If you've just deleted a file you need, the most important thing to do is stop using the drive that contained it — right now, before reading the rest of this guide if necessary. Every file you write, every application you open, every automatic process running on that drive reduces your chance of recovery. Here's why, and then the specific steps to get the file back.
How File Deletion Actually Works
When you delete a file (including from the Recycle Bin), the operating system doesn't immediately erase the file's data from the drive. It removes the file's entry from the filesystem directory — the index that tells the OS where files are stored — and marks that storage space as available for reuse. The actual file data remains on the drive until something else is written on top of it.
This is why immediate action matters: the longer you use a drive after deleting a file, the more likely the operating system is to write new data over the space the deleted file occupied. Once overwritten, the original data is unrecoverable by any software tool.
The situation is different for SSDs. Unlike traditional hard drives, SSDs use a process called TRIM that proactively erases blocks of data that are marked as free. On most modern SSDs with TRIM enabled, recovery of recently deleted files is often impossible within minutes of deletion — the drive has already cleared the space. If the file was on an HDD (mechanical hard drive) or a USB flash drive without TRIM, the recovery window is much longer.
Step 1: Check These Places First
Before running recovery software, check whether the file already exists in a recoverable location:
- Recycle Bin (Windows) or Trash (macOS): Open it and look. Files deleted with the Delete key go here first and can be restored with right-click → Restore.
- Previous Versions (Windows): Right-click the folder where the file was located, select Properties, and click the Previous Versions tab. If Windows File History or System Restore was enabled, earlier versions of the folder (including the deleted file) may be listed. Click Restore to recover.
- Time Machine (macOS): If Time Machine was running, open the folder where the file was, then click the Time Machine icon in the menu bar and select "Enter Time Machine." Navigate back to before the deletion and click Restore.
- Cloud sync: If the folder was synced with OneDrive, Google Drive, or Dropbox, check the trash in the cloud service's web interface — deleted files from synced folders often appear there. OneDrive keeps deleted files for 30 days; Google Drive for 30 days; Dropbox for 30 days (free) or 180 days (paid).
Recuva — Best Free Recovery Tool for Windows
Recuva (recuva.com) by Piriform (the company behind CCleaner) is the most widely tested free file recovery tool for Windows. It scans a drive for deleted file signatures and presents a list of recoverable files with a recoverability rating (Excellent, Poor, Unrecoverable) based on how intact the file's data appears.
Critical: do not install Recuva on the same drive you're trying to recover from. If your files were on your C: drive and you install Recuva to C:, you risk overwriting the data you're trying to recover. Instead:
- Download Recuva from another computer and copy it to a USB drive
- Run the portable version directly from the USB drive
- When recovering files, save them to a different drive than the one you're scanning
In the Recuva wizard, choose the type of file you're looking for (all files, documents, photos, music, video), specify the location if you know it, and enable Deep Scan for better results. Deep Scan takes longer but finds more files, especially when the directory entry has been partially overwritten.
PhotoRec — Best for Images and Documents Across All Platforms
PhotoRec (cgsecurity.org/wiki/PhotoRec) is a free, open-source recovery tool that works on Windows, macOS, and Linux. Despite the name, it recovers far more than photos — it handles over 480 file formats including documents, videos, archives, and databases.
PhotoRec works differently from Recuva: it ignores the filesystem entirely and scans raw drive sectors looking for file signatures (the specific byte patterns that identify each file format). This approach recovers files even when the filesystem index is completely destroyed — on formatted drives, drives with filesystem corruption, or drives where Recuva found nothing.
The trade-off is that PhotoRec cannot recover file names — it reconstructs files from their content and saves them with generic names (f0000001.jpg, f0000002.pdf, etc.). For recovering a large number of photos or documents where the content matters more than the name, this is acceptable. For finding one specific file with a specific name, it's less useful.
PhotoRec comes bundled with TestDisk. Run the executable, select the drive, select your partition, choose where to save recovered files (on a different drive), and let it run. Recovery of a full hard drive can take several hours.
macOS Built-In: Time Machine and Versioning
On macOS, the best recovery path is Time Machine if you have it configured. Connect the Time Machine backup drive, navigate to the folder where the file was stored, and use Time Machine to browse back to a point before the deletion.
If Time Machine wasn't running, macOS stores local snapshots on APFS-formatted drives. Open Terminal and run:
tmutil listlocalsnapshots /This lists any available local Time Machine snapshots. If any exist from before the deletion, you may be able to mount them and browse for the file. The process varies by macOS version and APFS configuration.
For Formatted or Damaged Drives
If a drive has been accidentally formatted, or if it's showing as RAW in Windows Disk Management, the filesystem structure has been overwritten but most file data may still be intact. In this situation, PhotoRec is the most effective free tool — it bypasses the filesystem and reads raw sectors directly.
TestDisk (bundled with PhotoRec) can sometimes repair a damaged or lost partition table, restoring access to the filesystem without needing to recover individual files. Run TestDisk, select the drive, analyze, and look for detected partitions. If it finds the original partition structure, writing it back can make the drive readable again in Explorer or Finder.
Realistic Expectations
Software recovery works best when: the drive is a mechanical HDD, the deletion was recent, and little has been written to the drive since. It works less well when: the drive is an SSD with TRIM enabled, significant time has passed, or the drive has been written to heavily since deletion.
If the file is genuinely critical and software recovery fails, professional data recovery services (like DriveSavers or Ontrack) use hardware-level recovery in clean-room environments. These services are expensive ($300–$1,500+ depending on the drive and damage) but can recover from physically damaged drives that no software can read. Treat software recovery as the first step, not the last resort — the free tools above recover most accidentally deleted files when used promptly.