86

My Android phone gives the following message when I try to format a volume (SD card or USB OTG.)

Formatting SD card will delete all data. Data cannot be recovered. Continue?

Now, this message is obviously (correctly) trying to warn the user that if they have any data they care about on the SD card, they should back it up before formatting.

However, the statement "data cannot be recovered" is factually incorrect. In fact, much of the data can usually be recovered with tools such as Photorec, Recuva and Disk Drill.

Why does this matter to the user? Well, someone may, for example, be thinking of passing on a storage medium to someone else, and want to make sure none of their naughty photos or business secrets will be retrievable by that person. A tech illiterate person who knows little or nothing about how digital data storage works, could easily take this message literally as an assurance that their data is securely deleted.

How should the message be written to warn the user about data loss while also emphasizing that formatting the volume is not a secure way to shred data?

Every OS I have ever used has warned me when formatting volumes or deleting files. But I cannot recall a single one ever pointing out that it's not really a secure way to erase the data. Why is this?

Edit (After most answers): In case anyone is curious, it's a Samsung Galaxy S3 (I9305) running stock Android 4.4.4. Here's what the process looks like:

enter image description here

Some of the language aspects of this question are now posted on English SE.

Improve this question
24
  • 14
    They also might want to be more clear about what "all data" means: "Formatting the SD card will delete all the data on it. ..." (Not all data on my device.)
    – Ken Mohnkern
    Commented May 17, 2016 at 13:43
  • 4
    @KenMohnkern True, one might assume users are familiar enough with these devices to know that distinction but assuming anything for all users is dangerous.
    – DasBeasto
    Commented May 17, 2016 at 13:46
  • 18
    People who are concerned about security don't need to be told - they know what the score is. The average user cares about losing their files. The message should convey to them that the expectation of recovering their files goes to zero following this operation. It doesn't need to convey that the expectation of the data being irrecoverably eliminated is also non-zero. It should, however, not suggest that the data is expected to be irrecoverably eliminated unless the operation is designed specifically to do so.
    – J...
    Commented May 17, 2016 at 19:39
  • 3
    For the average user one should assume the data cannot be recovered; Recuva and its ilk can be hard to use for non-tech-savvy people to use and they are virtually never 100% accurate/able to recover all data, so it's better to assume you can't
    – MilkeyMouse
    Commented May 18, 2016 at 6:06
  • 2
    @Cronax It seems that if we're gonna write a technically accurate, well communicated warning here, it needs to be wordy and complicated, unfortunately. Unless there's a genius wordsmith around.
    – Fiksdal
    Commented May 18, 2016 at 6:14

12 Answers 12

Reset to default
31

I see no problem with the message that other suggestions completely solve.

Formatting SD card will delete all data. Data cannot be recovered. Continue?

Data cannot be recovered gives a very good sense of urgency, and speaks well to the target audience who at this juncture needs to know the likely worst case scenario. Even though the data can be recovered, it is beyond most people's knowledge. Additionally, it may be true! Although the data can be recovered by special software or hardware, depending on the next actions the data needed to recover the data might make the data unrecoverable (a 4GB drive 100% full of 1 movie, once formatted and a couple songs written to it, the odds of recovering the video are slim).

As @DasBeasto recommended:

This action cannot be undone.

I'd venture the subtle difference is too slim, possibly regional or related to age to merit this change alone. Although a study would be interesting.

Instead, my suggestion is to add a Chrome Incognito like "Success" message at the end of the operation. Something that says something like:

"Format Successful!

"Did you know, this does not prevent the bad guys and the feds from reading your old data from your SD card? discard old storage securely!

You may now write new Data to your SD card."

Improve this answer
12
  • 9
    1+ for the idea of having the second warning after the formatting is done.
    – Fiksdal
    Commented May 18, 2016 at 2:50
  • 4
    I like the combination of the DasBeasto's "Formatting SD card will delete all data. This action cannot be undone. Continue?" before the event, to emphasize what matters to most people (your data will disappear, and there's no built-in way of reversing that) with the post-event warning that it may still be recoverable.
    – TripeHound
    Commented May 18, 2016 at 8:16
  • 3
    I can understand why. From a UX perspective I wouldn't use it however. "Data will likely be unrecoverable" asks more questions than it answers... Now the user wonders how likely, or worse assumes the message is unsure of what is happening. A warning should be sure of itself, imo.
    – Austin French
    Commented May 18, 2016 at 15:10
  • 1
    @AustinFrench: What questions would it "ask"? If the user needs the data to be unrecoverable, some other means of erasure should be used but it's not the job of the format utility to help the user fine one. If the user may want the data again, it should be obvious that "data is sitting on disk" would be more helpful than "data might possibly be recoverable".
    – supercat
    Commented May 18, 2016 at 15:52
  • 4
    @AustinFrench: An after-action message like yours could be helpful, but yours seems a bit chummy. Better might be something like "Information has been erased, and may no longer be read by normal means, but might not be completely destroyed". A picture of a handwritten page being erased using a pencil eraser might be worth 1,000 words, given that such erasers often erase things well enough to allow paper to be reused, but don't always obscure them completely.
    – supercat
    Commented May 18, 2016 at 16:01
128

"Recovered" is a poor choice of words here. All that app is trying to do is warn people that the action is not reversible and they can't simply hit cancel or undo and all their files will be returned. A better solution would be:

Formatting SD card will delete all data. This action cannot be undone. Continue?

This is more direct to the point that you simply can't undo the deletion, it keeps the sense of urgency but since it doesn't say "recovered" it doesn't give the impression of a full secure wipe to people who have heard the importance of doing so but never been trained to do it.

Improve this answer
15
  • 1
    Perhaps language should be added/modified, in order to satisfy OP's "...while also emphasizing that formatting the volume is not a secure way to shred data?"
    – InkyDigits
    Commented May 17, 2016 at 15:30
  • 2
    @Snowman I personally don't think that is necessary. In the way I worded it the user (hopefully) wouldn't even get the idea of shredding it in their mind, so stating that it doesn't do so would be overkill.
    – DasBeasto
    Commented May 17, 2016 at 15:33
  • 3
    And working in and around IT for 10+ years I have often seen the confusion about what "delete" means to the common user.
    – InkyDigits
    Commented May 17, 2016 at 15:52
  • 2
    @DasBeasto I had to look up the definition of purge. IMO purge plays similarly to delete, only it's a more mysterious word.
    – Fiksdal
    Commented May 17, 2016 at 18:57
  • 3
    Semantics... maybe this is English Language SE material now :) I had a problem with putting "delete" into an API that I was writing once. It was a collaborative deal and one of the people programming an app that used the API wanted a "delete" added, and I told him that I would not allow a client to actually delete anything. We argued for a while because we had different concepts of what delete should do. In the end we did it my way, because I was writing the API, but we settled on allowing his app to "retire" information, which made it invisible to him.
    – InkyDigits
    Commented May 17, 2016 at 19:01
14

Really good question.

I've thought about this inaccuracy (although in a security, not UX context) and had to explain to several colleagues that most "delete" options (yes, even formatting a drive) are not secure and that the data is quite often recoverable.

I have never found it difficult, nor has anyone failed to understand, that the way to think about this is that the operating system will no longer recognize the content and that it is thus available to be overwritten. It may be as simple as wording it along the lines of.

Formatting SD card will make all current data unavailable to the operating system. Data cannot be recovered without using special software. Continue?

Or I rather like the FOLDOC definition for "delete":

To make a file inaccessible.

"Inaccessible" doesn't mean it's gone, we just can't get to it. Thus:

After formatting the SD card all data will be inaccessible. Continue?

This does not emphasize that the data is not gone, but it does mean that. Do we need to include something about potential recovery? That might depend on how security-critical the operation is considered to be.

Maybe not the perfect wording, but my point is that the truth isn't difficult to understand and you've made an excellent point in the fact that the inaccurate wording could actually be a disservice to less savvy users.

EDIT

Another, more verbose but perfectly accurate versions courtesy of Mark Stewart (comments below)

Formatting SD card will make all current data on the SD card unavailable to the operating system. Data cannot generally be recovered; using special software may recover some data. Continue?

Improve this answer
16
  • 1
    1+, I like the suggested message also. But can we make it slightly more alarming? Like adding "partly recover" or something? Don't know how to phrase it. (You know, since the OS may immediately overwrite some of the sectors. Also, if it's a fragmented filesystem, I think formatting may overwrite the index, which will lead to many fragmented and/or corrupted files, even if immediately attempting recovery. I actually experienced this recently when a friend of mine accidentally formatted a FAT32 volume.)
    – Fiksdal
    Commented May 17, 2016 at 16:29
  • 7
    Haha.. Yeah, we might as well put a whole lecture into the warning :)
    – Fiksdal
    Commented May 17, 2016 at 16:53
  • 8
    ...cannot be recovered without using special software - this gives the impression that there should be some expectation that data recovery is possible. In reality, the probability of data recovery following a format operation is undefined. An appropriate message should not give the user any impression otherwise. The expectation of data recovery should be zero following a format. The expectation of data elimination following a format should also be zero.
    – J...
    Commented May 17, 2016 at 19:36
  • 1
    How about Formatting SD card will make all current data on the *SD card* unavailable to the operating system. Data cannot *generally* be recovered; using special software *may recover some* data. Continue?
    – Mark Stewart
    Commented May 17, 2016 at 19:44
  • 2
    @MarkStewart: Seems a little wordy. I think "Data will likely be unrecoverable" would suffice. While some people might take "likely" to mean "over 50% chance", and while the probability of rendering data completely unrecoverable would be less than that, I don't think anyone who would be dissatisfied with a 50% chance of real destruction would be satisfied with anything less than 90%, and the adverb "likely" does not imply anything near that.
    – supercat
    Commented May 18, 2016 at 5:07
8

I know the question is about the text, but in addition to others responses, consider that user don't always read what you have written and can click on a single button as a habit/reflex.

Consider adding 2 buttons with exact same formatting to force them process the information

enter image description here

Improve this answer
2
  • 3
    Yes, this. A button's label should be clearly stating what the button does, instead of a simple Yes, No, Cancel, Continue. ("No, do nothing" would be even better than "No, cancel"). And a "dangerous" operation should provide a user with an easy way out instead of making them hope tapping the screen somewhere else, or the back menu button, will cancel the operation.
    – Guntram Blohm
    Commented May 20, 2016 at 6:12
  • 1
    Along that line, another good practice for a destructive operation is to disable the "yes" button for a few seconds when the prompt first loads. This prevents an accidental double tap, e.g. if the button that opened this screen was positioned near the "yes" button, and also increases the likelihood of the message being read by the user.
    – Dan Henderson
    Commented May 25, 2016 at 13:52
6

I would suggest "Data will likely be unrecoverable" as having a clear meaning that is unlikely to materially mislead anyone. While it is true that the likelihood of data being truly unrecoverable if nothing is done with the cartridge following the format might not be as high as the adverb "likely" would suggest, few if any users will care about the odds in such a way that it would matter. Someone who discovers they need to recover some files but is unable to do so can't complain if something described as "likely", turned out to be the case; on the flip side, since "likely" is decidedly weaker than "certainly", anyone who wants certain destruction should recognize that "likely" isn't apt to fit their needs, regardless of whether the probability would be 10% or 90%.

Improve this answer
1
6

Maybe the UX should go in a completely different direction here. Starting with some (always dangerous) assumptions about context:

  • The majority of users landing on this bit of UI are here because they want to re-use the SD card on the same device. They have no intention of removing the SD card, or sharing it with anyone.
  • And many of those users actually hate being here: formatting is a necessary evil. They think "Why do I have to do this, I was downloading stuff I care about, and then was rudely interrupted with a "not enough space" message" before I got to this bit.
  • For that majority, the purpose of being here is to quickly empty a medium for reuse of that medium.
  • For them, the current message is not bad. I personally like the "cannot be undone" best, and find the Samsung process in your question needlessly annoying ("you entered your pin to confirm, but are really really sure?"). But in essence, the message is "warning, you are about to do something dangerous"
  • Of course, there could be a small minority of users who are actually here NOT because they want to reuse the medium, but for a completely different purpose: to safely destroy any data on the medium.

So the challenge is:

  • Facilitate the "quickly empty medium" primary purpose.
  • Alert about no easy recovery of data to them
  • Also warn that data can still be recovered somehow.
  • Without confusing the primary purpose.

How about something like:

enter image description here

Improve this answer
2
  • This is actually a better answer than the others. It also highlights one of the main issues: the term "format" is a technical term with no real meaning to end users. (In fact, it has multiple technical meanings, depending on how the formatting is done.) Really, we need to rename this "Clear SD card" or "Renew SD card", with the message "Renew will empty the SD card for reuse by discarding all data. This action cannot be undone. Continue?" I think you've hit upon the heart of the matter.
    – user8889
    Commented Sep 15, 2016 at 4:33
  • Well, personally, I only needed "format" when I wanted to pass the card (or USB stick) to somebody else, so I think the first assumption is not quite correct. Anyway, the design proposed cares for both.
    – virtualnobi
    Commented Sep 15, 2016 at 6:22
2

I think the message is fine. It's not about giving people all the information, or even all the options.

Formatting SD card will delete all data on this specific card Serial Number XXXXXXXXX. Data cannot be easily recovered, but may be recovered using some tools with an unknown degree of success depending on how many sectors of this device are altered after formatting. Recovery may or may not be possible. Other external factors apply. Samsung and Google make no clams that data will or will not be recoverable. Continue?

That's a bit much. So instead, think about the action and the consequence to the most likely user.

If you smash yes your data be gone!

Well, ok that doesn't sound "professional".

The point is that it doesn't matter that the data is potentially recoverable. It's not recoverable using the tools built in to the OS/Phone. A normal user will not be able to recover the data. Any user smart enough to recover the data will know so at the time of the message. As for sharing cards, that's not the primary audience. The primary audience is new cards or fixing old cards.

Improve this answer
2

The question is not so much about what the OS is doing, as clarifying the assumptions that naive users are making about what the OS is doing. How about ...

Formatting this card will allow it to be used for new data storage. Assume you will not be able to recover your old data. Assume that any bad guy that gets this card will be able to recover your old data.

Improve this answer
2

How about:

Formatting SD card will erase existing data. Continue with erasure?

Improve this answer
1

I wouldn't add

Data cannot be recovered

I would add it only in the case of a full erase (in case you have the option available to your users).

An other issue is with

Continue ?

I believe you than give "Yes" and "No" as choices to your users ? If you do, it probably isn't the best practice as it forces the user to read the whole message to know ether they should click on 'yes' or 'no'. Instead, you should give options such as "Delete" and "Cancel". (By the way, depending on the OS it will be running on, you should carefully choose the place of the buttons.

Improve this answer
2
  • 2
    Regarding button placement, this seems to be a clear case for a very big easy-target "Cancel" button, and a very small bright red "Delete" button.
    – Wildcard
    Commented May 18, 2016 at 3:12
  • 1
    @Wildcard In actual fact, here's what it looks like on my phone. It's a Samsung I9305. There's not even a "cancel" button. One has to use the back or home button. i.sstatic.net/nggsS.png i.sstatic.net/SmDpp.png i.sstatic.net/t48iU.png
    – Fiksdal
    Commented May 18, 2016 at 6:38
1

Add another paragraph after the warning that your data may not be retrievable:

Warning: formatting is not an authorized method of destroying classified or confidential data such as old passwords, naughty photos, or your credit card number.

(What would I recommend? (a) contact a reputable data destruction service, (b) read the government standards for data destruction and implement one of the methods, (c) heat the media to at least 5700 °C, which is higher than the boiling point of Tungsten, which has the highest known boiling point of any element, or (d) detonate a nuclear weapon within 1 meter of it. But I wouldn't put any of this paragraph in the warning message.)

Improve this answer
1
  • 1
    Some people say you have to detonate 3 consecutive nukes before you can be sure your data is wiped.
    – Fiksdal
    Commented May 20, 2016 at 4:34
0

I like the way Ubuntu has solved this problem. Admittedly it's a bit wordy, and may confuse total tech illiterates a little bit. But it's very technically accurate, and I find it a good solution. This screenshot is from the native disk management tool in 16.04.

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.