Once a file has been deleted, the OS will no longer see this location as holding valid data so the space can be reused by other files. For all intents and purposes, though, your deleted data remains until overwritten. What you do in the first ten minutes after deleting your files matters much more than what software you use to attempt to recover them later. Example: a Dell SSD caught mid-TRIM.
Every time you save new files to your drive; every time you install updates; every time your web browser caches a page or image; these are candidates for writing directly to the space your deleted file occupied. The timer starts when you delete your files; it’s just now that you are aware of the issue.
Deleting files on a traditional hard disk file system simply removes an entry in the file system table for the file. This will mark it as deleted and make those same clusters of data available again within the free list of the file system. However, all of the original data (bytes) remain in their exact position on the disk unless and until the operating system chooses to use that space again. When the operating system does choose to re-use that space, this can happen either immediately or months from now, based upon the volume of usage of the subsequent files created after deletion.
This is all about how data recovery works. It’s also the reason why time is so much more important than method. Data deleted one hour ago from a computer that has been turned off since then will likely still exist and be recoverable. On the other hand, a file deleted a week or two ago with Windows Update and internet surfing taking place constantly may no longer be available to you at all.
Recycle Bin or Trash. The most obvious, yet easily overlooked option; it is available immediately. Use Previous Versions or File History on your Windows computer or Time Machine on your Mac to go back in time. You will never touch your file system when you use either of those options, so always try them before any software. Cloud versioning: that includes OneDrive, Google Drive, Dropbox, and iCloud. All of them save files for a certain number of days (typically 30 days) after they have been deleted. And many users forget their files were synced.
When all of your options are used up is when the time to use a scanner comes in, and at this point you should already have stopped using that hard drive.
On most solid state drives (SSDs), when files or folders are deleted, TRIM is activated: the operating system lets the drive know what blocks were previously allocated to deleted files/folders, and the drive removes these blocks in the background to maintain performance during writes. This removal is genuine and happens within minutes, not months. Therefore, if you delete a file on a functioning SSD utilising TRIM, chances are it can’t be recovered by anyone, not due to tool capabilities but due to the fact that there is no physical data left from said file.
It’s also good to know about exceptions: TRIM doesn’t work with most USB external cases, can’t be run on older operating systems (file systems), and won’t even run if the SSD has failed. That last case is the recoverable one; a dead SSD full of information is an entirely different situation than a working SSD which you have already deleted files from using TRIM.
The best course of action to determine why a drive is clicking/ticking/disappearing periodically is not to run a scan utility; these programs will simply continue to spin (and potentially burn out) a failing drive. In addition, since RAID and/or NAS volumes utilise multiple drives, most single disk recovery utilities will either be unable to identify the correct configuration or interpret the data incorrectly. And if the files were deleted weeks ago on a machine in daily use, they have often already been overwritten.
Where the drive itself has failed, recovery is from £300 +VAT per drive (after a free 48-hour diagnostic), and in most cases you only pay if we recover your data. Where the drive is healthy and the files were simply deleted, you should be told by us whether it would make sense to continue with the cost of recovering your data. In some cases it will not.
Often, yes. “Permanently” deleted files generally mean that you’ve removed them from the Recycle Bin as opposed to removing the actual file. A permanently deleted file remains on the hard drive until some other activity writes something new into that space, so it’s based upon how frequently the drive is being used since the deletion took place, not necessarily how you actually deleted it.
Stop using the drive. Avoid writing to the drive or installing software. If this is your primary drive, please shut off the computer. Every time you use the drive after deleting your file you run the risk of landing on the exact location of where your original file was located on the drive and destroying any remaining bits of data from your original file.
Generally no, provided the disk is otherwise functioning properly. A TRIM command allows the SSD to delete the data blocks allocated to deleted files, and this deletion process occurs within minutes as part of normal operation. There are some exceptions: typically those include SSDs in a USB enclosure (TRIM will generally not be passed through); very old file systems; and a physically failed SSD retaining its data (even though it’s technically failed, the data stored on it remains retrievable).
Only on a healthy drive, and never install it on the drive from which you’re attempting to recover, because the installation program itself may write over the data that you’re seeking to recover. In addition, if the drive is experiencing problems such as generating excessive noise or periodically losing contact, scanning programs can cause significant harm by keeping a failing drive operational for extended periods of time.
For drives that have failed, we charge from £300 + VAT for each drive after providing a complimentary 48-hour diagnostic, but in most cases you only pay if we recover your data. When the drive is functional and the files were merely deleted, prior to charging you for our services, we’ll provide you with an honest assessment of whether recovery would be worthwhile.