Can you really recover deleted files from a storage drive? Well…

What happens when you delete a file?

Think of your storage drive as a public library, with each individual file being a book stored on a shelf somewhere. Your operating system (e.g., Windows) knows where each book is because it keeps an index of everything. Want to access a certain file? The OS has a pointer to that file’s location on the storage drive, which it then retrieves.

When you delete a file, you aren’t destroying the book; instead, the OS simply loses its pointer to that book. As far as the OS is concerned, it no longer knows about the book or where it is—but the actual book is still there, sitting on the shelf, until it’s dealt with. Technically, even if the OS doesn’t know about it, you could potentially scour the entire library and find such “lost” books… and then “recover” them.

In other words, when you delete a file on your PC, your OS is marking the underlying sectors on the storage drive as reusable. To truly delete the data on the drive, you have to use a secure erase or file shredder tool to overwrite the physical data—and until that happens, the data sitting on the drive could be marked as “deleted” but still recoverable.

Ease of data recovery by storage type

Let’s talk storage types. Here’s what you actually need to know about data recovery on different types of drives:

• Hard disk drives: Traditional HDDs with spinning magnetic platters make data recovery easy. Unless you go out of your way to muck things up, and as long as the data hasn’t been overwritten, it’s trivial to recover deleted files on mechanical HDDs.
• Solid-state drives: Modern solid-state drives support TRIM, a feature that immediately cleans up data upon deletion. TRIM is often enabled by default, but it can be turned off. With TRIM enabled, a deleted file is physically gone almost instantaneously, which means data recovery is extremely difficult if not impossible.
• USB drives, SD cards, and microSD cards: Here’s a big wildcard many people haven’t thought about. Modern USB flash drives and SD/microSD cards don’t support the TRIM command. So, although they’re technically solid-state storage like your internal SSD, any data that’s deleted from a USB drive or SD/microSD card is still often recoverable. Note that some external SSDs may support TRIM—it depends on the SSD and the hardware.

It’s also worth noting that encrypted drives are a big solution here. If a drive is encrypted with something like BitLocker—either the full BitLocker experience in Windows Pro or the more basic BitLocker experience in Windows Home—then files won’t be recoverable without the encryption key. Even if the data is still present on disk, it’ll just be a bunch of random noise that’s only decipherable with the encryption key.

This is a big reason why encryption is so useful. It doesn’t just protect the files you have—it protects the files you’ve deleted, too.

How to recover data from a drive

If you have a storage drive that you want to recover files from, step one is to immediately stop using that drive. Every time you write new data to the drive, there’s a chance that the new data will overwrite—either partially or fully—the data you’re trying to retrieve.

Chris Hoffman / Foundry

Step two is to run a file recovery tool to scan the drive for bits of deleted files. The classic Recuva app works well and it’s simple. Microsoft also has its own Windows File Recovery tool now, but it’s a command-line tool. (See Microsoft’s official guide to using it.) These are just a few off the top of my head. There are many other file recovery tools out there.

If the data is mission-critical (e.g., you deleted the CEO’s one and only copy of a crucial business plan, or it’s a collection of irreplaceable personal photos with sentimental value), you might want to seriously consider using a professional data forensics service instead.

How to prevent data from being recovered

If you want to stop people from recovering your files, the best method is encryption. Full stop. People won’t be able to recover deleted (or undeleted) files without your encryption key.

If you’re saving data to a traditional magnetic hard drive, USB flash drive, or SD/microSD card and that data is unencrypted—which, let’s be honest, is almost always the case when we use flash drives and SD/microSD cards—then you may want to use a secure wipe tool that actually deletes deleted files. Tools like Eraser and BleachBit are great for overwriting individual files on storage.

Chris Hoffman / Foundry

Better yet, use a tool that writes zeroes or random bits to the entire USB flash drive or SD/microSD card to obliterate everything stored on it. This ensures nothing is recoverable. (Yes, flash storage only has so many “write cycles” before it wears out, but you shouldn’t be doing this all the time. Only when you have critical files that need to be obliterated.) Eraser and Disk Wipe can both wipe drives in this way.

In other words, if you handed your accountant some tax documents on a flash drive and now want to ensure that data is unrecoverable, then that’s the perfect time to wipe the drive by overwriting it.

There’s also the simple, physical solution: just destroy the drive. Indeed, when the military has the proverbial nuclear launch codes—or some other critical data—on a drive, they toss it into an incinerator. If you had truly sensitive information on a $5 USB drive, you might feel more secure physically destroying it than digitally wiping it.

Don’t forget backups and the cloud

It’s not just about the storage hardware you use, by the way. A modern Windows computer isn’t just leaving your files in a particular folder on one local storage device. It’s often backing up your data and storing it elsewhere, like on the cloud (depending on how you have OneDrive configured on your PC). On Windows, OneDrive syncs your Desktop, Documents, Pictures, Music, and Videos folders by default.

This is also true with other devices, like your Android phone with Google Photos or your iPhone with iCloud. You thought you deleted that file, but a copy of it may be lurking somewhere else—and someone may be able to dig it out of a backup or find it in your cloud storage service’s trash section (often for up to 30 days after deletion).

So, if you’re ensuring certain files aren’t recoverable from physical storage media, be sure to think about other storage locations, too.

Be mindful with your files and data

The takeaway here is that a deleted file isn’t always necessarily gone. The OS might have marked it as deleted, but the file could still be residing on the storage drive—unless the storage drive has something like TRIM and actually wipes its memory when a file is deleted.

Meanwhile, a file could be deleted from one location (e.g., your PC’s internal SSD) but still exist somewhere else as a backup (e.g., on OneDrive or Google Photos). On the other hand, if a file is encrypted, it doesn’t really matter if it’s recoverable or not—it won’t be readable without the right encryption key anyway.

All you can do is try your best to understand how all of this works and stay vigilant when it comes to your data, whether that means protecting it with encryption, storing it in safe places in safe ways, making sure you have backups for when you need them, and more.