Deleted files: Where They Go and How to Get Them Back

Illustration for article titled Deleted files: Where They Go and How to Get Them Backem/em

When you delete a file from your PC, intentionally or by an unfortunate mistake, have you ever wondered what really happens to this data? Does it immediately vanish without a trace or its leftovers are hidden somewhere deep within the hard drive? No matter if you accidentally killed your working project which was supposed to have been delivered to an impatient client, oh, God, by yesterday(!) or are just worried that some busybody can get their hands on the dirty digital secret you naively believe you’ve destroyed, you probably want to know whether it is possible to restore this information.


As you presumably know, the most common way of getting rid of unnecessary files in Windows is sending them to the Recycle Bin (the icon is in the upper-left corner of your screen). From the user’s point of view, it’s just a folder which contains lots of icons of deleted files awaiting their fate – in case you suddenly change your mind, you can take a peek in it, find the needed one and rescue it without a hitch.

But in reality, a deleted file is not even moved anywhere: it stays at its initial physical location on the disk while its content remains absolutely unaltered and protected from being overwritten. However, the name of the file is changed to a set of random characters beginning with $R (still, it does maintain its original extension), its entry is removed from the record of the original directory and placed to a special hidden system folder (a separate one for each partition) called $Recycle.Bin/SID, where SID is the security identifier of the user who performed this deletion. At the same time, a matching file is created in that folder, whose name consists of $I followed by the same set of random characters and which contains all the information about the original name of the file, its path, size and the time and date of deletion.


However, when you open the Recycle Bin, you will magically see all the files deleted from all the partitions of your hard disk displayed with their original names. You can browse these files, right-click the icon of the needed one and select the “Restore” option. To make things even easier, use the search box at the top-right corner or sort all files by date. Also, if you press the Ctrl-Z combination immediately after the deletion, you can avoid referring directly to the Recycle Bin. After that the original name and path will be read from the “$I” file, the file will be renamed back and its entry will be restored in the record of the original directory.

Nevertheless, one should remember that files won’t be stored in the Recycle Bin for eternity: it has a certain size limit (which can be altered in the Properties, by the way), and once it is exceeded, the older files are thrown away automatically to free up the room for newer ones. Moreover, some of us have the habit of emptying the Recycle Bin now and then, use the Shift-Delete shortcut or even the Command Prompt which makes it possible to bypass it and delete the data outright. What’s more, some very large files may skip the Recycle Bin by default. In these cases, the directory entry of the file gets deleted, making it disappear from the file system. But even though Windows can’t see it anymore, the data of this file stays at the same spot on the disk and is completely intact, which makes it possible to retrieve the file with the help of special data recovery software. This type of programs can search through file system metadata and find out the size, location and name of the deleted file.


Still, the trick is that the space it occupies is marked as free and hospitable to new files, so the system may overwrite it anytime. This usually doesn’t happen straight away, but the longer your PC is used after the deletion, the higher are chances that this location will eventually be used for a different purpose.

Thus, if you happened to delete something you actually never meant to, take a deep breath and follow these steps:

  1. Double-check your computer’s the Recycle Bin. The file you need may still reside there, safe and sound. In addition, try to recall: maybe you once shared this file via skype or email, downloaded it to the cloud or made a backup on a removable drive. In addition, you can try navigating the folder in which the file used to be stored, right-clicking it and selecting the option “Restore previous versions”.
  2. If luck wasn’t on your side and the mentioned above measures appeared to be fruitless, immediately stop using your PC. Any further operations, even streaming a hilarious cat video from You-tube, may turn out to be disastrous to the deleted file and result in its overwriting. To be on the safe side, shut the computer off and remove its hard disk drive out the tower. Sure, Windows wouldn’t write anything onto this disk space unless it has no other options, but you don’t want to take chances, do you?
  3. Find another PC, download and install a data recovery program onto it. For instance, Raise Data Recovery can cope with the task of restoring deleted files perfectly well, being able to bring them back together with their original names and folder structure. Also, check the digital signature of the application before installing it – just to make sure the installation file wasn’t damaged and doesn’t contain any malware.
  4. Connect the removed drive to this computer for recovery (directly or using a SATA/IDE adapter).
  5. Launch the data recovery software and run a scan over the problem drive. When it is completed, find the needed file, select it and save to the internal drive of the recovery PC or some external storage.

On the other hand, if you’re worried that some snooper may retrieve a file you don’t want them to obtain, you should bear in mind that the only way for a deleted file to fully cease to exist is if other files occupy its physical space (excluding total physical destruction of the storage medium, this option is for truly desperate ones). Therefore, to ensure that the file cannot be recovered by anyone, you can run a low-level format on your drive which will fill all the drive space with zeros or use a special utility which will overwrite it with some rubbish data.

As you can see, unlike their human owners us, computers do not tend to forget things so soon, thus, in most cases, if you don’t hesitate, a deleted file can be successfully “undeleted”.

Share This Story

Get our newsletter