Solved Does reinstall of OS write to same disk area

January 22, 2015 at 06:46:40
Specs: Windiws 7
Im interested in knowing whether after a reformat and rein stall of the OS whether the reinstalled OS will write exactly to the same sectors of the disk where the previois OS resided?

See More: Does reinstall of OS write to same disk area

Report •

✔ Best Answer
January 23, 2015 at 09:55:37
Yes it is answered. The question you ask and seem to want an unequivocal answer to is not always so simply answered, and we are doing this for free, in our spare time......

I buy a hard drive it is blank. I format it and install windows xp sp2 from my cd. I install no missing drivers, nothing else. If I now reformat the hard drive again, and install xp sp2 from my cd, not installing any drivers. It would install to the identical spots on the hard drive. ok

Now I do the same thing...format and install xp But this time I add all my music and pictures, and I install any missing drivers. But now I wipe the drive by doing a quick format and reinstalling windows. I want the pictures and music back now! In this case if we stop here and attach the hard drive to another machine to do the data recovery, windows xp will infact have installed to the exact locations, and I have a 100% chance of getting the pictures and music back.
If you install data recovery software on the original system in an attempt to recover the data the installation of that software could be writing over sectors where some of the music and pictures were and will LIKELY make recovery less than 100%.

Now we start over...I have a new hard drive. I do a quick format and install xp sp2,
and install all the drivers, put on some programs, add all my photos and music etc and we use the computer for 1 year, Installing all windows updates, anti virus updates etc etc. The computer is wiped clean for the 1st time with a quick format, and windows is reinstalled, at this point it will be identical. However, what if the drivers have updated, are downloaded from a different source, we now are deviating from the original pattern. It gets complicated very quickly as the different drivers now install over a different area, all subsequent writes to the hard would be displaced from their original written locations, making the subsequent addition of programs writing over top portions of the files "underneath" from the original install. The more programs and data written to the hard drive would likely corrupt more and more data, as you are not likely to install an anti virus or windows updates or programs in the exact same order as last time, and hard drive will use the "next available space" when it writes to the drive. But we do not attempt to recover ur photos and music here at this point.
We continue using the drive for some period year 2 attempting to put most of our programs back on etc and continue using the computer, likely writing over top much of the original 1st install. The above hard drive is wiped again and windows is reinstalled from the same cd, no drivers. Indeed at this point the installation is identical and so are the spots written to the hard drive. What are odds on recovery? Again assumptions need to be made. If the drive is removed immediately.....and data recovery done on another machine you may expect the following:
Very little if anything useful will be recovered from the very first installation as the files or even just portions of the files have likely been written over at least once during the 1 st years use, and the 2nd years use.
From the 2nd installation you have a decent shot at recovering the bulk of that data at this point. However, if you install the recovery program onto the same unit or if you continued to add files to the computer you are now diminishing your chances of recovering anything from the 2nd install of XP!

Why is this not YES or NO? Because things happen. If the hard drive at some point decides it cannot use the same sector or block during an install, it is marked unusable and installing would carry on with the next available sector, thereby throwing off things and not be 100% identical as the original. It would always be the same general area of hard drive, but not always exact and that matters with data recovery.

Even the use of different drivers could change the way things deviated from the core install of Windows on the hard drive.

You say it was a factory restore and see that again is different than a cd install of Windows. The factory restore uses an image to which wipes the drives and restores to out of the box state from a "recovery partition". So one could have reason to believe you would have the exact same Windows, and same drivers, and any programs. Again though as soon as you start adding your own stuff back to it downloading programs etc, you will likely not be putting those things back in their exact old locations, you only have to be off one sector.

So the General Gist is this, all things being perfect, an image would infact re-install to the exact same spots on the hard drive. But it is not carved in stone, as the hard drive is capable of adjusting for bad sectors as is the operating system.

If I have a hard drive and all I do is install windows from a factory restore, restart, do factory restore, restart do a factory restore 50 times and we examine the drive. It is highly probable it will have written the exact same thing in the exact spots on the hard drive.

If I do it 50 times again, but each time added random amounts of data and programs, what you find is the "core" (from the recovery partitions exact same install) would install to the exact same locations on the hard disk, but the data and added programs would not be in the exact same locations. AND we are not usually trying to recover the operating system files, we are in fact usually wanting that data. In the above example you are likely to recover the last installation of windows in which the data had not been written over.........Which of course depends on EXACTLY, when/how recovery is being attempted and if any subsequent data had been added since the last "FACTORY RESTORE"

If we now continue simply wiping the hard drive and reinstalling until the darn thing gives up and begins to fail, we take out the hard drive, and we would find things are not identical, same "core area", but as sectors failed and things moved...things...changed and things were no longer exact.

Again if one were to examine hard drives, we might find they often fail because certain parts of the hard drive are re written to over and over as you suspect, eventually failing, even though many sectors were completely unused. Even then as I said in it's dying days, the hard drive and operating system work to preserve the data by moving files from bad sectors to ones marked usable, thus not 100% identical to it's originally installed location.

To err is human but to really screw things up, you need a computer!



#1
January 22, 2015 at 08:42:24
No, it will not.

Report •

#2
January 22, 2015 at 09:00:04
Can you explain why not? If the disk was reformatted making all disk space available will logical block allocation not put the OS back on the first part of the hard drive where I assume it originally resided?

Report •

#3
January 22, 2015 at 10:02:25
Files do not remain in a static physical location on modern systems.

Modern HDDs have their own sector mapping tables, used to hide bad sectors. Over time, these sector mappings change as sectors become unreliable.

Modern OSes are heavily patched. Patching typically changes the size of these files. Even when if the size were exactly the same, the patches aren't overladed over the existing file.

Modern file systems use tricks to avoid fragmentation. Windows even runs its defragmenter when the computer's idle. Therefore, there is no guarantee the file system will choose to place the same file in the exact same position, nor is there a guarantee the file will remain in that position.

Modern OSes are multitasking. There's no guarantee the writes will happen the same way every time, even between fresh installs.

How To Ask Questions The Smart Way


Report •

Related Solutions

#4
January 22, 2015 at 11:37:45
Really have to disagree with the above posts.

The first issue is files are not written to sectors but clusters. Cluster identification is exactly the same on the drive every time you format.

If the drive has been formatted and the OS is installed it will overwrite a major area that was previously used before the format. This would include areas previously used by the OS.

"Even when if the size were exactly the same, the patches aren't overladed over the existing file."

Don't confuse file size with file name. Absolutely if the file is named the same it is over written using the existing file clusters of the original file and if larger then writes the rest of the file elsewhere.

"Files do not remain in a static physical location on modern systems."

Yes they do. Database files are a perfect example. Some program and game files also. They are not defragable by defrag software.

Spare sectoring is done at the factory. Though SMART can do some spare sectoring I want you to think about that for a moment.

If you have a 4kb cluster which contains 8 512 clusters and one sector is found to be bad and reallocated from the spare pool when that cluster is read the drive heads have to leave that cluster and go find that spare sector to read the last of that qroup of information.

Does that sound efficient to you? Heck no!

This is very different than what chkdsk /f does which is mark the entire cluster as unusable in the file table and tries to move the contained info to a different available cluster.

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's

message edited by wanderer


Report •

#5
January 22, 2015 at 11:59:40
"Don't confuse file size with file name. Absolutely if the file is named the same it is over written using the existing file clusters of the original file and if larger then writes the rest of the file elsewhere."

But in this case you are not using the existing clusters of the original file because the disk has been formatted.

The OP begs a number of questions which mean that the only sensible answer is that you cannot guarantee that the same physical sectors are used on the disk as before.

1. It is not specified if the disk is a mechanical one or an SSD. If the latter then wear leveling will alter the physical sectors used.

2. It has to be assumed that the OS being overwritten has been through a number of updates - possibly even Service Packs. These will, inevitably, have moved files from their original location and even added or removed some files; the total file size will have changed. The files written are not the same, let alone their physical location.

3. NTFS is a journalled file system; it is possible that this will lead to apparently identical writes being performed in a different order.

4. The simple fact is that the internals of NTFS are hidden from us as it is a proprietary system. We just don't know the details of the block allocation scheme used and certainly can't assert that there is no random factor involved (even if the files being written were identical in both instances).

5. It's true that some files are immovable; these are a minority of the files on a disk (else you would never be able to defrag it). So defragmentation may well have moved the operating systems in the time between its being installed and the disk being formatted. As an aside, anyone who has looked at the distribution of clusters used on a disk, as displayed during a defrag, will be aware that they are not allocated in a simple linear fashion.

Sure, the location of all the files on the disk might be identical to how they were just before the format. And I may win the Lottery this Saturday. But we can't say, with any degree of certainty, that either of those statements are true. In reality the probability of both is very low - I'm not sure which is the least likely.


Report •

#6
January 22, 2015 at 12:12:31
Both arguments have merit. I am wondering why the OP asked this question in the first place. Why is it relevant?

Report •

#7
January 22, 2015 at 12:21:00
I think it's relevant to the OP original question in the post below
data recovery after sequential factory resets?

i_Xp/Vista/W7User

message edited by XpUser


Report •

#8
January 22, 2015 at 12:45:12
This post is what might be called a "supplementary question" in the UK Parliament (PMQs - prime ministers question time) and possibly Canadian parliament (it being modelled on the UK one).

This is the previous (primary) post/question...

http://tinyurl.com/nha9tnn

Useful discussion, and somewhat scholarly too; mmm.


Report •

#9
January 22, 2015 at 12:46:57
Looks like i was late in posting the link/reference to the same primary question/post. XPuser got there first... Gold star to him.

Report •

#10
January 22, 2015 at 13:16:31
Thank you for your replies. Being a novice on a laptop I was merely wondering whether files could be recovered after sequential resets and if the OS reinstall is likely to have overwritten my data or not if the OS always reinstalls to the same area of the disk. Apologies for my ignorance. It's a HDD with FAT. Thanks

Report •

#11
January 22, 2015 at 13:32:23
wanderer: The first issue is files are not written to sectors but clusters. Cluster identification is exactly the same on the drive every time you format.
You're working from too high of a level. Get away from the OS level. Bring it down to the actual, physical disk. Suggested reading: http://en.wikipedia.org/wiki/Bad_se...

wanderer: Don't confuse file size with file name. Absolutely if the file is named the same it is over written using the existing file clusters of the original file and if larger then writes the rest of the file elsewhere.
I am unaware of any OS patching mechanism that overwrites the OS files while in use. Windows creates temporary files, and replaces the original file entries with their replacement. The old data stream probably remains thanks to WinSxS. There might be a Linux OS patcher that opens the file for read/write, but that's not the area of my expertise. Do you have an example?

wanderer: Yes they do. Database files are a perfect example. Some program and game files also. They are not defragable by defrag software.
I am unaware of any DB software requiring raw disk access to work. Do you have an example? Otherwise, the program is relying on the file system, and that means the files can be moved. Suggested reading: http://blogs.msdn.com/b/oldnewthing...

wanderer: Spare sectoring is done at the factory. // This is very different than what chkdsk /f does which is mark the entire cluster as unusable in the file table and tries to move the contained info to a different available cluster.
Not sure what your point is, nor the relevance of it to the rest of the post. That the HDD's sparing costs time? That the file system does things differently compared to the HDD itself? I didn't realize these were contested points.

How To Ask Questions The Smart Way


Report •

#12
January 22, 2015 at 22:33:31
Here is the skinny on data recovery. First there have to be some assumptions. If I had say Windows installed, plus all my programs, photos and music. I then reformat the drive and reinstall windows, using a quick format and then realize eghad I have lost all my stuff. You are not guaranteed to have all files written exactly as before, but if you yanked out the hard drive at that point, and used data recovery software on another unit to run a scan on the hard drive, you'd get the bulk of your stuff back. Probably greater than 90%, not likely 100%, but not impossible either, after all you are likely just wanting the data files and not the recovery of all the system files. Now if you do full format with newer operating system, Vista and up, then the full format actually writes 0's in all the spaces of the hard drive and data recovery of any kind is likely nil. As you have framed this scenario I would say you would be very successful in recovering the majority of the data.

To err is human but to really screw things up, you need a computer!

message edited by HopperRox


Report •

#13
January 23, 2015 at 02:39:25
Thanks for the reply. Key point I guess is "yanked out the hard drive at that point". Laptop was used intermittantly after reinstall including download of 3 or 4 movie files so I assume I may have overwriiten some files doing this and maybe through the reinstall itself - hence orginal question does reinstall of os write to same disk area thereby limiting overwrite or different area, thereby adding to it?

Will run recovery programme and find out I guess but above question is one that i don't think anyone has conclusively answered has a yes or no - Perhaps it cant be, but it intrigued me.


Report •

#14
January 23, 2015 at 06:24:33
It would be like telling you we are 93 million miles from the sun. And you reply back exactly 93 million miles not an inch more or an inch less???? I need an exact answer. Well the exact answer would be more complicated because the earth has an elliptical orbit.......

What I said stands. You will get the bulk of the data back. Installing more programs after the fact, adding an anti virus, letting windows update afterward.....etc etc, diminishes your odds on a full recovery which is why it is best to remove the hard drive immediately, without writing any further to it (including installing a recovery program on drive in question). Hence data recovery should be attempted by removing it and doing the recovery on another machine....if possible.

To err is human but to really screw things up, you need a computer!

message edited by HopperRox


Report •

#15
January 23, 2015 at 07:00:19
Having now read your related post. If this is 2 resets ago, and there has been significant writing to the hard drive, your odds go down further and further with every sector written over by new data. You might get some data back from that predicament, but basically you have followed the "what not to do" list.

To err is human but to really screw things up, you need a computer!

message edited by HopperRox


Report •

#16
January 23, 2015 at 07:42:03
oh dear....will try anyway. Is the primary question of OS writing to same disk space answered in the 93 million miles reply? I've read in one forum that the OS writes to the first available clusters on the HDD after a quick format - given this space has been made avaialble to be overwritten,, logically this would be the space formerly occupied by the previous OS?

Wanderer - If the drive has been formatted and the OS is installed it will overwrite a major area that was previously used before the format. This would include areas previously used by the OS.

Ijack - the only sensible answer is that you cannot guarantee that the same physical sectors are used on the disk as before.

I conclude that the OS reinstall will have occupied some space of the former OS but the extent is largely unknown.


Report •

#17
January 23, 2015 at 09:55:37
✔ Best Answer
Yes it is answered. The question you ask and seem to want an unequivocal answer to is not always so simply answered, and we are doing this for free, in our spare time......

I buy a hard drive it is blank. I format it and install windows xp sp2 from my cd. I install no missing drivers, nothing else. If I now reformat the hard drive again, and install xp sp2 from my cd, not installing any drivers. It would install to the identical spots on the hard drive. ok

Now I do the same thing...format and install xp But this time I add all my music and pictures, and I install any missing drivers. But now I wipe the drive by doing a quick format and reinstalling windows. I want the pictures and music back now! In this case if we stop here and attach the hard drive to another machine to do the data recovery, windows xp will infact have installed to the exact locations, and I have a 100% chance of getting the pictures and music back.
If you install data recovery software on the original system in an attempt to recover the data the installation of that software could be writing over sectors where some of the music and pictures were and will LIKELY make recovery less than 100%.

Now we start over...I have a new hard drive. I do a quick format and install xp sp2,
and install all the drivers, put on some programs, add all my photos and music etc and we use the computer for 1 year, Installing all windows updates, anti virus updates etc etc. The computer is wiped clean for the 1st time with a quick format, and windows is reinstalled, at this point it will be identical. However, what if the drivers have updated, are downloaded from a different source, we now are deviating from the original pattern. It gets complicated very quickly as the different drivers now install over a different area, all subsequent writes to the hard would be displaced from their original written locations, making the subsequent addition of programs writing over top portions of the files "underneath" from the original install. The more programs and data written to the hard drive would likely corrupt more and more data, as you are not likely to install an anti virus or windows updates or programs in the exact same order as last time, and hard drive will use the "next available space" when it writes to the drive. But we do not attempt to recover ur photos and music here at this point.
We continue using the drive for some period year 2 attempting to put most of our programs back on etc and continue using the computer, likely writing over top much of the original 1st install. The above hard drive is wiped again and windows is reinstalled from the same cd, no drivers. Indeed at this point the installation is identical and so are the spots written to the hard drive. What are odds on recovery? Again assumptions need to be made. If the drive is removed immediately.....and data recovery done on another machine you may expect the following:
Very little if anything useful will be recovered from the very first installation as the files or even just portions of the files have likely been written over at least once during the 1 st years use, and the 2nd years use.
From the 2nd installation you have a decent shot at recovering the bulk of that data at this point. However, if you install the recovery program onto the same unit or if you continued to add files to the computer you are now diminishing your chances of recovering anything from the 2nd install of XP!

Why is this not YES or NO? Because things happen. If the hard drive at some point decides it cannot use the same sector or block during an install, it is marked unusable and installing would carry on with the next available sector, thereby throwing off things and not be 100% identical as the original. It would always be the same general area of hard drive, but not always exact and that matters with data recovery.

Even the use of different drivers could change the way things deviated from the core install of Windows on the hard drive.

You say it was a factory restore and see that again is different than a cd install of Windows. The factory restore uses an image to which wipes the drives and restores to out of the box state from a "recovery partition". So one could have reason to believe you would have the exact same Windows, and same drivers, and any programs. Again though as soon as you start adding your own stuff back to it downloading programs etc, you will likely not be putting those things back in their exact old locations, you only have to be off one sector.

So the General Gist is this, all things being perfect, an image would infact re-install to the exact same spots on the hard drive. But it is not carved in stone, as the hard drive is capable of adjusting for bad sectors as is the operating system.

If I have a hard drive and all I do is install windows from a factory restore, restart, do factory restore, restart do a factory restore 50 times and we examine the drive. It is highly probable it will have written the exact same thing in the exact spots on the hard drive.

If I do it 50 times again, but each time added random amounts of data and programs, what you find is the "core" (from the recovery partitions exact same install) would install to the exact same locations on the hard disk, but the data and added programs would not be in the exact same locations. AND we are not usually trying to recover the operating system files, we are in fact usually wanting that data. In the above example you are likely to recover the last installation of windows in which the data had not been written over.........Which of course depends on EXACTLY, when/how recovery is being attempted and if any subsequent data had been added since the last "FACTORY RESTORE"

If we now continue simply wiping the hard drive and reinstalling until the darn thing gives up and begins to fail, we take out the hard drive, and we would find things are not identical, same "core area", but as sectors failed and things moved...things...changed and things were no longer exact.

Again if one were to examine hard drives, we might find they often fail because certain parts of the hard drive are re written to over and over as you suspect, eventually failing, even though many sectors were completely unused. Even then as I said in it's dying days, the hard drive and operating system work to preserve the data by moving files from bad sectors to ones marked usable, thus not 100% identical to it's originally installed location.

To err is human but to really screw things up, you need a computer!


Report •

#18
January 23, 2015 at 11:49:27
HopperRox: gold stars...

That last post of yours (17) is a labour of dedication - I refrain from saying "of love..." as that might be misconstrued...?

An excellent presentation, simple and logical. Covers just every aspect, and explains it clearly the what, how, - and not the least the why. Well dun!

Hopefully it answers this supplementary question, and clarifies the whole situation...?

Perhaps it might be copied to the on-site reference/help/how to files collection.

Trvlr

message edited by trvlr


Report •

#19
January 24, 2015 at 00:44:18
HopperRox, you are awesome. Explained perfectly and eloquently logical. Thank you very much for all your time and effort in posting that reply. Hopper does indeed Rock

Report •

Ask Question