If you’ve lost an important file, then there’s a complete “ladder” of possible recovery methods (including some that you may have never thought about using) and they’re all in the right order. That includes version history (which almost no one ever uses) before moving onto free recovery programs and finally into a situation where someone has to take your computer into a lab. So here’s the full list, along with the true story about when a deleted file is truly gone.
Deleting a file doesn’t destroy it. It simply marks the area of the hard drive used by the file as “available”. After that, everything else you do with the hard drive (such as looking at pictures, downloading music, installing a recovery program in the wrong location) can be considered as building over the file’s burial site. Do nothing until you have recovered the file.
In the case of a file that was recently deleted, you should use Ctrl+Z (or ‘Cmd+Z’ if you have a Mac), located within the folder where the file existed. “Undo Delete” actually exists, is immediate, and lasts only until you perform another action. This is why it should always be tried first. Next, you need to look through the Recycle Bin or Trash. However, don’t skim this step. Sort by “date deleted”, and also make sure you know how to find items in the trash since a heavily littered recycle bin will obscure what you are trying to find. Also, keep in mind two important facts about recycling bins: Windows automatically bypasses the recycle bin for files larger than its capacity and for anything that has been removed from removable media (USB flash drives/memory cards). These are both examples of situations where items go directly to the third step of the recovery process. As for deleting files using Shift+Delete, while this may appear scary, it simply bypasses the recycle bin and does not alter the fact that the file can still be recovered like any other item.
This is the rung that will pull your files back out. Not many people climb this rung. On Windows: Right click the folder where you lost the file. Click “Properties” at the bottom. In the window that opens up, select Previous Versions. If either File History or some type of restore point schedule was ever set up then dated backups of every single file in the folder should show up including anything that got deleted. Synced anywhere? If you use OneDrive, Google Drive, Dropbox or SharePoint they each have their own recycle bins (usually for 30 days but often longer for business accounts) plus a version history by the file, so if you delete a file locally, there’s a good chance it will still be sitting in the recycle bin of whatever service you used to sync it. And if you’ve overwritten something, you’ll probably be able to roll it back to yesterday’s version. On a Mac: just go into Time Machine in Finder and scroll backwards to find your lost file. The recovered version of your file will look exactly like how you last had it. On a work network drive: don’t assume this doesn’t exist, ask. Most server shares create a backup of the deleted file(s) and store them in what is called a shadow copy of the share and/or in a bin created by an administrator who may be able to recover your deleted file quickly. The files restored from rung two are going to include everything you need (name, folder structure, timestamp) as perfect replicas without needing to install any software or take any risks. That’s why this rung always comes before rung three and software.
No bin, no version, no backup? Now the scanners earn their keep, under three rules that matter more than the brand. Install the tool on a different drive than the one that lost the data (to avoid overwriting the data by installing it on the same drive as where the missing data was stored). Save recoveries to a different drive as well. And only scan healthy hardware (a failing or dead drive requires rung four, NOT a six hour long “deep” scan). Scanners: Recuva (no cost) offers a simple wizard for recovering recently deleted items using Windows. PhotoRec (no cost, spartan, endless) recovers file(s) from all types of devices: hard drives, memory sticks, SD cards, etc. Even if your file system is corrupted PhotoRec will carve out your files. Disk Drill (paid) offers previews before payment, which we rate in our full review. Be aware that carved file(s) will most likely have lost name(s), folder structure(s) as well as other associated information. Recovered data is essentially content only. The first honest caveat about scanning for data loss is that the internal SSD in virtually all new computers uses TRIM technology. This technology automatically deletes the physical storage space of a deleted file once it has been removed from its directory listing. Therefore, there is little chance of successfully recovering deleted files off an SSD. Rungs one and two above were always the plan when dealing with SSD deletion. Our SSD recovery guide outlines what may be possible when the drive fails.
There are three scenarios where “do-it-yourself” (DIY) has been surpassed. Some deleted files have been overwritten in part: when documents will load but appear to be corrupted, images show horizontal lines, etc. When this occurs some professional utilities may recover information that a consumers utility cannot. In addition, when the drive is misbehaving as hardware (i.e. it clicks, freezes, or disappears) then we image your drive once, very carefully, and perform your recovery from the copy. Lastly, for those who cannot afford to lose their files, the stakes make the first attempt the one that matters (a business’s accounts, case files, copies of irreplaceable items, etc.); our deleted file recovery process begins with a complimentary diagnostic and a written quote. And the truth at the other end of the spectrum: if a file was completely written over by newer files or was TRIM’d on an SSD, it’s gone. Anyone who claims they can get back such a file is selling you something. But there is positive news coming out of our lab: although many people believe they have lost all their files because of complete overwrite of their disks, this actually doesn’t happen nearly as often as most people think. Therefore, our complimentary diagnostic is well worth the investment even before you decide to give up.
For hard drives, external drives, USB sticks, and memory cards, generally, yes. When a file is deleted on any of these media types, the operating system simply deletes the directory listing and flags the block(s) containing the file as available to write new data. As long as no additional data is written on the disk containing the file, the actual data remains on the disk. This is precisely how most file recovery services operate. However, each time you continue to read/write data on a disk after deleting a file, the chances of successful file recovery decrease. The major exception to this general rule is an internal solid-state drive (SSD) used inside today’s computers. Any time you delete a file from an internal SSD, the operating system immediately sends a command to the controller on the drive that causes it to erase the physical area of the disk that contained the deleted file.
No, that’s probably the most enduring myth of all time with respect to computers. Shift+Delete only skips over the recycle bin. Underneath, it performs the exact action as any other type of deletion. It strikes the index and leaves the data. Recovery tools work just as well whether you deleted normally or using Shift+Delete. What actually makes files unrecoverable is what occurs afterwards: new write operations on your hard drive, or TRIM for an SSD.
Generally, yes, and usually without any recovery software. Files that were deleted from a Windows file share often remain in one of two locations that DIY tools cannot find: The local recycle bin settings for the server where the files existed, Volume Shadow Copies (right click on the file or folder and select “Properties”, then select ‘Previous Versions’), or both. Before you assume the worst, ask the person responsible for running the server. If the server is down completely, our server recovery lane will be your route back to your lost data.
The honest truth is that it depends upon how much has been added since then, and there’s no way to find out without checking. Time destroys nothing; overwriting does. Browsing for weeks at a leisurely pace with 50% of the space free on a 2 TB hard drive might mean you never touched your own files. On the other hand, downloading heavily for a week onto a near-full laptop will probably bury those files. If you’re going to run a scan (which doesn’t cost anything), this will give you answers. If you’re running from a solid state drive, we recommend skipping the suspense and jumping directly into your backup(s) or cloud version.
A free 48-hour diagnostic: An honest evaluation of whether or not your deleted files currently exist, along with a set-price written quote for their restoration prior to performing any service.