Formatting just tells the OS that the data is no longer there; it doesn't actually remove the data. You need to overwrite it with zeros or random data to make it unrecoverable. Of course, this method isn't perfect and may leave some data recoverable in bad sectors, etc., but you would need pretty specialized tools to find it and it would be of limited usefulness to an attacker.