How to Recover Deleted Files Safely

To recover deleted files safely, stop using the affected drive, then check Recycle Bin, cloud recycle bins, and existing backups before you scan anything. If no copy exists and the storage device is stable, use a recovery tool that reads the source and saves recovered files to a different physical drive. Stop DIY recovery if the device clicks, disappears, reports the wrong capacity, overheats, or contains irreplaceable data you cannot risk.

This order matters more than the software brand. A backup restores a known copy without searching unallocated space. A scan is only a reasonable next step for a stable logical-deletion case, and even then it cannot promise that deleted content has survived overwrite, SSD deallocation, encryption, or file-system changes.

Do this immediately

Stop normal use of the source. Do not download, edit, install, update, or save files on the affected volume.
Do not empty Recycle Bin or Trash. If the file may be there, inspect it before running cleanup tools.
Do not format, initialize, optimize, defragment, or run CHKDSK. These actions are not undelete steps and may change the only copy of the storage state. Read Should You Run CHKDSK Before Data Recovery? before attempting a repair.
Do not recover to the source. Prepare another physical drive with enough free space for recovered files.
Stop for unstable hardware. New noises, repeated disconnects, extreme slowness, incorrect capacity, heat, liquid damage, or a recent drop move the case out of ordinary software recovery.

If the deleted files were on the Windows system SSD, shutting the computer down is safer than leaving it running while you research and install tools. Normal background activity can write to the same drive.

Choose the path that matches the file’s current state

What you see	Safest next step	Do not do
The file is still in Recycle Bin or Trash	Restore it from there	Do not install recovery software
The file came from OneDrive or another sync service	Check the service’s web recycle bin and version history	Do not assume the local Recycle Bin is the only copy
File History or Time Machine was already backing up that location	Restore a previous copy, preferably to another location first	Do not overwrite a newer version you still need
A stable HDD, USB drive, or memory card has no backup	Make one controlled recovery attempt and save results elsewhere	Do not format, repair, or recover back to the source
A Windows SSD contains the deleted file	Check backups first; treat scanning as uncertain because TRIM may have deallocated the content	Do not disable TRIM after the event or keep using the PC
The device is unstable or physically damaged	Power it down and compare professional recovery options	Do not run long scans or repeatedly reconnect it

The rest of this guide follows that sequence.

Step 1: Confirm where the file was stored

Before choosing a recovery method, identify the original location as precisely as possible:

A local Windows folder on C: or another internal volume.
A synced folder such as OneDrive Desktop or Documents.
An external HDD, SSD, USB flash drive, SD card, or camera card.
A Mac folder protected by Time Machine.
An application library, shared workspace, email attachment, or exported copy.

Also note what happened: ordinary Delete, Shift+Delete, emptying Recycle Bin, an application cleanup, formatting, a sync conflict, or a device failure. These are not interchangeable. If the drive was formatted, use the dedicated formatted USB recovery guide. For camera media, start with the SD card photo recovery guide.

Step 2: Restore from Recycle Bin or Trash

On Windows, open Recycle Bin, search or sort by deletion date, select the file, and choose Restore. Windows normally returns it to its original location. If that location no longer exists or you are unsure where the file went, record the original path before restoring.

On a Mac, open Trash, select the item, and choose Put Back. Files removed from some apps or cloud services may instead be in an app-specific Recently Deleted area or online recycle bin.

If the item is present, stop here. An undelete scan adds no benefit.

Step 3: Check OneDrive and existing backups

OneDrive

If the file was synced, sign in to OneDrive on the web and inspect its recycle bin. An online-only file may be recoverable there even when it is absent from the Windows Recycle Bin.

Microsoft currently says deleted items in a personal OneDrive recycle bin are normally retained for 30 days. Work or school accounts normally use 93 days, although an administrator can change that setting. A retention rule is not proof that your file is still present, so check the account immediately rather than waiting.

File History on Windows

File History can help only if it was already enabled and backing up the folder before the deletion. Navigate to the folder that contained the file, open its previous versions, and inspect the available dates. If you need to preserve the current contents, restore the older version to another location instead of replacing the current folder blindly.

File History is not the same as System Restore. Do not treat a restore point as a dependable backup of personal documents.

Other copies

Check shared folders, email attachments, messaging downloads, application autosaves, exported archives, another computer, and recipients who may have received the file. A verified alternate copy is safer than attempting to reconstruct deleted blocks.

Step 4: Decide whether the storage is safe to scan

A DIY scan is appropriate only when all of the following are true:

The device identifies consistently with the expected capacity.
It does not click, grind, buzz, overheat, disconnect, or freeze the computer.
The loss followed a logical event such as deletion rather than impact, liquid, or electrical damage.
You have a different physical drive for the software, scan output, and recovered files.
You accept that a scan can fail or return incomplete files.

If any of these conditions are false, use Data Recovery Software vs. Professional Service before continuing. Software can interpret readable storage; it cannot repair mechanical, electrical, controller, or media damage.

Step 5: Recover deleted files on Windows when no backup exists

Microsoft’s Windows File Recovery is a command-line option for Windows 11 and Windows 10. It works with local storage such as internal drives, external drives, and USB devices; it does not recover from cloud storage or network shares.

The tool requires the source and destination to be different drives. Microsoft documents Regular mode for recently deleted files on NTFS and Extensive mode for older deletions, formatted or corrupted NTFS volumes, and FAT or exFAT. Read the current Windows File Recovery instructions before entering a command, because the correct drive letters, mode, path, and filters depend on your case.

If a command-line tool is not suitable, a third-party recovery application may provide a guided scan and file previews. Use the same safety rules regardless of product:

Install or run the tool from a drive other than the source whenever possible.
Confirm that you selected the correct source volume.
Start with the least intensive scan that fits the deletion event.
Preview several important files instead of trusting filenames or a recoverability label.
Recover a small sample to a separate physical drive and open it with the normal application.
Pay only if the preview and sample support your specific files and the product terms make sense for you.

Our free data recovery software comparison can help you compare workflows, but no tool can guarantee access to overwritten or deallocated content.

What changes on an SSD

Deleted-file recovery from a modern SSD is more uncertain than the familiar “the file remains until overwritten” explanation suggests. Windows can send a delete notification—commonly called TRIM or unmap—to supported storage. Microsoft says NTFS delete notifications are enabled by default unless an administrator disables them. Once the SSD controller processes deallocation, normal software may no longer receive the old content even if a filename or folder record remains.

Do not disable TRIM after deletion in the hope of reversing the event. A setting change cannot prove or undo commands that were already sent. Do not run Optimize Drives on the affected SSD.

For the full explanation, see Can Deleted Files Be Recovered From an SSD With TRIM?. The practical rule is simple: stop using the SSD, check alternate copies first, and do not mistake a promising file list for intact content.

What changes on USB drives and memory cards

FAT and exFAT are common on removable media, and Microsoft directs Windows File Recovery users toward Extensive mode for those file systems. That is an operating-mode rule, not a recovery promise.

Before scanning, confirm that the device remains connected, reports the expected capacity, and can be read without repeated errors. Cancel prompts to format or initialize it. If it disconnects, becomes extremely slow, or shows the wrong capacity, stop. If it is stable, recover to an internal or external drive other than the source removable device.

How to recover deleted files on a Mac

Start with Trash, iCloud or app-specific Recently Deleted areas, and Time Machine. Apple supports browsing Time Machine backups and restoring deleted items or older versions when the affected location had already been backed up.

If no backup exists, apply the same source-and-destination separation used on Windows. Avoid installing tools or saving results to the affected volume. Internal Mac SSD deletion can also involve flash deallocation and encryption, so a scan result is not a guarantee that file content remains available.

Limits no recovery tool can remove

Overwrite: New data can reuse space that held part or all of a deleted file.
SSD deallocation: TRIM or related commands can make old logical blocks unavailable to ordinary reads.
Encryption: Recovery may still require the original device, account, key, controller, or intact metadata.
Partial files: A scan may recover a name, thumbnail, or fragment without a usable complete document, photo, archive, or video.
Physical failure: Software cannot repair damaged heads, unreadable flash, failed electronics, or an unstable controller.

Validate recovered copies before changing the source. Open documents, extract archives, inspect photos at full resolution, and seek through entire videos. Keep the original unused until the important results exist in at least two verified locations.

When to choose a professional evaluation

Stop DIY work when the device was dropped, exposed to liquid, makes a new noise, repeatedly disconnects, reports an unexpected capacity, becomes abnormally hot, or contains the only copy of high-value data. A specialist may have better options for hardware, firmware, imaging, RAID, or forensic cases—but cannot guarantee overwritten or deallocated files.

Ask whether the provider works on the exact device type, how it protects the original, what can be evaluated before payment, and what happens to your data and device if recovery is unsuccessful.

Frequently asked questions

Can I recover files after emptying Recycle Bin?

Possibly, but not from Recycle Bin itself. Stop using the affected volume, check OneDrive and backups, then consider Windows File Recovery or a preview-first scan on stable storage. Overwrite and SSD deallocation may already limit the result.

Is Shift+Delete different from normal Delete?

Shift+Delete normally bypasses Recycle Bin, so the first local restore step is unavailable. Cloud recycle bins, File History, other backups, and a controlled scan may still be relevant depending on where the file was stored.

Should I install recovery software on the same PC?

Avoid installing it on the affected volume. If the deleted file was on the system drive, installation, browser downloads, updates, caches, and normal Windows activity can write to that same drive. Prepare the recovery from another computer or another drive when practical.

Can Windows File Recovery restore to the same drive?

No. Microsoft requires a different source and destination drive. This separation also prevents recovered output from overwriting other deleted data on the source.

Can deleted files be recovered from an SSD?

Sometimes, but there is no universal window or guarantee. The outcome depends on whether deallocation reached the controller, subsequent activity, encryption, the storage path, and whether another copy exists. Check backups first and stop using the SSD.

Why does a recovered file not open?

The scan may have found metadata or only part of the content. It may also have recovered an overwritten, deallocated, encrypted, or fragmented file. Test previews and small recovered samples; do not pay solely because familiar filenames appear.

Should I try several recovery programs?

Not automatically. Different tools may parse storage differently, but repeated installs and long scans do not recreate unavailable bytes. On a stable device, make one controlled, preview-first attempt. On an unstable device, stop and preserve it for evaluation.

Primary sources

Microsoft: Windows File Recovery — supported storage, source/destination separation, modes, and overwrite warning.
Microsoft: Backup and restore with File History — restoring previous versions from an existing File History backup.
Microsoft: Restore deleted files or folders in OneDrive — OneDrive recycle bin behavior and current retention limits.
Microsoft: fsutil behavior — Windows delete notifications and default NTFS behavior.
Apple: Recover files from a Time Machine backup — restoring deleted items and previous versions from an existing backup.

The safest recovery is usually the copy you already have. Start with Recycle Bin, cloud storage, and backups; scan only stable media; keep the source and destination separate; and stop when the device shows physical or unstable behavior.