworthy original checksum exists for comparison. Record partial files and errors, retain the assessment report, and decide when the original can be released or retired. Use the backup and restore-test guide to reduce the impact of another loss.