Why deleted files can be recovered — and when they can't

What deleting actually changes

A file system keeps two separate things: an index that maps names to places, and the data itself. On NTFS the index is the Master File Table; on FAT32 and exFAT it is the directory entries plus the allocation table. Deleting touches the index and a bitmap of free space. It does not touch the data.

• The name entry is marked unused. On FAT the first character of the name is replaced with a delete marker — which is why recovered FAT file names sometimes come back with a missing first letter, and why an honest tool shows a placeholder there rather than guessing what the letter was.
• The clusters go back on the free list. They are now available to the next file that needs space. Nothing is written into them at that moment.
• The bytes stay put. A photograph of 24 MB is still 24 MB of photograph sitting in the same place on the disk, with nothing pointing at it.

So any cluster on your drive is in one of three states: holding a live file, holding a deleted file that nothing has claimed yet, or overwritten by something new. The first is not lost, the second is recoverable, the third is gone. The map on the front page is that distinction drawn cell by cell across a real card.

What a recovery tool reads to find them

There are three sources of truth on a damaged volume, and good recovery uses all three, because each one covers what the others lose.

1. The file table, read directly

The deleted entries are still in the table. Each one names the file, its size, and the runs of clusters it occupied. The valuable part is not the name — it is the run list, because that is what says where a fragmented file's pieces are. A tool that reads the table gives files back with their names, their folders and their fragments in the right order.

2. The journals, which remember what the table used to say

This is the part most recovery tools skip. NTFS keeps two journals, and they answer a question the current table cannot:

• $UsnJrnl, the change journal, is a flat list of events: for each one, the file's record number, its name, the folder it was in, and when it happened. A file whose table record has since been handed to a different file still has a name here — and a delete carries the wall-clock time it happened.
• $LogFile, the transaction log, holds what NTFS was about to write and what it would have to put back to undo the write. The undo side of "free this record" is the whole record, run list included. Which means a file whose record has already been reused can sometimes be recovered in full, not merely named.

Unlost reads both, and the ext journal (jbd2) for Linux volumes. When the journals record that another file was later given a deleted file's clusters, it says so with a name and a date instead of leaving you to find out when the photo opens grey.

3. The contents themselves, when there is no table left

After a format, or on a card whose directory area is unreadable, there is nothing to walk. What is left is to read the whole volume in one pass and recognise files by the bytes they begin with — JPEG, PNG, MP4, PDF, camera raw formats each have a distinctive header. This is called carving, and it has two honest limits: the names are gone for good, so files come back as numbered files with the right extension; and a carver only recovers a file while the file is contiguous on the disk, because a header and the bytes after it are all it can see. A fragmented file needs a run list, and a run list only exists in the table or a journal.

When the data really is unrecoverable

Every one of these is a case where no software — not this one, not a more expensive one — can bring the file back.

The clusters were overwritten

New data landed in the same place. The old bytes are not underneath the new ones; a drive stores one value per location. The much-repeated idea that overwritten data can be read back with laboratory equipment comes from research on drive densities of the 1990s and does not carry over to any modern disk. A single overwrite is enough, and no data recovery service can undo it.

Most deletions on an internal SSD

This is the case people are most often misled about, so here is the whole of it. Flash memory cannot overwrite a block in place; it has to be erased first. To keep writes fast, Windows tells an SSD which blocks a deleted file freed — the TRIM command — and the drive's controller erases them in the background, typically within seconds to minutes. After that the drive returns zeros for those addresses no matter who asks, including software reading the disk sector by sector. There is nothing left to find.

What this means in practice:

• Internal SATA and NVMe SSDs: TRIM is on by default in Windows and deleted files are usually unrecoverable within minutes. Acting fast rarely helps, because the erase is not triggered by you using the computer — it happens on its own.
• USB sticks and SD/microSD cards: these do not receive TRIM in normal use, which is exactly why cards recover so well. A card is the best case in file recovery, not the worst.
• External SSDs over USB: it depends on the enclosure and its bridge chip; some pass TRIM through, some do not. There is no way to know from the outside — a scan will tell you, since a TRIMmed area reads back as zeros.
• A lost partition on an SSD is a different question. TRIM applies to blocks the file system frees, so files that were never deleted — the ones on a partition that vanished from the table — may still be entirely intact.

A read-only scan is still the fastest way to find out which of these you are in, and it costs nothing. But if the answer is "nothing was found on an internal SSD", that is the true answer rather than a limitation of the software.

A full format, as opposed to a quick one

The quick format — the default, and the one your camera does — writes a new empty index and leaves the data alone. A full format on Windows 10 and 11 writes zeros across the entire volume. Files that went through a full format are gone. Recovering files after a quick format covers the difference in detail.

An encrypted volume you cannot unlock

A BitLocker volume without its password or recovery key is noise, and no amount of scanning changes that. What good software can do is recognise the encryption and say so — including the identifier of the recovery key, which turns "somewhere in my Microsoft account there are nine keys" into "this one". Unlost reads the unencrypted metadata BitLocker keeps at the front of the volume and reports that instead of grinding for an hour and calling the drive unreadable.

Hardware that has failed

Clicking, seizing, disappearing mid-scan: at that point the problem is not the file system and software is the wrong tool. Copy a failing drive before you scan it — and if it will not read at all, a lab with a clean room is the only remaining option.

Why some files come back damaged

Recovery is not all-or-nothing per file. A file occupies many clusters, and some of them can be overwritten while others are untouched. If seven of ten clusters survive, the file comes back at seven-tenths of itself: a photo that opens with the bottom missing, a video that plays and then stops, a document that may or may not open at all.

That number can be known before you recover anything, because it is arithmetic on the run list against the map of what is in use now. What cannot be known in advance is whether the surviving bytes are really the file's — which is why a recovered file is worth checking after it is written. Formats that carry checksums (PNG, ZIP, and the many formats built on ZIP such as DOCX and XLSX) can answer definitively. Formats with a structure that has to close (JPEG, GIF, PDF, MP4) give a weaker answer. Bare MP3 and most camera raw files can give no answer at all, and the only honest thing to report for those is that nothing could be checked.

Questions people ask about deleted data

Does emptying the Recycle Bin erase the files?

No. It deletes the index entries for the files that were sitting in the bin's folder. The contents stay on the drive until overwritten, which is why recovery after an emptied Recycle Bin is one of the most successful cases there is.

Can data be recovered after it has been overwritten once?

No. Not by software, and not by a recovery lab. Anyone claiming to read layers underneath overwritten data on a modern drive is describing something that does not exist.

Does TRIM affect my SD card or USB stick?

In normal use, no. Cards and USB sticks connected as removable drives do not receive TRIM from Windows, so deleted files stay on them until something is written over them. This is the reason a camera card that was formatted by accident usually comes back nearly whole.

Is there anything that makes deleted files permanently unrecoverable on purpose?

Yes, and it is worth knowing for the opposite reason. Overwriting the free space, a full format, or a drive's own secure-erase command all destroy deleted data for good. If you are selling or giving away a disk, that is what you want; if you have just lost files, it is what you must avoid.

Does the file name always come back?

It depends on where the tool found the file. From a file table or a journal, usually yes, along with the folder it was in. From carving after a format, no — the name lives in the index, and the index is what the format replaced. Files then come back numbered, sorted by type, which is workable for photos and painful for documents.