What to do in the first minutes after losing files

Why the drive has to go quiet

When a file is deleted, its clusters go back on the list of space the file system may hand out. The bytes are untouched at that moment. They stop being recoverable at the moment something else is given those clusters and writes into them — and after that the old bytes are not hiding underneath, they are simply gone.

So the clock that matters is not measured in hours. It is measured in writes. A card sitting in a drawer will still give the photos back next year. A system drive on a computer you keep using can lose them in minutes, because Windows writes to it constantly without being asked: search indexing, update downloads, browser cache, thumbnails, temporary files, restore points, the page file. None of that is under your control while the machine is running normally.

What to do, in order

Six steps. The first three are about not making things worse and matter more than the choice of software.

1. Stop using the drive that held the files. Eject and unplug a memory card, USB stick or external drive. If it was the computer's own drive, close what you were doing and stop saving anything. If the files matter more than the machine's uptime, shut the computer down and do the rest from another one.
2. Do not run repair tools on it. chkdsk /f, "Scan and fix drive", a partition repair utility — all of these write to the drive, and they write into exactly the structures a recovery scan reads. Repairing a file system is a different job from recovering files, and doing it first can turn a full recovery into a partial one.
3. Do not format it, and do not accept an offer to. Windows and cameras both offer this at the worst moment. Formatting is never a step towards getting files back.
4. Install the recovery software onto a different drive. The installer itself is a write. If the lost files were on C:, install to a spare USB stick, or use another computer and connect the drive to it.
5. Check whether the drive is physically failing before you scan. Clicking or beeping, taking a minute to appear, disappearing and coming back, getting hot — those are hardware symptoms, and a long scan is the worst thing to run on them. Copy a failing drive before you scan it explains what to do instead.
6. Scan the drive read-only, then save what you find to a different drive. A scan that only reads cannot make your situation worse, and it will tell you what is still there before you commit to anything. Recovered files must land somewhere else — writing them back onto the source drive lands them on the clusters that still hold the rest of your missing files.

Three reflexes that cost people their data

Running chkdsk because Windows suggested it

Windows offers to scan and fix a drive it finds inconsistent, and the offer arrives at precisely the moment your files are recoverable. chkdsk /f rewrites the file system's bookkeeping to make it self-consistent again. It is not trying to save your files; it is trying to save the file system, and it can do that by discarding references to them. Run recovery first. Repair afterwards, if you still want the drive.

Saving recovered files back onto the same drive

It feels tidy and it is the most destructive thing in this list, because it writes into free space — which is where all your other deleted files are. Good recovery software refuses to let you do it. In Unlost the destination picker will not accept the drive being recovered from, and that refusal is enforced in the recovery engine rather than in the interface, where the window cannot reach around it.

Copying the "surviving" files off first

Rescuing what you can still see, onto the same drive or onto a folder on it, is a natural instinct and it is still writing. Copy visible files off to another drive if you like — copying to the damaged drive is what does the harm.

If the files were on your computer's own drive

This is the awkward case, because the drive you must stop writing to is the one the computer runs from. In order of how much data it saves:

• Best: shut the machine down, take the drive out, and connect it to another computer as a second drive or in a USB enclosure. Nothing writes to it, and you can scan it at leisure.
• Good: keep using the machine but install the recovery tool on a USB stick and recover to an external drive. You accept some background writing in exchange for not opening the case.
• Also worth knowing: if the drive is an internal SSD, deleted files are often already unrecoverable no matter how fast you act. Why deleted files can be recovered — and when they can't explains why, and how to tell whether your case is one of them.

After the scan: what "recovered" actually means

A recovered file can be exactly the right size and still be full of somebody else's bytes, because the clusters were reused or a stretch of the disk would not read. That is why Unlost checks each file after writing it and reports one of three answers rather than two: intact, where the file's own checksums or structure agree — PNG and ZIP carry a CRC beside every chunk, JPEG, PDF and MP4 carry a structure that has to close; damaged, where they disagree, with a note saying where; and unchecked, where the format offers no way to tell. Bare MP3 and most camera raw formats fall in the third group, and calling them intact because nothing disagreed would be the most expensive lie a recovery tool could tell.

Open the important files yourself before you erase or reuse the source drive. Once you overwrite it, a second attempt is not possible.

Common questions in the first hour

How long do I have before the files are gone?

There is no time limit, only a write limit. Files on a drive that nothing writes to stay recoverable indefinitely. Files on a drive in daily use can be overwritten within minutes. This is why "stop using it" beats "hurry".

I only realised a week later. Is it too late?

Not necessarily, and it costs nothing to look. What matters is how much was written to that drive in the meantime. A camera card you have not shot with since is as good as it was a week ago; a system drive you have used daily has probably lost some of it. A read-only scan will show you which files survived rather than leaving you guessing.

Should I restart the computer?

A normal restart writes to the system drive, so it is not free — but it is a small, one-off cost. Shutting down and leaving the machine off is better than continuing to use it. Do not put it to sleep or hibernate if the lost files were on the system drive: hibernation writes a file the size of your memory onto it.

Will a System Restore point bring the files back?

No. System Restore covers Windows settings and system files, not your documents and photos. Running it also writes to the drive. If you have a backup or file history from before the loss, that is a better first stop than any recovery tool — recovery is for when the backup does not exist.

Is scanning the drive itself risky?

Not on healthy hardware. A scan that opens the drive for reading only cannot change anything on it, and one you abandon halfway leaves the drive exactly as it was. On hardware that is physically failing, the risk is different and real: every read costs the drive something, which is the case for imaging it first.