Files, emails, database records and whole volumes get deleted every day: by accident, by a failed update, by a departing employee or by an attacker. Whether they can come back depends far more on the first few actions than on the tools used later. These ten steps give deleted data the best chance, and keep the recovery safe and defensible.
Nobody can promise recovery. What you can do is avoid making it harder, and find out quickly what is realistically possible.
The ten steps
- Stop using the affected system. Deleted data usually stays on a disk until something else is written over it. Every minute of normal use, including background updates, log files and browser caches, risks overwriting it. If it is a laptop or a single drive, shut it down rather than carrying on.
- Do not “repair” it. Disk-repair utilities, reformatting, reinstalling or factory resets can destroy the very structures that recovery depends on. Do not install recovery software onto the drive you are trying to recover from, because installing it writes to that drive.
- Write down what happened. Record what was deleted, when, by whom or by what, which system and location, and what has happened to it since. Good notes narrow the search and show later that you acted carefully.
- Preserve the original. For anything important, make a complete, bit-for-bit copy (a forensic image) and work only on the copy, ideally through a write blocker so nothing is changed on the source. If recovery fails, you still have the untouched original to try again with.
- Check the easy sources first. Look in the recycle bin or trash, file version history, backups, snapshots, mailbox and cloud “recoverable items” folders, and database point-in-time recovery or transaction logs. Many of these have short retention windows, so check them in the first hours, not weeks later.
- Understand what your storage means for the odds. Hard disks often keep deleted data until it is overwritten. Solid-state drives and modern operating systems may erase freed space quickly (TRIM), so chances can be much lower. Encrypted volumes need the keys or passwords to be recovered at all. Cloud services recover only what the provider still holds.
- Treat physical failure as a specialist job. If a drive clicks, is not detected, or has been dropped, flooded or burned, power it off. Repeated power-ons, freezer tricks and opening the case at home can turn a recoverable drive into an unrecoverable one. Specialist laboratories exist for this.
- If it may be deliberate or unlawful, treat it as an incident. Keep a record of who handled what and when (chain of custody), hash the images so you can show they have not changed, and involve your security, HR or legal contacts before anyone starts experimenting. Loss or destruction of personal data can also be a reportable personal data breach under UK GDPR, so decide quickly whether it is.
- Handle what you recover as sensitive data. Recovered files can contain anything the original did. Keep them encrypted, limit who can open them, restore into a clean location rather than over the original, and verify the results (open the files, check counts and checksums). Do not restore data that was deleted on purpose, such as information removed to meet an erasure request or a retention rule.
- Close the gap afterwards. Find out why it was possible to delete the data and make it harder next time: tested backups, versioning or soft delete, limited delete permissions, change control for bulk operations, and alerts on mass deletions.
You can download this as a one-page checklist (PDF) to keep with your incident procedures, or read the shorter dos and don’ts, which also covers laptops, phones, memory cards, servers, cloud and databases.
Prevention beats recovery
Recovery is slow, uncertain and sometimes impossible, while a good backup is quick and predictable. The most valuable habit is to test restores on a schedule, so you know your backups really work and how long a restore takes before you need one. Keep at least one copy that an attacker or a mistaken administrator cannot delete along with the original, and keep access to deletion tightly controlled.
This article is general information, not legal advice. For related reading, see our pieces on UK GDPR for developers, encryption and secrets management.