Deleting a file removes its entry from the index and marks the space reusable — the contents stay exactly where they were. That is why recovery works. It is also why a computer left running quietly writes over them, and why hard drives and SSDs give you completely different amounts of time.
$ mdr diagnose /dev/sdb → Device: SanDisk SD card (128 GB) · camera → Status: DELETED FILES — 1,240 photos removed → Client: confidential · Derby DE1 $ mdr engineer-working → Forensic image: taken · originals untouched → Deep scan + carve: JPEG/RAW signatures → Found: 1,236 / 1,240 files $ mdr verify → ✓ holiday_photos — 1,236 files → ✓ all preview OK — intact → ✓ deleted shots — recovered
Deleted data survives only until something is written over it, and a running computer writes constantly without being asked — updates, caches, logs, indexing. On an SSD the window is shorter still, because the drive erases deliberately.
Understanding this is what tells you how to behave in the next hour.
Deleting removes a file’s entry from the index and marks the space it occupied as available. The contents are untouched — every byte still sits on the disk, simply no longer described by anything. That is why recovery works at all, and why it works quickly when nothing has been written since.
The corollary is the uncomfortable part. That space is now first in line to be reused, and a computer left on writes to it without being told to: temporary files, log entries, browser cache, update staging, search indexing. None of it is dramatic and all of it has to land somewhere. Which is why the advice is to stop using the machine rather than to go looking for a tool.
The most important distinction here, and the one most guidance skips.
Worth exhausting before treating this as a recovery job at all.
Obvious, routinely overlooked in a panic, and it restores in one click with the original path intact.
Windows File History and macOS Time Machine both keep versions quietly in the background. Right-click the containing folder and look at Previous Versions, or enter Time Machine on that folder.
OneDrive, Google Drive, Dropbox and SharePoint all retain deleted items and prior versions for a period — and the web interface exposes far more than the desktop sync client does.
A surprising share of “lost” documents were attached to something, shared with someone, or are sitting in a Sent folder. Search before assuming.
These are the jobs where we most often send people away.
A single drive is from £300 +VAT after a free 48-hour diagnostic. But where the drive is mechanically healthy and the deletion recent, reputable read-only software run from a different drive will frequently do the job for a fraction of that, and we will say so.
Where a laboratory is genuinely needed: the drive is failing as well, the file system is damaged rather than merely missing an entry, part of the material has been overwritten, or the result has to withstand scrutiny later. Otherwise the honest answer is usually software — installed elsewhere, recovering to somewhere else again.
Get the device to us with a short note on what happened. The diagnostic that follows costs nothing, and the figure that follows it is fixed in writing before any work begins.
Nothing can begin until the device is on the bench, which makes this the only step that needs anything from you. Pack it properly, put your details in with it, and send it over. What follows is a free diagnostic and a written figure, in that order.
Posting it? Use something tracked and insured — whatever is on the drive is worth considerably more than the postage. Bringing it in? Weekdays, 9am to 5:30pm, and it still wants packing as above for the journey.
Tell us what the device is, what it is doing, and anything already tried — an engineer will come back with a realistic view of the odds and a price band, before you commit to posting anything.
We’ll be in touch shortly. If it’s urgent, call 0161 871 0788.
The things people most often want to know about getting deleted files back.
On a hard drive, usually. Deleting removes the index entry and marks the space reusable while leaving the contents intact, so they survive until something overwrites them. On an SSD, often not — TRIM erases those blocks physically within minutes.
On a spinning disk, potentially weeks or months if little else is written. On an SSD, minutes. Either way the most useful thing you can do is stop using the machine, because a running computer writes constantly without being asked.
Frequently, and we will tell you when that is the sensible route. Check the Recycle Bin, Previous Versions, Time Machine and cloud version history first. If those come up empty, reputable read-only software installed to a different drive often works.
Because the installer writes to the drive — potentially straight into the space holding the files you want back. Install it to a different drive, and recover to a third location rather than back onto the source.
Only if it was shut down almost immediately. TRIM erases the blocks in the background while the drive has power, so a machine switched off promptly may retain whatever the drive had not yet reached. Left running, generally not.
From £300 plus VAT after a free 48-hour diagnostic. Where the drive is healthy and the deletion recent, software will often do it for far less — and we would rather tell you that than take the work.
A free diagnostic, no fix no fee on most jobs, and deleted-file recovery from any drive, stick or card. The sooner you stop, the more comes back — start today.