When files are deleted from a computer, they are not necessarily gone forever. Whether or not deleted data can be recovered depends on several factors.
Quick Answers
Here are quick answers to some common questions about recovering deleted files:
- Deleted files are not immediately erased from a computer’s hard drive. The space they occupied is just marked as available to be overwritten.
- As long as the space occupied by a deleted file has not been overwritten, data recovery software can scan the hard drive and recover the file.
- The longer a deleted file remains on a hard drive before being overwritten, the better the chances of recovering it.
- Solid state drives (SSDs) make data recovery more difficult because they overwrite data faster than traditional hard disk drives (HDDs).
- Files deleted from the Recycle Bin can often still be recovered as long as the space has not been reallocated and overwritten.
Factors That Affect Recovery
There are several key factors that determine whether deleted files can be recovered from a computer or storage device:
- Overwriting: As soon as new data is written to the same disk sectors that a deleted file occupied, the old data is overwritten and no longer recoverable.
- Drive type: SSDs overwrite deleted data faster than HDDs, giving a shorter window for recovery.
- Time since deletion: The longer ago a file was deleted, the greater the chance something else has overwritten it.
- File system: Some file systems like NTFS keep more metadata about deleted files than others.
- Data fragmenting: Heavily fragmented files are harder to fully recover.
Understanding these factors allows you to better judge the likelihood of recovering erased data from a given device.
How Deletion and Overwriting Works
When a file is first saved to a hard drive, it is allocated a set of disk sectors where the data is stored. This allocation information is kept in the file system’s metadata that tracks what parts of the disk belong to which files.
When a file is deleted, the operating system simply removes it from the file system directory and marks its disk sectors as available space. The data itself remains on the hard drive waiting to be overwritten.
The actual overwriting doesn’t happen right away. It occurs later on an as-needed basis whenever new data is saved that happens to get written to the same disk sectors. Once other files claim that space, the original deleted file is lost for good.
Secure Deletion Methods
There are techniques users can employ to try to ensure that deleted files are unrecoverable by immediately overwriting the data:
- Drive wiping: Software can overwrite all sectors on a drive to scrub deleted files.
- Secure delete: Tools overwrite files multiple times before deletion.
- Encryption: Encrypting files requires their secure deletion to avoid leaks.
However, these methods are not entirely foolproof. Sophisticated scanning may still be able to recover fragments of old overwritten data in some cases.
Recovering Data from the Recycle Bin
When files are deleted from within an operating system like Windows or macOS, they get placed into a special Recycle Bin folder. Items in this folder have not yet been permanently scrubbed from the hard drive.
Recycle Bin recovery simply involves restoring the deleted files back to their original location. This is possible until the Recycle Bin is emptied or the space is needed for new files. Then, the sectors holding the deleted data get reallocated and overwritten.
Using Data Recovery Software
Data recovery programs are the best way to retrieve deleted files from a hard drive or external storage device. They work by scanning the drive sector-by-sector and looking for data signatures of common file types.
Once patterns are found indicating the start of JPEG, PDF, MP3 or other file formats, the software reconstructs the file’s content and directory information as much as possible. This recovered data is then saved to a different drive than the one being scanned.
Recovery software can often restore deleted files even long after they were removed, as long as the original occupied clusters have not been reused and overwritten. However, fragments of files may not be recoverable if impacted clusters have been reallocated.
Recovery Software Options
Some popular data recovery programs include:
- Recuva
- EaseUS Data Recovery Wizard
- Stellar Data Recovery
- Disk Drill
- R-Studio
Many security and forensic analysis tools like Encase also have file recovery capabilities.
Physical Recovery Methods
When a drive is physically damaged and normal access is impossible, more specialized techniques like chip-off forensics can sometimes recover the raw storage contents.
This involves carefully dismantling the drive in a clean room and transplanting the storage media onto another functional circuit board so it can be read. This is an expensive last resort for critical recoveries.
Recovering Deleted Files from SSDs
Solid state drives (SSDs) store data differently than traditional hard drives, making deleted file recovery more difficult.
Unlike HDDs that simply mark deleted sectors as available, SSDs perform an erase process called garbage collection to actively overwrite deleted data blocks for improved performance.
This means that deleted files stored on SSDs have a shorter window before being destroyed, especially if the drive is actively being used which accelerates garbage collection.
However, recovery software can still pull data from SSDs if it gets to it quickly enough before large portions of the files are overwritten. The chances decrease over time as more data is written.
Recovering Data from Cell Phones and Tablets
Smartphones and tablets also utilize solid state storage in the form of flash memory chips and eMMC chips. As with SSDs, this makes data recovery difficult if devices are actively being used.
Fortunately, many mobile devices tend to have less frequent write activity than desktop SSDs, increasing the odds of recovering recently deleted files. But over time, the likelihood drops drastically.
Independent data recovery companies specializing in mobile devices can sometimes pull lost data by performing low-level access and extraction of the flash storage chips. But this is costly and depends on how much of the target data is still intact.
Can Erased Data on Hard Drives Be Recovered? It Depends…
Whether or not an erased file can be recovered from a computer hard drive depends on two key factors:
- How soon after deletion recovery is attempted
- Whether the storage sectors holding the deleted data have been reallocated and overwritten
As soon as new data is saved to the same sectors occupied by a deleted file, those sectors are overwritten and the original deleted data is destroyed. However, as long as the sectors remain untouched, recovery software has a window to scan the drive and retrieve the deleted files.
On traditional hard disk drives, this window can be weeks or months unless the drive is filled up or heavily used. But on solid state drives, aggressive garbage collection and wear leveling make data recovery much more time sensitive, sometimes reducing the window to just days.
The bottom line is that erased files can often be recovered from storage media like hard drives and SSDs if recovery is attempted quickly, but the likelihood drops steadily over time. Devices that see constant write activity make data recovery progressively more unlikely.
Can Formatted Hard Drives Be Unformatted to Recover Files?
When a hard drive is formatted, the file system structures are recreated and any existing files and folders are marked for deletion. This makes data recovery more difficult but not always impossible.
The key factor is again whether the deleted file data has been overwritten with new content written to the same disk sectors.
- If a drive was formatted but no new data has been written, recovery software has a good chance of restoring the deleted files.
- If even a portion of a deleted file was overwritten, that portion will be unrecoverable. But other parts may still be retrievable.
- If a substantial amount of new data was written after formatting, most deleted files will have been fully overwritten and be unrecoverable.
For the best chance of recovering files after a format, avoid writing any new data to the drive and use file recovery software immediately. The longer the delay, the lower the odds of successful file recovery.
Can Erased Files Be Recovered from the Recycle Bin?
When files are deleted from within an operating system interface, they get moved to a special Recycle Bin folder. Until the Recycle Bin is emptied, it is usually possible to restore deleted files by simply retrieving them from this folder.
However, once the Recycle Bin has been emptied, the files are permanently deleted from the directory structure. The actual data still remains on the hard drive temporarily until being overwritten.
At this point, recovering erased files from the Recycle Bin requires data recovery software that can scan the drive and extract files based on data signatures. As long as the space occupied by the deleted data has not been reallocated, this has a good chance of success.
Can Shadow Copies Recover Overwritten or Erased Files?
Windows has a feature called Shadow Copy that provides some limited recovery capabilities for deleted files. By default, System Restore and File History leverage Shadow Copies.
Shadow Copies periodically capture snapshots of files at certain points in time like before updates. If enabled, Shadow Copy can retain older versions of files and folders after deletion.
However, Shadow Copies have some key limitations:
- Limited space is allocated, so old snapshots get deleted over time.
- If storage sectors are rewritten, Shadow Copies of older data are destroyed.
- Encryption and compression limit Shadow Copy usefulness.
Due to these restrictions, Shadow Copies can only recover limited older versions of files. They are not reliable against intentional deletion or drive formatting.
Can Deleted Files Be Recovered After Rewriting the Disk?
If a hard drive is completely rewritten by performing a full format or using a utility like DBAN, deleted files cannot be recovered.
The rewrite process overwrites all sectors on the drive with new data, destroying any remnants of files that once occupied those clusters. Even advanced forensic data recovery cannot salvage deleted files after a complete disk rewrite.
Some exceptions are areas marked as bad sectors that get skipped by the rewrite. But this accounts for a tiny fraction of a drive’s storage capacity.
The only hope for file recovery after rewriting a disk is if a sector-by-sector image backup was made before the process. Otherwise, all previous files are permanently destroyed.
Can Overwritten Files Be Retrieved by Looking for Traces?
There is speculation that overwritten data leaves traces that could potentially be recovered using sophisticated magnetic scanning techniques like magnetic force microscopy.
In theory, bits realigned by writes do not perfectly revert to a blank state and microscopic residual traces may remain detectable. But even if traces exist, recovering anything usable is enormously challenging.
While traces of overwritten data may exist, commercial data recovery services do not currently offer any services based on trace recovery. There are no known instances of overwritten hard drive data being practicably recovered through residual traces or fingerprints.
Can Deleted Files Be Recovered After Reinstalling the OS?
Reinstalling an operating system over an existing OS installation without reformatting the drive does not necessarily make file recovery impossible.
Since the reinstallation process primarily overwrites operating system files rather than the entire drive, there is a good chance deleted user files such as documents and photos still reside on the disk untouched.
Recovery software can often extract these deleted files if their original sectors have not been reallocated for new data. The longer the time since deletion and reinstall, however, the lower the odds of recovery.
A full format and OS reinstall makes recovery far less likely since most sectors get completely overwritten in the process.
Conclusion
While no deleted data is ever truly gone until it has been overwritten, whether or not a particular file can be recovered depends on many variables.
Recent deletions from traditional hard drives are generally recoverable in the absence of any new data being written to the drive. But the likelihood drops steadily over time as more overwriting occurs.
SSDs and mobile devices overwrite deleted data much faster, giving a smaller window for possible recovery. Physically damaged drives make data recovery exponentially more difficult.
In most cases, quick action with data recovery software offers the best chance to restore deleted files. But if a drive is heavily used or reformatted, recovery becomes much less feasible over time.
While there are anecdotal tales of recovering long-deleted data, this represents the exception rather than the rule. Once deleted files have been overwritten even just partially, permanently restoring them becomes impossible with current technology.