If you accidentally delete an important file, it can feel like all hope is lost, but that is not always the case, as in some cases shortly after a file is deleted a data recovery service can access and restore some or all of the deleted data.
IT technicians and experts often get questions about why this is the case, given that if you throw a document in the bin and the bin is emptied, it is almost impossible to recover before it is pulped.
Given that many people who use Windows will by default send files to the Recycle Bin before “emptying” it to delete files unless they have adjusted system settings, it can be confusing as to why it is even possible to recover data that intuitively does not exist any longer.
The reason why this is possible relates to how hard drives are designed and how they have worked for decades to store and remove data, and why this no longer works for modern solid-state drives.
How Hard Drive File Systems Work
Hard disk drives (HDD) or hard drives work through the use of one or several magnetic spinning discs, with a read-and-write head that can either write data to one of these disks (known as a platter) or read pre-existing data.
The heads of the HDD can, naturally, only read or write data, so the typical way in which operating systems such as Windows operate is through the use of file markers.
When you, for example, save a document or spreadsheet, Windows writes that information to the hard drive, as well as a marker pointing out where the computer can find the start of the information on the hard drive as well as another marker to find the end.
The file manager then keeps track of which markers point to which file when you access them.
What Happens When You Delete A File?
Because hard drives can only read or write, and historically writing to a hard drive can lead to wear and tear on its components, when you delete a file it does not actually get rid of the information on the hard disk as that would take as long as it would take to write the file in the first place.
Instead, it removes the markers that the file system uses to identify that a file is there. This means that instead of deleting the data immediately and taking a long time to do so, the data is overwritten as the HDD is used.
This means that as long as nothing has been written in its place, it is very possible to recover a file from a hard drive by accessing the data through other means or via third-party software, although this is typically a job for a specialist.
Modern solid-state drives work in the opposite way. Because they use flash memory that must always be deleted before new information can be written onto them, most SSDs use the “trim” command to automatically erase files that have been deleted.
