Deleted data retrieval: the dos and don’ts

When data has just been deleted, the next few minutes matter more than anything that follows. This is the short, practical list: what helps, what hurts, and what to do for the kind of device or system you are dealing with. For the fuller reasoning behind each point, read our best practice guide.

The dos

• Do stop using the affected device or system now. New data can overwrite deleted data. A laptop or single drive is best shut down rather than left running.
• Do write down what happened. What was deleted, when, from where, by whom or what, and what has been done since. It helps recovery and shows you acted carefully.
• Do check the obvious places. Recycle bin or trash, file version history, backups, snapshots, “recently deleted” folders, and the recoverable items of your mailbox or cloud storage. Some keep items for a limited time only, so look straight away.
• Do pause anything that synchronises. Sync tools can copy a deletion to every other device and cloud copy, and can clear out recycle folders. Pause them until you know where the good copies are.
• Do work from a copy. If the data matters, have a complete image of the drive taken and recover from that, so the original stays untouched.
• Do recover to a different drive. Anything recovered should be saved somewhere other than the source, so it cannot overwrite what you are still trying to get back.
• Do keep encryption keys and passwords safe. For an encrypted drive or phone, recovery is not possible without them. Keep recovery keys such as a BitLocker key somewhere you can find them.
• Do power off and get specialist help for physical damage. A drive that clicks, is not detected, or has been dropped or exposed to water or fire needs a laboratory, not another attempt.
• Do treat suspected deliberate deletion as an incident. Keep records of who handled what, tell your security, HR or legal contacts, and avoid anyone experimenting on the evidence.

The don’ts

• Don’t keep using the device “just for a bit”. Browsing, updates and background tasks all write to the disk.
• Don’t run repair tools. Disk checks and repairs, “fix” wizards and file-system repair commands can rewrite the structures recovery depends on.
• Don’t format, reset or reinstall. That includes the “you need to format this disk” prompt and factory resets. If prompted, say no.
• Don’t install recovery software onto the affected drive. Installing it writes to the very space you want to recover from.
• Don’t run cleanup, defragmentation or “optimise” tools. On solid-state drives these can also trigger TRIM, which erases freed space for good.
• Don’t empty the recycle bin or delete more to make room. Free space elsewhere instead.
• Don’t open a drive, shake it, tap it or put it in a freezer. These myths turn recoverable drives into unrecoverable ones.
• Don’t keep power-cycling a failing drive. Each attempt can do more damage.
• Don’t assume the cloud keeps everything. Retention periods are limited and differ by service and plan. Check the provider’s documentation and act promptly.
• Don’t restore data that was deleted on purpose. If it was removed for an erasure request or a retention rule, restoring it into live systems can create a compliance problem.

By situation

Laptop or desktop

Shut it down, do not restart it to “see if it is still there”, and do not reinstall the operating system. If you have a backup, restore to a different location first. If not, an image of the drive is the safest starting point.

Phone or tablet

Stop using it, and check the “recently deleted” area of the app and your cloud backup before anything else. Modern phones usually encrypt storage and clear freed space, so recovery is often only possible from backups or cloud copies. Do not factory reset.

Memory card or USB stick

Stop taking photos or saving files, remove the card or stick, and do not format it, even if the camera or computer asks. Recovery works best when the card is read as it is, copied, and worked on from the copy.

Server, NAS or RAID

Do not force a rebuild, initialise disks or re-create a volume without advice. Note the disk order and RAID settings, label the drives before removing them, and stop writes to the volume if you can do so safely.

Cloud storage and email

Look in the trash, version history and any recoverable items or administrator restore options straight away, and pause sync clients. An administrator may be able to restore items a user cannot see.

Databases

Keep the transaction logs, binary logs or write-ahead logs, because point-in-time recovery depends on them. Take a backup of the current state before doing anything else, and restore to a separate instance rather than over the live database.

When to bring in a specialist

If the data is important and your first checks have not found it, stop there and ask for help. A specialist can take an image, assess what is realistically recoverable and tell you the chances before doing anything irreversible. Nobody can promise recovery, so be wary of anyone who does.

Common questions