When you delete a file, the entry for that file is removed from the file system index and that space can be reused but the original content remains on the disk in the exact same place. This explains why recovery may work so well, why a computer left running quietly writes over those areas, and why hard drives and SSDs give you completely different amounts of time. Pictures specifically? We have put together a guide to recover deleted photos, which addresses card-based storage devices, PCs/computers, smart phone-based storage devices and cloud-based storage devices separately.
As with anything else, the amount of time data exists after deletion depends entirely upon the timing of subsequent writing. In the case of a running computer, there is constant writing occurring to update applications, create cache files, log events, and rebuild indexes. An SSD provides even less time to act due to the fact that the drive itself intentionally erases deleted data.
What you understand about how deleting files affects your data in terms of how long you have to retrieve deleted files in a particular situation is the knowledge that will tell you what to do in the first hour.
Removing a file from a file system deletes only the description of that file; the actual bytes representing that file remain unchanged on the disk. Therefore, if no additional writing occurs (i.e., no new files or modifications occur), recovery is possible immediately.
The corollary is the bad news. This space will be the first in line to be used again, and a computer running can write to it at its discretion, and does so without telling you: temporary files, log entries, browser cache, update staging, search indexing. None of these events is "dramatic" and all have to end up somewhere. Thus, the recommendation is to stop using the device rather than go looking for a tool.
This is perhaps the most significant distinction made when discussing deletions, and the one many recommendations omit.
It’s always worth checking for free before deciding whether or not to treat it as a recovery project.
Obvious, commonly missed in a panic, and restores in one click with the original file path still available.
Windows File History and macOS Time Machine both keep a record of previous versions of files silently behind the scenes. Look at 'Previous Versions' when you right-click on the containing folder or enter Time Machine on that folder.
OneDrive, Google Drive, Dropbox and SharePoint all save deleted items for a period and have available earlier versions of each document and/or file. When accessing via a browser, there is a great deal more information available than through the desktop syncing software used to access the service.
A significant portion of "missing" documents were previously attached to something, shared with someone else, or currently located in a sent mail folder. Research before assuming.
These are probably the types of projects where we will most likely send clients out the door.
One drive costs from £300 +VAT, after a free 48-hour diagnostic. However, if your drive is mechanically healthy and you have recently deleted something, there are likely cheaper alternatives which use read-only software on another drive and we would let you know.
When a laboratory is required: when your drive is also failing; when your file system is damaged and not just missing a record; some of your data has been written over; or your results need to be scrutinised at a later date. There are few occasions when the truthfully honest answer will not be software — installed on a separate device and recovering to a new location.
Please send us your device along with a brief description of what happened. This diagnostic process has no cost and the price for the next phase of service will be fixed in writing prior to commencing work.
This is the only step that requires input from you and nothing else can happen until the device is on our bench. Package your item properly and include all the information we require about you and your item(s), then ship them to us. Then comes a no-cost diagnostic, followed by a written quote.
Posting it? Use a tracked and insured service. The value of what is on the drive far exceeds the cost of postage. Bringing it in? Weekdays from 9am to 5:30pm, and it still needs packing as described above for the journey.
Tell us about the item in question, tell us how it has been behaving lately, and let us know if there is anything you have done as far as troubleshooting goes so that our engineers may provide a realistic estimate of success and a probable cost range prior to sending your items off.
We’ll be in touch shortly. If it’s urgent, call 0161 871 0788.
Things that users most frequently ask about recovering their deleted files.
Generally on a hard drive. A deletion removes the index entry for the file and changes the status of the file's block(s), but leaves the data itself intact. This means that until something else writes to these blocks, you can recover deleted files. Generally not on an SSD. An SSD uses TRIM, which erases these blocks physically within minutes.
For a very long time on a hard-disk; for example weeks or even months with very limited writing activity. And just minutes on an SSD. In either case your best bet is to stop working with your PC, as computers write continuously, whether prompted by their user or not.
We'll explain when that makes sense to do, but frequently yes. First check the Recycle Bin, Previous Versions, Time Machine backups, and cloud version history. Once you've exhausted all of these avenues then, assuming you're willing to try, install reputable "read-only" file-recovery software to a separate drive to access the lost files.
The reason is that the installer writes to the drive where your files were stored — possibly directly over top of them. Therefore, install the recovery software to a different drive. Then recover the data to a third storage area instead of recovering it back onto the original source.
Likely not, unless you shut down your computer almost instantly. The TRIM command (which deletes blocks) runs in the background when your system is powered up. Therefore, depending upon how long your computer is running after deleting files, there might still be some data left on the drive that hasn't been erased by TRIM before you shut it off. Left running, generally speaking, no.
After a free 48-hour diagnostic, the fee will be at least £300 + VAT. If the drive is good and the files were deleted recently, there may be a lower charge with some software, and we would rather tell you that than take the work.
A no-cost diagnostic — nothing to pay on most jobs if it fails, and deleted-file recovery from any hard drive, flash drive, or memory card. The longer you wait, the less will come back; start today.