Data Recovery Case File · NAS & RAID · Formatted, Thrice

Three formats, one mirror: the arithmetic of repeated quick formats — and the config question the drives answered themselves

The confession came with its own exclamation mark: while trying to add additional storage to his two-drive setup, he had "inadvertently formatted my 2 RAID drives (3 times!) without realising what I was doing." Ten-terabyte drives, one mirroring the other as backup — though his description of the layout wobbled in a way the recovery itself would need to settle — and a sign-off already braced for bad news: was any of it retrievable, in our experience? The honest answer begins with a rule this archive keeps proving: a quick format is a new front page, not a shredder — and three new front pages still leave the same book behind them.

Why three formats isn't three erasures — and how the drives declared what they'd been

A quick format — the kind storage devices and operating systems perform unless told very deliberately otherwise — writes a fresh set of filing structures at a handful of fixed locations and touches nothing else: seconds of work on a 10TB drive that would take many hours to genuinely wipe. Repeat it three times and you've overwritten the same small neighbourhoods three times — each pass costing a little more of the old paperwork's remnants at those specific spots, but leaving the terabytes of actual content exactly as undisturbed as after pass one. The count that mattered wasn't three; it was zero — the amount of new data written since, because free-looking space only dies when something lands on it, and he'd stopped. His layout confusion resolved the same forensic way everything on this page did: beneath the fresh formatting, both drives still carried the older configuration records and matching content fingerprints of a mirror — two copies of one volume, exactly as his "one backing up the other" intended — which quietly doubled his luck, since every structure the formats had damaged existed in two independent editions, wounded slightly differently on each drive.

The reconstruction

Both members were imaged write-blocked on the TaskForce 2, and the archaeology ran on the copies in Data Extractor: the pre-format volume's structures excavated from wherever the three passes hadn't reached — the filesystem's scattered redundant records on each drive cross-checked against its twin, the healthier testimony adopted region by region — and the old volume rising substantially rebuilt: folder trees, names and dates for the large majority of the estate. What the triple pass had genuinely consumed — paperwork living precisely at the thrice-rewritten spots — was made good the honest way, by carving those files whole-but-nameless from the untouched data regions and filing them by type and date. Delivered on new storage with the recovered structure intact and the carved remainder clearly foldered; losses — the small population overwritten by the formats' own footprint — itemised rather than implied.

Outcome

The great majority home, structure largely intact, from a pair its owner had mentally written off at the first exclamation mark. Two closers, one technical and one human. Technical: the moment a format goes wrong, the counter that matters starts at zero writes — stop using the device instantly, as he did, and even a repeated mistake stays recoverable; it's continued use, not the format count, that buries data. Human: his enquiry's frank arithmetic — the "(3 times!)", the braced-for-it tone — made the assessment faster and the plan exact, and earned the reply this page makes public: mistakes made honestly and halted promptly are this trade's favourite kind of case. The head-shake he was bracing for never happened here either.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.