KNOWLEDGE
Erased, but not gone
What formatting and flashing erase first is not the contents of the files but the map that records what is where (the partition table and the start of the file system), so data that has not been overwritten is still there and can be recovered.
Erase the map and bring it back
Follow a case where an image is flashed to an external drive by mistake. Erase the map with step 1, change how much the new image overwrites with step 2, then try to bring everything back with step 3. One cell is 2.5% of the disk.
- Map (partition table)
- Boot region (its copy is right next to it)
- File list (directory entries)
- Photos
- Documents
- Videos
- Music
- Memos
- Map copy at the end of the disk
- Cells the flash filled with zeros
- Cells the new image overwrote
Everything is intact now. Press step 1 to erase the map.
- 1
- 2
A real image is about 3 to 10 GB, so on a large external drive it overwrites just a tiny part at the very start. The picture is exaggerated so you can see it.
- 3
What happened
- A disk keeps the map and the data apart. The map records what is where; the data is the cells that hold the contents of the files. On exFAT the map comes in layers: the partition table at the start of the disk, the boot region at the start of the volume, and the file list (directory entries) inside the folders. Confirmed Source: Microsoft exFAT specification, Table 3, §6
- Formatting and flashing erase or rewrite the map first. Before writing, a flashing tool (Raspberry Pi Imager) clears the partition information (on Windows) and fills the first 1 MiB and the last 1 MiB of the disk with zeros, then writes the image from the start for as long as the image is. The first chunk of the image is written after verification. A quick format deletes the file table and the root directory, and a full format writes to every cell. Confirmed Source: Raspberry Pi Imager source (downloadthread.cpp, main branch, read on 2026-11-04), the Microsoft format and Format-Volume documentation, and the Raspberry Pi OS download page (storage required 2,656 to 9,504 MB). It may differ by installed version
- Without the map, the operating system sees an empty disk. The drive disappears from File Explorer, and Disk Management keeps only the device. The data that was not overwritten is still there, so you recover it by redrawing the map or by file carving (finding files by the marker at their start). Only the range that was overwritten is really gone. Confirmed Source: Microsoft exFAT specification §3.1; Microsoft Disk Management documentation (you initialize the disk and create a volume before a drive letter is assigned); this page's experiment (own implementation)
What the experiment showed
On a 128 MiB disk image we made an exFAT volume and wrote 20 files, then erased the partition information and overwrote the first N bytes with random bytes. That makes 36 scenarios. We checked with code we implemented ourselves and with the macOS exFAT driver. We did not reproduce the flashing step that fills the last 1 MiB with zeros (no files sit at the end of the disk).
- Even when the original boot region (6,144 bytes) was overwritten, the copy right behind it survived, and all 20 files came back with their names. Confirmed
- Once the copy's first sector was overwritten too, the boot region could not be read. Even so, not a single byte of the data that had not been overwritten changed. Confirmed
- The file lists are scattered, each right in front of the files of its folder, so the more was overwritten, the more folders lost their names, one folder at a time. Confirmed
- A text file such as a memo has no marker at its start, so file carving could not find it even though its cells were intact. Confirmed
- The macOS exFAT driver placed the files written first at the front of the disk. In effect the oldest files were overwritten first. Confirmed
How much was checked
ConfirmedWhere the exFAT boot region and its copy sit, the marker bytes, and how directory entries are built (specification). That a flashing tool clears the partition information and fills the first and last 1 MiB with zeros (Raspberry Pi Imager source). The results of this page's experiment (our own code and the macOS driver).
HypothesisWhether real recovery tools bring an exFAT volume back from the copy of its boot region, or pick up directory entries after the boot region is gone and restore the names. The TestDisk documentation lists finding lost exFAT partitions, but lists boot sector recovery only for FAT32 and NTFS.
UnknownWhere the volume starts on a disk that real Windows created (we could not find it in the Microsoft documentation). How Disk Management labels a disk whose partition information was erased. The results with fragmented files and on SSDs.
Common misconceptions
MythFormatting or pressing flash erases the data on the disk.
In factMostly only the map is erased. A quick format deletes the file table and the root directory, and writing an image fills the first and last 1 MiB with zeros and then overwrites only as much as the image is long. Only cases that empty the data itself, such as a full format or SSD TRIM, cannot be recovered.
Frequently asked questions
Does formatting really erase the data?
A quick format deletes the file table and the root directory (Microsoft format /Q). A full format writes to every cell of the disk (Microsoft Format-Volume -Full), so the old data cannot be recovered. In this page's experiment, even after the partition information was erased and the start of the disk overwritten, not a single byte of the data that had not been overwritten changed.
The flash stopped at 0%. What happens to my external drive?
Before writing the image, Raspberry Pi Imager clears the partition information (on Windows) and fills the first 1 MiB and the last 1 MiB of the disk with zeros. The first chunk of the image is written last, after verification. So if it stopped at 0%, usually only the map and those two ends are gone, and the rest of the data is still there. If the volume started within the first 1 MiB, its boot region may have been zeroed too, and where a volume starts differs from disk to disk. This explanation follows the Imager source (main branch), so it may differ by installed version.
The drive vanished from File Explorer but shows up in Disk Management. Why?
The device itself is still alive. To use a disk in File Explorer you initialize it and create a volume, and the drive letter is attached to that volume (Microsoft Disk Management documentation). Once the partition information is erased there is no volume to attach one to, so the drive disappears from File Explorer and only the disk is left in Disk Management.
On exFAT, is everything lost if the start of the disk is overwritten?
No. A copy of the boot region (sectors 12–23) sits right behind the original (sectors 0–11) (Microsoft exFAT specification, Table 3), so if only the original was overwritten, the copy can bring it back. In this page's experiment, all 20 files came back with their names when the overwritten amount was 6,144 bytes or less. If the copy's first sector is overwritten too, both are gone, and the data that was not overwritten has to be pulled out by file carving, content only.
Are older files outside the overwritten range still there?
Yes. Raspberry Pi Imager writes the image from the very start for as long as the image is and fills the last 1 MiB of the disk with zeros, but leaves the cells in between alone, so the bytes of that data stay as they were. But opening them needs the boot region and the file list at the front, so if those were overwritten you can only pull out the content without names. There is no guarantee that old files sit near the back. In this experiment, the files written first were placed at the front and were overwritten first.
Which files can file carving find, and which can it not?
File carving finds files by the marker at the very start of a file. A JPG starts with FF D8 FF and a PDF with %PDF. A file with no marker, such as a text file (.txt), could not be found by this experiment's file carving even when its cells were intact. A file whose start was overwritten and only the end remains cannot be found either.
Is it the same for SSDs?
An SSD can empty cells internally once the operating system tells it through TRIM that they are no longer in use, so the data can be gone. After TRIM and garbage collection, recovery can be difficult or impossible, depending on the drive's firmware. This page's experiment assumes a storage device that leaves the cells as they are.
What should I do first if I erased a disk by mistake?
Write nothing to that disk. Recovery is a race against new data, and the old contents of cells that have been overwritten cannot be recovered.