Deleting a file or formatting a drive does not physically erase it: on a hard drive, the data stays on the platters, intact, as long as no new data has been written over it. Your chances of recovery are therefore often good after an accidental deletion or format, on one imperative condition: stop using the affected device immediately. Every minute the computer keeps running can overwrite what you are trying to save, because updates and other automatic processes write precisely into the "freed" space. On an SSD, where the TRIM mechanism erases deleted data quickly, you have to act even faster.

What follows explains why a deletion is not an erasure, where the real danger lies, and why the recovery software you are tempted to download can do more harm than good.

What really happens when you delete a file

On Windows, an ordinary deletion goes nowhere: it passes through the recycle bin. The file is removed from its place but kept in a kind of buffer zone from which it can still be retrieved. It is only by emptying the recycle bin that one believes it is erased for good.

Except that "for good" is misleading. When you empty the recycle bin, the system notes that the file no longer exists, but on the platters of a hard drive, the data remains physically present. Why? Because actually erasing the content would take a great deal of time: it would require writing over it, sector by sector, which would strain the drive enormously with every deletion. The system does not bother with this work; it simply crosses out a line in its register.

This register is called the allocation table, or index: the directory that tells the system which files exist and where their data is physically located on the drive. To understand it, picture a book. The allocation table is the table of contents. Each chapter corresponds to a file, and the table of contents indicates the page on which it begins, that is, where the data is located on the drive. When you delete a file, the system does not tear out the pages: it erases the corresponding line in the table of contents. The pages themselves are still there. You just need to know how to find them again.

This is the whole reason recovery is possible. As long as no one has written over it, the entire chapter waits, invisible but intact.

The real danger: overwriting

If the data stays there, what can go wrong? Overwriting.

Once the file is deleted, the system considers the space it occupied to be available. At the first opportunity, it will want to write new data there. If you have just deleted a large file and the system needs to save another one, or several small ones, that freshly "freed" space will even be given priority. The new data then settles exactly where the old data was and overwrites it for good.

The trap is that you do not need to do anything to trigger this process. A powered-on computer works constantly, without you. Windows or macOS download and install updates, which look for room wherever there is some, and therefore in the space that contains your deleted data. The antivirus writes its files. Automatic defragmentation reorganizes the drive. All these unintended and invisible processes compete for the free space and can overwrite, piece by piece, what you were hoping to recover.

Hence the absolute rule: as soon as an accidental deletion has occurred, stop using the operating system running on that drive. Save nothing, install nothing, and if possible power off the device. The same principle applies to a phone: to keep using it is to let the background processes work against you.

Hard drive or SSD: the nuance that changes everything

This good news, "the data stays there", has one major exception, and it depends on the type of device.

On an ordinary, mechanical hard drive, writing is relatively slow. No system amuses itself by spontaneously overwriting sectors that appear free: it would be counterproductive and needlessly slow. Your deleted data can therefore survive for a long time, as long as nothing comes to overwrite it.

On an SSD, it is a different story. TRIM is a command that lets the SSD actually erase the blocks marked as free, in order to maintain its write performance. In concrete terms, after a deletion, the SSD may physically purge your data within minutes, on its own initiative. The recovery window is therefore far shorter, and stopping use of the device must be even quicker. This is one of the major differences between recovering a hard drive and recovering an SSD.

Formatting, repartitioning: quick or full, everything hinges on this

Deleting a file or a folder means erasing its entries one by one in the index. A format proceeds differently: instead of removing the lines of the table of contents one at a time, it resets the entire allocation table at once. The table becomes tiny, like a blank table of contents.

But the old content itself is still there, and often the old allocation table as well, recoverable because it was larger. This is what makes it possible, after a simple format, to fully reconstruct the file structure. The same principle applies to repartitioning: the organization is rewritten, but the underlying data remains.

It is still necessary to distinguish two types of format, because they are in no way comparable:

	Quick format	Full format
What it does	Recreates only the table of contents (the allocation table)	Recreates the table, then resets every sector to zero
The data	Still physically present	Actually erased, sector by sector
Duration	Almost instantaneous	Several hours on a drive of several TB
Recovery	Often possible	Severely compromised

In other words, a quick format erases almost nothing of your data, whereas a full format overwrites it methodically. If you have the choice when formatting and you are in doubt, a quick format always leaves a way out.

Recovery software: when it saves, when it destroys

Faced with a deletion, the reflex is to look for recovery software. There is a great deal of it, of highly variable reliability and principles. Some of it is good. But almost all of it shares the same design flaw: it does not freeze the state of the drive before working. It does not begin by making a bit-for-bit copy in order to operate on the copy; it works directly on your device.

Here is the scenario we see arriving at the lab, again and again. A customer deletes important data, then downloads recovery software. First mistake: they install it on the very drive they want to save. Yet installing a program means writing files into the free space, that is, precisely where the deleted data lies dormant. The first software does not convince them? They try a second, then a third, each installing in the same place and overwriting the data a little more. Meanwhile, Windows launches an update in the background, which also writes into that space.

Then comes the second mistake, more fatal still. A piece of software eventually finds files; relieved, the customer restores them onto that same drive. The program then reads the data and rewrites it wherever there is room: into the free space, and thus over the data it is in the process of saving. It destroys what it has just found. The most frequent result: the permanent loss of what could have been recovered.

This does not mean that this software is bad. It can be helpful. Everything is in the method: has the device been frozen? Was a backup copy made beforehand? Is the restore done to a drive other than the one to recover? It is the handling that matters, not the tool. A wood chisel is sold to everyone; it does not make everyone a sculptor.

What a lab does in your place

Our approach begins where that of consumer software fails: with the protection of the device. The first step is a bit-for-bit copy of the drive, made in read-only mode; the device is physically write-blocked by our tools (a hardware write blocker), so that no system can write anything to it. We thus obtain a perfect copy of every sector, and we then work only on that copy. Your original data no longer moves.

On this copy, we run multiple scans to reconstruct the directory tree from the erased indexes: to find the table of contents again, in short, so as to give each file back its name and its folder. When the indexes are too damaged for this, we work directly on the files themselves, through a technique called carving: the recovery of files from their binary signature, without going through the index. We search the raw data for the characteristic bytes with which each file type begins, a JPG, a PDF, and so on. This method recovers files that no longer have any index, at the cost of one limitation: the original name and the location in the directory tree are lost.

We often go further. For photos recovered without a name, we exploit the EXIF data embedded in each image to give them understandable names again, with date and shooting information. And for rarer formats, such as DICOM used for medical imaging, we have on occasion developed our own detection software in order to extract those files that standard tools ignore.

Frequently asked questions

Is a deleted file really erased?

No. On a hard drive, deleting a file (even by emptying the recycle bin) only removes its entry in the index: the data remains physically present on the platters as long as no new data has been written over it. This is what makes recovery possible.

What should you do immediately after deleting or formatting by mistake?

Stop using the device on the spot: save nothing, install nothing, and if possible power off the device. Every write, including the updates and antivirus running in the background, can overwrite the data to be recovered. Do not install recovery software on the affected drive.

Can data be recovered after a format?

Often, yes, especially after a quick format, which only recreates the allocation table while leaving the data and the old table in place. A full format, which resets every sector to zero, on the other hand makes recovery severely compromised. Repartitioning follows the same principle as a quick format.

Can a deleted file be recovered on an SSD?

It is much more uncertain than on a hard drive. The SSD's TRIM mechanism actually erases the blocks marked free, often within minutes. You must therefore stop using the SSD immediately; after a short delay, the deleted data may be permanently lost.

Is data recovery software reliable?

It can help, but its common flaw is to work directly on the drive to be recovered without freezing it. Installing the software, scanning, then restoring the files onto the same drive writes into the free space where the data to be saved is precisely located, and destroys it. If you use one, install it and restore to another drive.

What is carving in data recovery?

Carving is a technique that recovers files from their binary signature, without the index. In the raw data, the bytes that mark the start of a JPG, a PDF, etc., are identified. It makes it possible to save files whose index is destroyed, but causes the original name and the location in the folders to be lost.