How to Restore Deleted Files on a Storage Device

Finding a secure way to restore deleted files

Every year, organisations and home users spend time and money trying to restore files that have been deleted by accident. Someone tidies up a shared folder, clears space on a drive or empties the recycle bin, and important files disappear, often with no backup in place to rebuild them quickly. The consequences of accidental deletion can be serious and costly.

When restoring lost files, the main aim is to avoid overwriting or corrupting the data you are trying to get back. Whatever the type of storage device (an internal hard drive, an external drive, an SSD, a RAID array, a NAS or a server) and whatever the operating system (Windows, macOS or Linux), the same principles apply, and deleted data can often be recovered if you act quickly.

Check the easy options first

Before anything else, look in the places a deleted file usually goes:

• The Recycle Bin (Windows) or Bin (Mac). Files you delete normally go here first and can be put back.
• Your backups. On a Mac, open Time Machine and browse back to before the file was deleted. On Windows, File History (if it was turned on) can restore earlier versions of files and folders.
• Cloud services. OneDrive, iCloud Drive, Google Drive and Dropbox keep deleted files for a while in their own recycle bin or “recently deleted” area.

If none of these has the file, read on before doing anything else with the device.

What happens to a file when you delete it on a storage device?

When a file is deleted, or removed from the recycle bin, the contents are not usually wiped straight away. What is removed is the file system’s record of where the file is stored, so the operating system can no longer find it.

Data is stored in blocks. The file system keeps a directory of file names and the blocks that hold each file’s contents. When a file is deleted, its blocks are marked as free, but on a traditional hard drive they still contain the old data until something new is written over them. That is when an overwrite happens, and why acting fast matters: the longer the device is used, the more likely those blocks are to be reused.

SSDs are different

Solid state drives (SSDs, including NVMe drives in most modern laptops) usually use a feature called TRIM. When a file is deleted, the operating system tells the SSD which blocks are no longer needed, and the drive’s controller often clears them in the background, sometimes very quickly. This means deleted files on an SSD can become unrecoverable much sooner than on a hard drive. If you’ve deleted something important from an SSD, stop using the computer straight away and get advice. See our SSD data recovery page for more.

Deleted or corrupted files on external hard drives

External drives are often used as a backup, but they can lose data too. Common causes include:

• Unplugging without ejecting, or a cable knocked out or power lost mid-copy, which can leave files or the whole file system corrupted.
• Moving the drive between different computers and operating systems, which can lead to file system errors or prompts to format the drive. Don’t agree to format it.
• Malware, including ransomware, which can delete or encrypt files on any connected drive.
• Physical problems: bad sectors, drops and knocks, overheating, damp and general wear. A drive that clicks, beeps or isn’t recognised has a hardware fault, and software won’t fix it.

The same rule applies: stop writing to the drive. Don’t run repair utilities or chkdsk on it, don’t keep plugging it in to see if it comes back, and never open it. Our external drive recovery page explains what we can do.

Steps to take when you accidentally delete a file and can no longer access it

Overwrites are the biggest threat to a successful recovery, so:

1. Stop using the device. If the deleted files were on your computer’s system drive, shut it down. Every program running, every update and every web page cached can write new data.
2. Don’t install recovery software onto the same drive, and don’t save any recovered files back to it. Doing so can overwrite exactly what you want back.
3. Don’t run repair tools or format the drive.
4. If the device has a physical fault, don’t use software at all. Clicking, overheating or a drive that isn’t detected needs specialist handling.
5. If the data matters, contact a specialist before trying anything else.

A professional lab first makes a sector-by-sector copy of the device and works from that copy, so the original is never put at further risk. Our data recovery process page explains each stage.

How Data Retrieval can help

Data Retrieval Ltd is an independent data recovery laboratory in London, recovering deleted and lost files for businesses, organisations and home users from hard drives, SSDs, external drives, RAID, NAS, USB sticks and memory cards. We offer a free initial assessment and a fixed, no-obligation quote before any recovery starts, and return recovered files on a new drive.

Call 020 7064 4996 or book a case online.