What is the Difference Between a Full Format and a Quick Format?

          If you are considering hiring an digital forensics expert to assist you with securing and recovering digital evidence from a computer for use in litigation, but are concerned that someone may have taken steps to cover their tracks by means of hard drive formatting, then it may be important for you to understand the difference between the methods of formatting and data erasure.  There is most definitely a difference between performing a full format versus a quick format on a hard drive and other digital storage media, but depending on the version of Windows used, the difference could seem trivial or detrimental.

          If you have ever had experience formatting hard drives and other digital storage media, you might agree that performing a format with the default “quick format” option selected is more convenient than the alternative, which takes at least three times longer to complete.  However, if you are using Windows Vista or later, and your intention is to completely erase your data, then the alternative option—a full format—would be more thorough.  Otherwise, formatting a hard drive using the quick format option (or an earlier version of Windows) will not actually erase all of its stored data.

          Performing a quick format simply clears the digital storage media’s partition table, which allows for new data to be written without impediment.  The benefit of performing a quick format is as its name suggests.  It is quick—blazing quick compared to its alternative.  It is also easy to do—so easy, in fact, that it is no surprise that an occasional accidental format might occur.  In the event that an accidental format has occurred, another benefit of a quick format is that most of the data will be recoverable regardless of which version of Windows was used to format the drive.

          For pre-Vista versions of Windows, performing a full format has a few additional roles compared to a quick format—it scans the drive for bad sectors, attempts to repair any found, and rebuilds the tables of the new file system.  If you are using a hard drive that is several years old, it may be prone to accruing bad sectors (although it is possible for newer hard drives to accrue bad sectors, too).  If a bad sector is discovered during a full format operation, the process will attempt to fix it.  A successful fix means that the hard drive is once again fully functional and all space on it can be used.  An unsuccessful fix means that the bad sectors will be flagged and no data will be written to those areas, which essentially means that the capacity of the hard drive will be smaller.  Once the scanning process has completed, the full format operation then constructs the tables of the new file system.

          For Windows Vista and later versions, performing a full format includes everything mentioned above.  Additionally, Microsoft included a data erasure functionality with the full format process in an effort to increase end user security.  What this means is that performing a full format on a computer running Vista or later will result in complete loss of data, and data recovery software will be unable to restore any lost files.