How to Recover Deleted Files Before They're Overwritten

You have just deleted a quotation, family photo folder or coursework file, and the bin is empty. The next few minutes can make a real difference. Knowing how to recover deleted files starts with one rule: stop using the affected device as soon as possible. A deleted file is often not removed straight away; its storage space is simply marked as available. Saving new files, installing software or continuing to work can overwrite it.

Recovery is never guaranteed. The right approach depends on where the file was stored, how it was deleted, whether the device is encrypted and whether a backup exists. Start with the simplest checks, then move carefully towards specialist recovery where needed.

Start by checking where the file went

On a Windows PC, deleted files normally move to the Recycle Bin. Open it, sort by deletion date or search for the filename, then right-click the item and choose Restore. It should return to its original location. On a Mac, the equivalent is the Bin.

This is also worth checking on shared office PCs. A colleague may have moved a document rather than deleted it, or it may have been saved under a similar name in Downloads, Documents or a shared network folder. Use the system search and look for file types as well as names. For example, search for .xlsx, .pdf or .docx if you know the document format but not its title.

If the file was held in OneDrive, SharePoint, Google Drive, Dropbox or another cloud service, sign in through the relevant account and inspect its recycle bin or deleted items area. These services commonly retain deleted files for a limited period, although retention periods vary by subscription and settings. Business Microsoft 365 accounts may also have additional recovery options through an administrator.

Restore a previous version or backup

A backup is the safest route to recovery because it restores a known copy rather than attempting to reconstruct deleted data from a drive. For a business, this may be a managed backup, a server snapshot, a cloud backup or a copy held off-site. At home, it could be File History, Time Machine, a USB backup drive or a cloud photo service.

Windows file history and previous versions

On Windows, right-click the folder where the file was stored and select Properties. If File History, System Protection or a compatible server backup was in use, the Previous Versions tab may show an earlier copy of that folder. Open the available version first and check that it contains the required file. Copy the file to a different location where possible, rather than immediately replacing the current folder.

For files stored on a business server, do not assume that a previous version is the most recent one. Check its date and time carefully. Restoring the wrong folder version can replace newer work, particularly in active shared locations.

Mac, cloud and mobile backups

Mac users should check Time Machine if it was configured before the deletion. Open the folder where the item was saved, enter Time Machine and go back through the available dates. Restore only the files you need.

For photos, contacts and documents on a phone or tablet, check the device’s Recently Deleted folder first. Apple Photos, Google Photos and many Android gallery apps retain deleted images temporarily. If the item has gone from there, an iCloud, Google account or device backup may help, but restoring a whole phone backup can replace newer data. Make sure current messages, photos and app data are protected before taking that step.

How to recover deleted files from a PC drive

If the Recycle Bin is empty and no backup exists, recovery software may be able to locate files that have not yet been overwritten. This is most successful on a traditional hard disk drive, particularly when the deletion happened recently.

Before running anything, stop saving to that drive. If possible, shut the PC down. Do not download recovery software onto the same internal drive that contains the missing files. The installation itself may overwrite the very data you need. Use another computer to create a recovery USB drive, or install the tool onto a separate external drive.

When scanning, save any recovered files to a different physical drive. Never recover them back to the source disk. Review filenames, folder paths, file sizes and preview options where available. A recovered document with the correct name may still be damaged, so open copies and check their contents before relying on them.

Free recovery tools can be suitable for a straightforward accidental deletion. They are less suitable when the device is making unusual noises, disappears intermittently, has been formatted, has suffered liquid damage or contains valuable business records. Repeated scans and restarts can turn a recoverable fault into a more difficult one.

SSDs need a different expectation

Modern laptops often use solid-state drives (SSDs). These are fast and reliable in normal use, but deleted-file recovery can be much harder because of a feature called TRIM. TRIM helps the SSD clear unused storage blocks efficiently. Once it has run, software may have little or nothing left to recover.

That does not mean you should give up immediately. Check backups, cloud recycle bins, previous versions and any synchronised folders first. But do not keep using the laptop in the hope that a recovery tool will improve the result. On an SSD, time and further activity are usually against you.

USB drives, memory cards and external disks

Files deleted from USB sticks and SD cards may bypass the Windows Recycle Bin, so the absence of a bin entry is normal. Remove the device safely and avoid using it for new photographs, documents or transfers. If it is a camera memory card, do not take further pictures with it.

Recovery can work well where the device is healthy and has not been reused. However, a USB drive that repeatedly disconnects, asks to be formatted or becomes extremely slow may have a hardware fault rather than a simple file deletion. Formatting is rarely the first answer if the data matters. It can complicate recovery and may conceal an underlying issue.

External hard drives deserve similar care. If a drive clicks, grinds or fails to spin up, switch it off and seek advice. Opening a hard drive at home, changing internal parts or placing it in a freezer are not sensible fixes. They can cause permanent damage to the platters and reduce the chance of professional recovery.

When deleted files are part of a business incident

For a business, the missing file may be the symptom rather than the whole problem. A large number of deleted documents, unfamiliar renamed files, inaccessible shared folders or ransom notes could point to a cyber security incident. Disconnect the affected computer from the network if it is safe to do so, but do not wipe it or begin restoring data without a plan. Preserving evidence can be important for understanding what happened and preventing a repeat.

Tell staff what to do next: stop working in the affected folder, avoid emailing suspicious files and report the issue promptly. Your IT provider can assess whether the deletion came from a user error, synchronisation conflict, failed update, storage fault or malicious activity. A proper response should check backups, restore data in a controlled order and confirm that the original cause has been addressed.

This is why businesses need more than occasional copies to a portable drive. A sensible backup arrangement uses separate storage, clear retention periods, regular monitoring and routine restore testing. A backup that has never been tested is only an assumption.

When to stop and ask for help

Professional help is sensible when the files are commercially important, irreplaceable or needed quickly. It is also the right choice if the drive is physically damaged, encrypted, encrypted by ransomware, formatted unexpectedly or no longer detected by the computer.

A local repair workshop or IT support provider can help assess the device without adding unnecessary risk. Bring the device, any relevant power supplies and a clear note of what happened: the device type, when the files disappeared, the folder they were in and anything you have already tried. That information helps avoid duplicated work and gives recovery the best possible chance.

For businesses across Norwich, Norfolk and Suffolk, Anglian Internet can help investigate data loss, repair affected hardware and advise on backup arrangements that suit the way your team works. The sooner you stop using the affected storage and ask for support, the more options are likely to remain.

Deleted does not always mean gone, but recovery becomes harder with every new file written to the device. Act calmly, protect the original storage and favour a verified backup whenever one is available.