Hard drive — weeks or months
Nothing happens to deleted data until something overwrites that space. On a drive with plenty of free room, files routinely recover long afterwards. Time is broadly on your side, provided you stop writing.
Good odds
The entry describing where it lives is removed and the space marked reusable — the contents stay exactly where they were. That is why recovery works, and why a computer left running is quietly writing over them while you decide what to do.
Not when you noticed. Every save, update, cache write and search index pass is a candidate to land on the space that file occupied — and a running machine does all of that without being asked.
Most people notice hours or days later, and the window has been closing the whole time.
Deleting a file does almost nothing to it. The entry describing where it lives is removed from the index and the space it occupies is marked available — the contents themselves are untouched, byte for byte. That is why recovery works at all.
It is also why it stops working. That space is now first in line to be reused, and a computer left running writes to it constantly without being asked: temporary files, browser cache, log entries, Windows update staging, search indexing. None of it is dramatic and all of it has to land somewhere.
So the single most valuable thing you can do is stop using the machine. Not close the applications — shut it down. Everything below assumes you have.
Exhaust these before downloading anything or paying anybody.
Obvious, routinely forgotten in a panic, and it restores in one click with the original path intact. Check it even if you think you emptied it.
Windows File History and macOS Time Machine both keep copies quietly without being configured. Right-click the containing folder and look at Previous Versions, or enter Time Machine on that folder rather than the file.
OneDrive, SharePoint, Google Drive and Dropbox all retain deleted items and prior versions for a period — and the web interface exposes considerably more than the desktop sync client. Look for a Recently Deleted or Recycle Bin area within the service itself.
Emailed as an attachment, sitting in a Sent folder, copied to a stick, opened on a colleague's machine, attached to a message thread. A meaningful share of “lost” documents are found this way in five minutes.
This is the distinction most guidance skips, and it changes what is realistic.
Nothing happens to deleted data until something overwrites that space. On a drive with plenty of free room, files routinely recover long afterwards. Time is broadly on your side, provided you stop writing.
TRIM tells the drive to erase those blocks, and it works through the queue in the background while powered. The erasure is physical and nothing retrieves it afterwards. Shut it down immediately or not at all.
They behave like whatever is inside. A spinning disk gives you time; an external SSD does not. Unplugging a bus-powered unit stops the erasing immediately, which is a genuine advantage.
Generally no TRIM implementation, so deleted data persists until overwritten. Take the card out of the camera and stop shooting; that is usually the whole intervention.
Recovery software is legitimate and effective on healthy hardware. It is also easy to use in a way that destroys what you want.
Install it somewhere else. The installer writes to whichever drive you put it on — potentially straight into the free space holding your deleted files. Install to a different physical drive, or run a portable version from a USB stick.
Recover to a third location. Never write recovered files back onto the drive you are recovering from. Doing so overwrites the very space that still holds everything you have not retrieved yet.
Beyond those two, choose read-only tools and stop if the drive is making any noise or throwing errors. Software cannot address a mechanical fault, and a deep scan is hours of continuous reading on hardware that may not survive it — drives regularly die partway through a scan intended to save them.
Where a laboratory is genuinely needed: the drive is failing as well, the file system is damaged rather than merely missing an entry, part of the material has been overwritten, or the result has to withstand scrutiny later. Otherwise software is often the honest answer, and we will say so. Single drives in Manchester are from £300 +VAT after a free 48-hour diagnostic.
On a hard drive, usually. Deleting removes the index entry and marks the space reusable while leaving the contents intact, so they survive until something overwrites them. On an SSD, often not — TRIM physically erases those blocks within minutes.
On a spinning disk, potentially weeks or months if little else is written. On an SSD, minutes. Either way the most useful thing you can do is shut the machine down, because a running computer writes constantly without being asked.
The Recycle Bin, Previous Versions or Time Machine, your cloud service’s deleted-items area through its web interface rather than the sync client, and anywhere the file has been — email attachments, Sent folders, colleagues. Those are free and resolve a good share of cases.
Because the installer writes to the drive, potentially into the exact free space holding the files you want back. Install it to a different physical drive, and recover to a third location — never back onto the source.
Only if it was shut down almost immediately. TRIM erases the blocks in the background while the drive has power, so a machine switched off promptly may retain what the drive had not yet reached. Left running, generally not.
When the drive is failing as well, when the file system is damaged rather than just missing an entry, when part of the data has been overwritten, or when the result may be scrutinised later. On healthy hardware with a recent deletion, software is often the honest answer.