Why deleted files can sometimes be recovered from HDDs and SSDs

Deleted files can sometimes be recovered because removing a file from a filesystem does not always erase all of its stored contents immediately. Recovery is possible only if enough useful data and metadata remain accessible. It is never guaranteed, and SSDs can behave very differently from traditional hard drives.

What a filesystem does

A filesystem records how files are organized and where their contents are stored. Reading a file involves using that information to locate its data, rather than searching the entire disk each time.

Different filesystems maintain this information differently. FAT uses allocation tables; NTFS, commonly used by Windows, uses structures including the Master File Table. Calling every filesystem's records “the FAT map” is inaccurate.

Ordinary deletion typically removes or changes filesystem references and makes the occupied space available for reuse. Moving a file to the Recycle Bin or Trash is a separate stage: while it remains there, the normal Restore command may be enough.

How recovery software finds files

Recovery tools generally use one or both of these approaches:

• Filesystem-based recovery: Use surviving metadata to identify a file's location, name and structure.
• File carving: Search accessible storage for recognizable file signatures and contents when the original metadata is missing or damaged.

Carving may find contents without the original names or folder structure. Fragmentation, missing pieces and partial overwrites can leave files incomplete. The PhotoRec documentation describes this signature-based approach and its limitations.

A scan result is therefore a candidate for recovery, not proof of a usable file. Previewing and opening the recovered copy are essential checks.

Why HDD and SSD recovery differ

Traditional hard drives

After ordinary deletion on an HDD, some file contents may remain in sectors until those sectors are reused. Continued activity can overwrite them: downloads, application installations and operating-system activity all matter.

Even without an obvious overwrite, metadata loss, fragmentation or physical damage may prevent complete recovery. No “almost 100%” success rate applies to all deleted files.

Solid-state drives

SSDs manage flash storage internally. An operating system can send TRIM notifications indicating that certain data ranges are no longer needed. Subsequent controller processing can make deleted contents unavailable to ordinary recovery tools, even when the user has not deliberately saved another file over them.

Microsoft's TRIM explanation describes how these notifications differ from simply changing filesystem metadata. Results depend on the device, connection, filesystem and operation. Stopping use is still sensible, but it cannot undo trimming that has already occurred.

Formatting is not one uniform operation

A quick format, a full format, a secure erase and deleting a partition are different operations. Do not assume that formatting merely removes a directory map or that repeating it leaves all contents recoverable.

The Windows format documentation distinguishes formatting options and notes TRIM behavior. Reinstalling an operating system also writes new data, potentially replacing files you wanted to retrieve. The exact operation matters more than the number of times someone says the disk was “formatted.”

What to do after accidental deletion

1. Stop writing to the affected device. Avoid installing recovery software, downloading files or performing repairs there.
2. Check existing copies. Look in the Recycle Bin, Trash, backups and cloud-service deleted-items or version history.
3. Choose a separate recovery destination. Save recovered files to another healthy physical drive, not another folder on the source.
4. Preserve the source where practical. For a stable readable device, an appropriate image can allow work on a copy. Imaging a failing drive requires care and may warrant specialist equipment.
5. Verify saved files. Open representative results before deciding that recovery succeeded.

This lost-file recovery guide covers practical options. If the drive is physically damaged, making unusual noises or repeatedly disconnecting, consult damaged-drive recovery guidance before repeated scans.

Recovery is an attempt to retrieve what remains. A separate, verified backup is the dependable way to avoid relying on that attempt.