When deleting a file, the operating system removes the entry in its directory indicating where it lives and marks the space where it lived as free — but the content of the file remains unchanged. That is why recovering deleted files works — because the contents are still located in their original locations, just now available to be overwritten. A computer that continues to run will continue to overwrite those areas with new data — whether it was intended or not.
When you delete something, that is when the clock starts ticking. Not when you find out about it. Every save, update, cache write & search index pass has the potential to land on the space that file used to occupy – and running machines do this without being asked.
Most people don’t notice until hours or days later … and the window has been closing the whole time.
When you delete a file, nearly everything about that file remains in place. Only the record in the index showing where the file existed has changed to indicate that there is no longer a file at that location; otherwise, the data itself is still intact — every single byte. This is why file undelete software can recover files — because the actual bytes containing the data remain in their original state.
It is also why it stops working. Now that space is first in line for reuse. A computer which remains on will write to it continuously while unattended: temporary files, browser cache, logs, Windows update staging, search indexing. None are particularly exciting. All of them need to end up somewhere.
Therefore the single most valuable thing you can do is stop using the device. This means shutting it down, not just closing the applications. Assuming you’ve done so everything from here on applies to you.
Exhaust these free methods before downloading anything or paying anyone.
Obvious, routinely ignored when panicked, and it restores your file in seconds with the same pathway. Check it even if you think you emptied it.
Both Windows File History and macOS Time Machine automatically save backup versions of your files without you having to do anything. To access Previous Versions of a file from Windows go into the folder where the file was saved and right-click on the folder and then find “Previous Versions.” On a Mac, simply enter Time Machine on the folder instead of the file itself.
OneDrive, SharePoint, Google Drive, and Dropbox also maintain deleted items for a certain time. Most of these services will allow you to view many Previous Versions of deleted items via their web interfaces; however, many users will not be able to see those versions using the desktop synchronisation clients. Look for the “Recently Deleted” or “Recycle Bin” area within the service itself.
Sent as an email attachment, stored in a Sent mailbox, stored on an external drive, opened on a colleague's machine, attached to a message thread. A meaningful share of lost documents can be located using one of these methods in five minutes.
This may seem like a simple distinction but it impacts the feasibility of recovery.
There are no immediate consequences for deleted data — it stays there until it gets overwritten. If you have enough free space on the drive, files can be recovered after months. Time is generally on your side as long as you stop creating new data.
TRIM tells the drive to physically erase these blocks. This happens through the background queue when the drive is turned on. Once the physical deletion has occurred, nothing will ever recover the data again. Shut it down immediately or not at all.
External drives work exactly how their internal components do. So if you have a spinning disk-based external drive, then you've got some extra time to get to it. If you're using an external SSD, you don't. Removing a bus-powered device instantly kills off the ongoing delete process happening in the background — and that's a major benefit.
Cards and USB sticks typically lack TRIM support, therefore deleted data remains until it gets overwritten. Stop taking pictures with the camera — take out the memory card — and that should be the entire extent of what you need to do.
Recovery software will work perfectly fine with healthy hardware; however, recovery software is quite simple to use in such a manner as to delete everything you wish to recover.
Install it somewhere else. Installers can write their data to whatever media you designate for installing — and thus could install directly into the unallocated space where all of your previously deleted files reside. Install to a different physical drive, or run the program off a portable version running from a USB stick.
Recover to a third location. Do not write any recovered files back to the original media they were stored upon. In doing so you would overwrite the remaining free space that still contains every file you had not yet recovered.
Beyond those two, select read-only tools and cease operations immediately when either drive noise is heard or there are error messages being generated by the drive. While recovery software is unable to address a failing mechanical component, a full scan is hours of non-stop reading on hardware which has a great chance of dying while attempting to complete the scanning operation which was designed to attempt to rescue it.
If you really need a lab: the drive itself is failing, the file system is damaged rather than merely missing an entry, some data was lost due to overwriting, or the result has to withstand scrutiny later. In all other cases software is often the honest answer, and we will say so. Single drives in Manchester are from £300 +VAT after a free 48-hour diagnostic.
On a hard drive, usually. Deletes remove the directory entries, mark the block reusable but leave the data in place. Thus deleting files doesn’t delete the files themselves. They remain on disk until the space where the file is stored gets written upon by another write operation. On an SSD, often not. Because when you delete files on SSDs, they are removed from indexes. Then using the TRIM command, these storage locations get erased within minutes.
A spinning hard disk could take anything up to several weeks or even months depending on how much is being written. A solid state drive typically takes minutes. Regardless of the type of drive you have, shutting the machine down is the most useful thing you can do. This is because computers run programs that write to disk constantly, whether you ask them to or not.
You can look for the Recycle Bin, Previous Versions or Time Machine, your cloud service's deleted items folder via the web interface instead of using the sync client, and all places the file has been located — email attachments, sent folders, other colleagues. These are cost-free and help solve a lot of your problems.
Because the installer will write to the disk and possibly right into the unused space containing the files you wish to recover. To do this safely install to another physical drive and then recover to a third location, never back onto the source.
Generally no. If your computer was turned off quickly enough after deleting, there might be some chance the drive still has what TRIM had not yet reached. Generally though, TRIM causes the drive to delete the blocks in the background when it has power; therefore there is very little chance of recovering anything once it has completed.
When the storage device itself is also failing at the same time, when the file system has become damaged rather than simply losing an entry to that file system, when portions of that data have already been overwritten, or when it would require scrutiny at a future date. In all other situations related to healthy hardware and relatively recent deletions, software is often the honest answer.