Skip to content

How to Recover Permanently Deleted Files in Windows 10 and 11

By Srinivasan Krishnappa · Ransomware & database recovery engineer · 656+ ransomware recoveries
7 min read
Need this solved now? We have already solved 656+ ransomware and data recovery cases. Call +91 74187 05822, WhatsApp us or email info [at] asittech.com. Free assessment; no data, no charge.

Windows calls a file permanently deleted when it has bypassed or left the Recycle Bin: Shift+Delete, an emptied bin, a file too large for the bin, or a delete on a USB drive or network share. In every one of these cases the file's contents are still on the drive at first. Windows removes the entry that pointed to the file and marks its space as available. Recovery works for as long as that space has not been reused.

Step 1: stop using the drive

Every file that is saved, downloaded or updated after the deletion can land on the space the lost file occupied. If the file was on the system drive (usually C:), stop working on that computer: do not install anything, do not browse, do not let large updates run. If the file was on a second drive, a USB drive or a memory card, simply stop writing to it.

On an SSD, time matters more than on a hard disk. Windows sends a TRIM command to an SSD after a deletion, and the drive may erase the freed blocks on its own soon afterwards. On a hard disk, deleted data stays until it is overwritten.

Step 2: check the places that cost nothing

Look in the Recycle Bin again, including the bin of any other user account. Right-click the folder that held the file, choose Properties, and look at Previous Versions: if File History or restore points were switched on, older copies of the folder are listed there. Check OneDrive, Google Drive or Dropbox, which keep deleted files in their own bin for a limited time. Check e-mail attachments, a backup, and other computers the file was copied to.

None of these checks writes to the drive, so they are always the first thing to try.

Step 3: scan the drive with recovery software, without installing onto it

If the easy places are empty, the file has to be found on the drive itself. Data recovery software reads what the file system still records about deleted files and lists them with their names and folders. The rule that matters is not to install or save anything onto the drive you are recovering from. Install the software on a different drive, or better, connect the affected drive to another computer as a second disk and scan it from there.

A quick scan of an NTFS drive takes minutes and usually finds recently deleted files with their original names. Good software also tells you, for every deleted file, whether its space has been reused. A file marked intact will open after recovery. A file marked overwritten will not, whatever tool is used, because its contents are no longer on the drive.

Step 4: run a deep scan if the quick scan does not find it

When the file-system record of a file is gone, the file can still be found by its content: photos, videos, Office documents, PDFs and archives each start with a recognisable signature. A deep scan reads the whole drive for these signatures. Files found this way usually have no name and no folder, so expect to sort through them by type, size and preview.

A deep scan is slow, roughly three hours per terabyte on a USB hard disk and much less on an internal SSD, and it is worth it only when the quick scan has not shown the file as recoverable.

Step 5: save recovered files to a different drive

Always save what you recover to another drive: an external disk, a second internal drive or a network share. Saving onto the same drive can overwrite the other files you are still trying to get back. Open a few of the recovered files before you rely on them, largest and most important first.

When software will not help

Recovery software cannot return data that has been overwritten, and it cannot scan a drive that Windows does not detect or that clicks, grinds or disconnects. A drive in that state has a physical fault, and every extra hour it runs can make things worse. It needs repair in a lab before any scan is possible.

On an SSD where TRIM has already run, the deleted blocks read back as empty and there is nothing left to find. That is a property of the drive, not a weakness of the software.

AS Data Recovery: free scan and preview →

Facing this problem? Contact us now.

We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.

  • ✓ Free assessment before you pay anything
  • ✓ No data, no charge
  • ✓ NDA on request

Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST

Request assessmentEmergency