When you delete a file on your computer, you may think it’s gone forever. However, that’s often not the case – deleted files can frequently be recovered. When you delete a file, most operating systems like Windows or MacOS don’t actually erase the data right away. Instead, they remove the file’s entry from the file system table, making it invisible to the user. The data itself remains on the hard drive until it gets overwritten by new data. This means deleted files can sit in this “deleted” state, waiting to be recovered.
Recovering deleted files is possible using data recovery software or tools built into some operating systems. However, the chances of recovery depend on several factors. The quicker you act to recover the deleted file, the better your chances are. In addition, how much you continued to use your computer after deletion affects the odds. The more activity on your device after deleting, the more likely the deleted file will get overwritten with new data.
In this article, we’ll explore what exactly happens when you delete a file. We’ll look at how operating systems like Windows handle deletions, where deleted data goes, and how you can recover deleted files if needed. Let’s start by understanding the key concepts:
Key Concepts
File Allocation Table (FAT) – The file system index that operating systems use to keep track of where files are stored on the drive. This table manages the addresses for all files on a volume. When a file is deleted, the entry in the table is removed, but the data still remains on the drive.
Master File Table (MFT) – The file system index in NTFS drives that records all file metadata. Like FAT, deleting files removes the entry but does not erase the data.
Data Overwriting – Writing new data over where deleted file data resides. The more this occurs after deletion, the harder recovery becomes.
Disk Fragmentation – When pieces of files get scattered across different areas of the disk over time. This makes overwriting deleted files less likely.
Undelete Utility – A software program designed to scan drives and recover deleted data based on various parameters.
Now that we’ve defined the key terms, let’s look at what happens when you send a file to the Recycle Bin or Trash.
What Happens When You Delete a File?
When you delete a file on your Windows, Mac, or Linux computer, the operating system removes the file’s entry from the file system index. As mentioned, this is the FAT or MFT depending on the file system. The data itself remains on the drive in the same location.
Some key points on file deletion:
- The bits representing the deleted file data remain in place on the disk
- The space occupied by the deleted content is now marked as “available”
- The entry referencing the file’s location is removed from the file system table
- The file becomes invisible to the operating system and user
For example, let’s say you have a file named report.docx that begins at sector 200 on your hard drive. When you delete this file, the FAT or MFT entry pointing to sector 200 is removed. However, the data within sector 200 itself is unchanged. The sectors just get marked as available for future writes.
Until the deleted file’s sectors get overwritten, the data remains recoverable by scanning the drive’s contents manually. We’ll cover how recovery tools leverage this in more detail later. But first, let’s look at what happens when you empty the Recycle Bin or Trash.
Emptying the Recycle Bin or Trash
When you send a file to your computer’s Recycle Bin or Trash, it can sit there indefinitely until you choose to empty it. Whether the file sits in the Recycle Bin for a day or a year, it has no impact on the likelihood of recovery. The Recycle Bin is simply holding the file name and directory path rather than deleting it fully.
Once you empty the Recycle Bin or Trash, the file behaves similarly to any other deleted file:
- The file entry is removed from the file system table
- The data remains in place on the disk
- The occupied sectors are marked as available for future writes
Emptying the Recycle Bin or Trash does not perform a secure erase on the file. The data continues existing in its original location until something overwrites it.
However, an important difference is that the file’s name and directory path are now lost, making recovery a bit trickier. We’ll discuss how data recovery tools can still locate files after emptying the Recycle Bin later on.
How Undelete Utilities Recover Data
As we’ve explained, deleted files can often be recovered due to the data remaining on a drive until something overwrites it. Let’s look at how undelete software utilities are able to locate and restore deleted data.
File Carving
File carving is one of the most effective undelete techniques. Without relying on file system metadata, file carving scans the drive block by block looking for specific file signatures. For example, JPEG images begin with the signature FF D8 FF E0. When a tool detects this signature, it knows the block may contain a JPEG file that was deleted.
By scanning each sector, file carving can rebuild deleted files based solely on their content, not file system data. This allows recovery even after emptying the Recycle Bin when the original filename and directory are lost. However, fragmentation can make file carving less reliable.
Using File System Metadata
Undelete tools can also leverage FAT and MFT data to locate deleted files more efficiently. For any files deleted from the Recycle Bin/Trash, the original filenames, directory structure, and file system data is still available. This makes finding and recovering files faster compared to file carving alone.
Volume Shadow Copies
Microsoft Windows has a built-in recovery option known as Volume Shadow Copy Service (VSS). This takes periodic snapshots of the file system in case users need to restore to a previous version. VSS snapshots exist outside the normal file system, so deleted files may remain in older snapshots.
Advanced recovery software can browse Volume Shadow Copies looking for deleted files that no longer exist in the current file system. This provides another avenue for undelete.
Factors Affecting File Recovery Chances
If you accidentally deleted an important file, how likely is it you’ll be able to get it back? Here are some key factors affecting recovery odds:
Time
The quicker you attempt recovery, the better your chances. As time goes on after deleting a file, the more likely something will overwrite the sectors where it resided. Attempting recovery immediately after deletion provides optimal odds.
Drive Usage
How much you continue writing new data to the drive affects recovery likelihood. The more you use the drive after deleting a file, the greater the chances of overwriting. Minimizing usage of the drive after an accidental deletion helps avoid overwriting deleted contents.
Drive Space
If your drive has a high percentage of free space, it further reduces the chances of overwriting deleted data quickly. A nearly full drive has less free sectors, increasing odds of overwrites.
File Size
Larger files take up more sectors on disk, decreasing the chances of getting entirely overwritten. Smaller files have a greater risk of getting overwritten after deletion.
File Fragmentation
As explained earlier, fragmentation scatters file contents across different sectors. This actually reduces the chance of overwriting. A highly fragmented file gets harder to recover, but less likely to get overwritten quickly.
How Operating Systems Handle Deletions
Now that we’ve looked at file recovery concepts, let’s see how Windows, MacOS, and Linux handle deletions under the hood:
Windows
- Uses NTFS or FAT file systems
- Maintains a Master File Table with file metadata
- Delete removes file entry from MFT but leaves data
- Supports Volume Shadow Copy for restore points
- Recycle Bin holds deleted files until manually emptied
On Windows, deleted files remain intact and recoverable both from the Recycle Bin or after emptying it. Recovery tools can scan the disk or shadow copies for deleted data.
MacOS
- Uses HFS+ or APFS file systems
- Maintains a Catalog File with file records
- Delete removes file records but leaves data
- Trash holds deleted files until manually emptied
- Time Machine keeps historical backups for recovery
On Mac computers, HFS+ and APFS behave similarly to NTFS in terms of file deletion. Deleted data remains on the drive and Time Machine snapshots provide restore points to recover older versions of files.
Linux
- Uses Ext4 and many other file systems
- Inode data structure tracks file metadata
- Delete clears inode entry but leaves data
- Trash holds deleted files until manually emptied
- Recovery relies on undelete utilities
On Linux, inodes perform the same role as the MFT and Catalog File. Otherwise, Linux handles deletion identically, keeping data intact on disk until overwritten.
Recovering Deleted Files
If you need to recover a deleted file, either from the Recycle Bin/Trash or after permanently deleting, here are some options:
Windows File Recovery
Windows 10 and 11 have a built-in utility called File Recovery that can restore deleted data. It scans the main file system, Volume Shadow Copies, and the Recycle Bin. To use it:
- Type “File Recovery” in the Start Menu search box
- Select the drive to scan for deleted files
- Browse the folder structure and tick files to recover
- Click “Recover” to restore files to another location
File Recovery may find your deleted files if they still exist and have not been overwritten.
Third-party Tools
If built-in recovery fails, commercial undelete tools often provide more advanced scanning of disks and volumes. Some popular options include:
- Disk Drill
- Recuva
- TestDisk
- EaseUS Data Recovery
These tools can find and restore files using techniques like file carving and searching Volume Shadow Copies. However, recovery is still not guaranteed if files were overwritten.
Data Recovery Services
For critical business or personal files, you may want to consult a data recovery specialist. Experts have specialized tools and cleanroom facilities to repair and restore even seriously corrupted media. However, costs for professional services often start around $300.
Preventing Data Loss
While you can attempt to recover deleted files, prevention is the best policy. Here are some tips to avoid data loss incidents:
- Have good backups – Regularly back up important files offline.
- Delete cautiously – Avoid Shift + Delete to skip the Recycle Bin.
- Use versioning – Microsoft OneDrive and Apple Time Machine can restore older copies.
- Enable shadow copies – System Restore provides recovery points.
- Manage drive space – Maintain sufficient free space for recovery.
- Act quickly after deletion – Recover files ASAP before they’re overwritten.
Following best practices for backup and deletion can reduce how often you need to resort to data recovery. But when accidents do happen, in many cases it’s possible to get your files back.
Conclusion
When you delete a file on your computer, the data itself remains on the storage device and can often be recovered. Operating systems remove file entries from their indexes but do not immediately erase contents. Until the space is overwritten, data recovery tools have a good chance of restoring your files. However, the likelihood drops over time as new data overwrites the deleted contents. Acting quickly, managing drive usage, and maintaining good backups are the best ways to keep your data safe in case you need to restore deleted files.