← Back to the catalog

Accidental Deletion

Deleting a file doesn't erase it. This is one of the more recoverable situations in data recovery — provided you act quickly and don't do anything else with the drive.

What's actually happening

When a file is deleted — even "permanently," bypassing the Recycle Bin or Trash — the operating system does not erase the data itself. It removes the entry that points to that data in the file system's index (the Master File Table on NTFS, the catalog on APFS, the inode table on ext4, and so on) and marks the space the file occupied as available for reuse. The bytes that make up the file stay exactly where they were until something else gets written into that same space.

How recoverable this really is

Two things determine how this goes, and neither has much to do with which software gets used. First, the drive hasn't been used for much of anything since the deletion — every write, even something as small as the OS updating a log file in the background, is a chance the freed space gets overwritten. Second, the storage type behaves the way this explanation assumes: a conventional hard drive, or an SSD with TRIM disabled.

On an SSD with TRIM enabled — the default on essentially every modern system — the drive itself often proactively erases the physical cells behind deleted files within seconds, specifically to keep write speeds up. On those drives, recovery odds can fall to zero within moments of the deletion, regardless of what's done afterward.

The general approach

Recovery software scans the file system's own structures for the traces a deleted file leaves behind — orphaned directory entries that still describe where the data begins, essentially a pointer nobody's using anymore. When even those are gone, tools fall back to scanning the raw disk for the recognizable byte patterns that mark the start of common file types (a technique usually called "carving"). The first method is faster and keeps original names and folder structure; carving works even on a badly damaged file system, but it typically can't recover names, and it struggles with files that were fragmented across the disk.

The one thing not to do

Don't keep using the drive the files were on — installing a recovery tool onto it, saving recovered files back onto it, or just continuing normal work. Any of those can silently overwrite the exact data being recovered. If the files matter, stop writing to that drive immediately, and do everything else — installing software, saving output — on a different drive.

Practical, step-by-step guides for specific recovery software will be added here as separate linked articles.

This page describes the general situation, not a guaranteed fix for your specific case. If you'd rather have someone experienced take a look before you try anything, see what a hands-on evaluation looks like.