Most people try two methods and give up. There are many more “rungs” and they climb in a very specific order, starting with the thirty-second checks everyone knows, then moving into the version history few remember, followed by free recovery software and lastly when a lab will take control. Below is a full list of ways to access your deleted file(s), as well as an honest description of where your deleted file may be irretrievable.
A deleted file doesn’t get “deleted”; it’s just marked with a deletion flag in the directory and the area that was used by that file gets added to the list of available space. So after you delete a file, everything else you do (browsing, downloads, dropping a recovery tool onto the wrong drive) will be building work on top of whatever remnants were left behind from your deleted file. Before you start trying to recover anything, stop. Recover second.
If it happened within seconds, try using Ctrl+Z (Command + Z on a Mac) while in the same directory as where the file was when it disappeared. “Undo Delete” will literally be an instant undo and once you take action on something else, that’s over. Therefore this has to be at number one. Then look into the Recycle Bin or Trash. But make sure to check it thoroughly. Sort items based upon how long they have been there. Use the box in the top right hand corner. The reason we’re telling you to do these two steps is because a recycle bin with items going back three years can easily hide items. There are two recycling bin issues that you need to know about. First, Windows automatically deletes files larger than what can fit into the recycle bin without taking them through the recycle bin first. Second, if you delete something from a flash drive or memory card then it goes directly to “gone”, which means it goes to step three. And don’t let the term “Shift+Delete” scare you; Shift+Delete simply bypasses the recycle bin. In fact, the data behind a Shift+Delete is just as recoverable as any other type of delete.
This is the “rung” that recovers lost work documents, and most people don’t even use it. On Windows: right click on the folder where your document was housed. Select Properties. Then select Previous Versions. If you’ve used File History or had restore points running at some point in time, the entire folder will be saved by date as a snapshot copy including all deleted content. Synced to anything? Each provider for cloud syncing (OneDrive, Google Drive, Dropbox and SharePoint) has their own recycle bin (typically 30 days, often longer on business plans). Per-file version history also exists; the file may still exist in the cloud bin if you delete it locally. An overwritten file may roll back to yesterday. On a Mac: open Time Machine from within the document’s folder and go back in time to find your document. On a work share: never assume that a “permanently deleted” file is truly deleted... Ask your administrator. Server volumes typically store shadow copies and admin-side bins that will retrieve a ‘deleted’ file instantly. All items recovered using this “rung” are restored with original name, folder, and time stamp (perfect clones, zero tools, zero risk); that is why we put this above software.
No bin, no version, no backup: now is the time for your data recovery scanning tool to be used. Three key rules will govern whichever scanner you use. Install the tool on a different drive from the one where the data loss occurred (you don’t want to overwrite what you are looking for by installing the recovery software to the same hard drive as the patient). Save whatever it finds to a different drive too. And point it only at healthy hardware: if a disk clicks, hangs, or disappears, it is time to perform rung four rather than a six-hour deep scan. Tools available include: free versions of Recuva (recent Windows deletions), PhotoRec (unlimited carving of files from disks, sticks, cards, etc., regardless of file systems being intact); and Disk Drill, an example of a paid product whose previews-before-payment we weigh up in our full review. Files recovered using these tools typically will lack folder structure and name assignments; they are simply recovering the contents. One wall, stated bluntly: the internal SSD in any recent computer is utilising TRIM, which will physically delete deleted blocks from the drive within moments, so scanners will only recover ghosts. For SSD deletions, rungs one and two were always the goal. Our SSD recovery guide explains what can be done when the SSD itself has died.
There are three types of situations in which DIY no longer suffices. When the deleted files have been partly overwritten (e.g. documents open but they appear to be gibberish; images are striped with grey), some specialised tools may sometimes recover information that a consumer grade scan will not. Storage failing as hardware (i.e. clicking, disappearing, freezing) indicates it’s time to image the failed drive once, using a gentle method. The recovery process will then run on the copy rather than the original. At the other extreme of risk, the stakes turn the first attempt into the only one that counts. This could include a company’s financial records; a law firm’s case file; the last remaining copy of something that cannot be replaced. Our deleted file recovery service begins with a complimentary diagnostic followed by a written quote. And then there is the truthful end-of-the-line of this spectrum: a file has been completely overwritten with newer data; a file on an SSD has been TRIM’d. In either instance, that file does not exist anymore. Anyone who claims otherwise is likely trying to sell you something. The good news from the lab bench is that true overwriting of all data within a file is much less common than many believe. That is why we give away the diagnostic; it earns its free price before anyone gives up.
Generally yes. File recovery works on hard drives, external drives, USB sticks and memory cards. When you delete a file, the operating system simply removes the “index” entry pointing to the location of the file and makes the space available for reuse, but the file itself remains intact until something else writes over top of it. This concept forms the entire basis of how file recovery works, and it’s why using your device even one additional time after deleting a file decreases your chances of successfully retrieving it. However, there is an exception: in computers with modern solid-state drives (SSDs), the operating system uses TRIM to erase the blocks previously occupied by deleted files almost immediately.
No, this is the biggest and most stubborn of myths about computers. Using Shift+Delete will skip the Recycle Bin but when you delete anything beyond that point, you are doing the exact same thing as deleting using a typical delete operation. It strikes the index, but it does leave the data. All recovery products would be able to find and recover deleted items just the same. In order to destroy your files forever you need to write new information over the old file space (on a hard drive) or perform a TRIM operation on an SSD.
Frequently and often without needing any recovery tools. Files deleted from a Windows server share tend to remain in two areas that consumer recovery tools cannot access: the server’s recycling bin configuration and the Volume Shadow Copies area; to get here simply right-click on the folder where you want to view previous versions then go into Properties, then Previous Versions. Before you fear the worst, call whoever is responsible for the server. If the server itself has failed, we have an entire section dedicated to recovering servers.
It depends how much was added or changed after that. Without checking, we cannot know. Nothing is lost to time itself, as it doesn’t destroy anything; rewriting (overwriting) does. Browsing lightly for weeks on a half full 2 TB drive may never have touched any of your documents. Downloading heavily on a near full laptop likely buried them. A scan will cost you nothing and settle this. On an SSD, save yourself the suspense and go right to your backup files and cloud versions.
We offer a free 48-hour diagnostic service at our lab; we’ll tell you if we believe your deleted files exist and provide a fixed written quote for their recovery prior to starting any work.