# NTFS Quick vs NTFS



## g3n0cide (May 18, 2007)

Hey,
After backing up all my data to dvd's, and navigating my way through-out the windows xp cd screens, deleting the old partition, then making a new one, it asks me if I want to format with NTFS (Quick) or just NTFS file system. I have been doing the NTFS (Quick) option because its alot faster for many years now, and just recently I was wandering if the other option offers anything besides the speed difference. Does it do a deeper level of format, or does it re-align the heads. Just throwing out some ideas.

Thanks


----------



## Girderman (Oct 22, 2006)

Okay, I'm going to through out some of my (possibly hare-brained) ideas.

My guess is that what the quick format does is simply "knock" off the first data bit in every unit, much in the same way a simple erase doesn't actually delete ALL the data, just changes the first bit to "0".

So that's my guess. A quick format just changes the minimum number of bits to zero and doesn't actually "zero" every single bit on the entire drive.

I doubt that there is any "head realignment" or any other calibration going on, and would like to hear about it if so.


----------



## g3n0cide (May 18, 2007)

Ya, see thats what I was thinking, the level of format and deletion. Hopefully we can get some more input, as some people may benefit.


----------



## Girderman (Oct 22, 2006)

Completely agree. Exactly my attitude. Maybe one of the Hardware guys can give us a lecture.


----------



## dai (Jul 2, 2004)

if there is nothing on the drive you need it is best to clear if completely with
killdisk or dban and then format and install
if there is other partitions you need to keep then do the full format of the partition in question


----------



## Girderman (Oct 22, 2006)

we were wondering

what is the difference between a quick format and a normal format


----------



## Kalim (Nov 24, 2006)

NTFS (Quick) format removes HDD files without scanning it for bad sectors, repairing them and so forth. (You can still retrieve your data many times by choosing this method, I've done it around 8-9 times). The full method does both and replaces the data bits with a null. Dban/Killdisk totally wipe everything off the disk. :wink:


----------



## Girderman (Oct 22, 2006)

So the full format zeros all the data AND runs (the equivalent of) a "chkdsk" ?


----------



## Kalim (Nov 24, 2006)

Girderman said:


> So the full format zeros all the data AND runs (the equivalent of) a "chkdsk" ?


The latter is definitely true, but the former I doubt very much (although that's what Windows Tech Support told me on query, when I asked that there is some confusion on this matter). I personally believe (and have asked some MS knowledgeable friends) that it just erases the files on the drive, i.e. more technically, marked as available space to be overwritten.

How that's done is probably by destroying and then recreating the MFT (metadata) and NTFS index directory, remapping it to sectors (B+ trees). Maybe even destroying the last part of the HDD first sector with the MBR, as that will make the files on the disk inaccessible as though they're not there, yet they are... IDK.


----------



## zeusx64 (Jun 9, 2007)

Good afternoon gentleman. :grin: Just kidding but hi guys. A format does nothing in the way of erasing, zeroing, or otherwise destroying data. Every thing that was there before is more than likely still there. The format actually just rewrites the master file table, therefore removing access to the data, unless you have some of that really expensive software that is used for computer forensics.
I know this because I know a guy whom teaches that stuff, so believe it. The absolute and only way to remove data from a hard drive is to use something like DBAN or Killdisk. Data is not actually written to the disk physically. 
This is a quote from an artical I was reading at http://www.actionfront.com/ts_dataremoval.aspx


> Data is recorded onto magnetic media by writing a pattern of fluxes (or pole changes) that represent binary ones (1) and zeros (0). These patterns can then be read back and interpreted as individual bits, 8 of which are used to represent a byte or character. For example, the letter "A" is written in a binary pattern as "01000001", the letter "B" is "01000010", the letter "C" as "01000011", etc... If the data is overwritten with a random pattern (let's say "11111111" followed by "00000000") the magnetic fluxes have been physically changed and the drives read/write heads will only detect the new pattern and for all intents the data has been effectively "erased".


Your best bet is to actually zero your drive. I use DBAN religiously, to wipe my drives. You have a choice between a number of different standards and algorythms and even the quick 3 pass method uses the sanitizing standard DoD 5220.22-M called short because it is only three passes, where as people like the Army use 17 and up. Plus, there is nothing quite like a clean drive to install on.

Anyway, that is my two cent input. I hope it helped.


----------



## Girderman (Oct 22, 2006)

Good first post. Welcome aboard, brainiac.

If you are not careful, they'll have you slaving in the salt-mines of the MS Support Team.


----------



## Kalim (Nov 24, 2006)

zeusx64 said:


> Good afternoon gentleman. :grin: Just kidding but hi guys. A format does nothing in the way of erasing, zeroing, or otherwise destroying data. Every thing that was there before is more than likely still there. The format actually just rewrites the master file table, therefore removing access to the data, unless you have some of that really expensive software that is used for computer forensics.


Welcome.

Yes, that's about right. Since once you delete or change the MFT, the data positions are lost by the drive, even though the bits are still actually retained. It's one of many ways used by software to show us a "delete". Another not well known software I use often is called "Cleaner" from within Windows. It clears the HDD space which is marked as available with null bits, while not overwriting any space occupied.

As mentioned before, the process rewrites the NTFS directory index too (file directory with description/file time/file time/file size and location in MFT), which verifies which file/sector is located where. Usually retained in the index cache. :wink:

Here's the root directory index on a NTFS drive, and what I mentioned with B+ tree data structures:


----------



## zeusx64 (Jun 9, 2007)

Girderman said:


> Good first post. Welcome aboard, brainiac.
> 
> If you are not careful, they'll have you slaving in the salt-mines of the MS Support Team.


About now, I am truely laughing my A word off! :jackson:
Very funny :grin:


----------



## Stefan S. (Aug 18, 2008)

zeusx64 said:


> Good afternoon gentleman. :grin: Just kidding but hi guys. A format does nothing in the way of erasing, zeroing, or otherwise destroying data. Every thing that was there before is more than likely still there. The format actually just rewrites the master file table


This is not true! Vista performs a mid-level format, overwriting every byte on the disk with zeros. The data is completely lost after a full format!

Only specific laboratories are able to recover the data with very expensive equipment.

You won't be able to recover the data with simple tools like PC INSPECTOR™ File Recovery, you need the hardware equipment, like a Magnetic Force Scanning Tunnelling Microscope.

See Change in the behavior of the format command in Windows Vista.


----------



## ssj4Gogeta (Dec 29, 2007)

Interesting. Though you shouldn't reply to dead threads more than 1 month old. But thanks for the info.


----------



## xakeriah (Aug 21, 2008)

Even though i shouldn't reply as the previous poster stated I'm going to anyways. Unfortunately there is almost 99.9% effectiveness of recovering data from a hard drive if someone has the resources to do so. The only way i know of to erase information from your hard drives completely is to burn (yes ignite as in bon fire) the platters on them. My friend does data recovery for a living, he hasn't been unsuccessful yet.


----------



## ssj4Gogeta (Dec 29, 2007)

Hi
So you mean even the softwares which claim to delete your data permanently by overwriting it with 0's aren't effective? And what about the data which has been overwritten by some other data?


----------



## Deleted090308 (Jan 25, 2007)

You have to overwrite the disk several times - some say at least 7.
Even after doing that bits and pieces can be recovered.


----------



## OM3GAInc (May 27, 2010)

I guess thats why the military does it 17 times. 

Wow i just posted in an old thread.


----------

