Deleting a file removes its entry from an index and marks the space as available. The contents stay exactly where they are until something else is written on top of them, which is why deleted data is recoverable at all and why every hour of continued use costs you some of it. This page covers the six places files get deleted from, why an SSD answers differently, and what actually comes back.
£300 + VAT a drive, £250 + VAT a card or stick, from £500 + VAT for a NAS or an array. Deleting a file removes the entry in the index and leaves the contents where they are, so the only thing that costs you anything now is continuing to use the disk.
Deletion means different things in different places, and the place decides the odds. These are the six versions people ring about, roughly in order of how well they usually end.
Not deleted at all. The file has been moved and renamed and it is still on the disk. Open the bin, right-click and restore. If the bin has since been emptied you are in the next category, but it is always worth looking first because it costs nothing and solves a surprising number of these.
Now the directory entry has gone and the space is marked available, while the contents sit there untouched until something writes over them. Good odds on a spinning disk if the machine is stopped promptly. On an SSD the released blocks are erased in the background within minutes.
There is no recycle bin between a PC and a network share unless one was set up on the unit, so the delete is immediate. It is also often recoverable, and the deciding factor is whether the unit was powered off or left serving the office while other people carried on writing to it.
Removable media has no recycle bin either. The file goes at once and the space is freed. Take the card or stick out of every device now, because a single further photograph or saved document can land exactly where the missing ones are. Cards and sticks are the £250 + VAT band.
The deletion propagates to every synced machine within seconds, which feels like a disaster and often is not. OneDrive, Google Drive and Dropbox all keep their own recycle bins on the web for a period, and version history frequently holds an earlier copy. Check the browser interface before doing anything else.
Saved over the top of, replaced by a file of the same name, or written across by continued use of the disk. This is the one that ends badly. Previous versions or a shadow copy sometimes hold an older revision, but where new data has physically taken the place of the old, nothing brings it back.
A file system is two things: an index recording every file's name, size and location, and the space where the contents live. Deleting a file edits the index and marks the clusters as available. It does not touch the contents. That is why deletion is instant on a fifty-gigabyte video and why recovery is possible at all — for a while, the file is entirely present and merely unlisted.
The window closes when something else is written into that space. Nothing dramatic is required: an update, a browser cache, a document saved, a photograph imported. This is why the advice is always the same and always immediate. Stop using the disk. On a system drive that means shutting the machine down, because Windows writes constantly on its own account whether or not anybody is typing.
The first is by rebuilding the index. Deleted records often survive in the file table with enough intact to say where a file began and how long it was, so names, folders and dates come back along with the contents. This is the better outcome and it is what happens on most recent deletions.
The second is carving. Where the index has gone or been reused, files are identified by their content instead: documents, images, video and archives all begin with recognisable patterns and have internal structure that can be followed to the end. That returns the file intact but with a new sequential name and no folder. It also struggles with fragmentation, since a file written in pieces across the disk has to be reassembled in the right order, and the map saying what that order was is exactly what has been lost.
Both explain something people find puzzling: why a recovery can return a thousand files of which some open perfectly and a few are corrupt. The intact ones were found whole. The damaged ones were partly overwritten or fragmented in a way the reassembly could not resolve.
On a solid state drive, deleting a file usually tells the drive that those blocks are no longer needed, and the controller erases them in the background so they are ready for reuse. That happens within minutes, without the computer being involved, and it is not reversible by any laboratory. It is the reason an honest answer about an SSD deletion is often no.
The exceptions are worth knowing. If the machine was switched off within moments there may be blocks not yet processed. Older drives, external SSDs behind a USB bridge and some RAID configurations do not always pass the notification through. And a deleted file on an SSD is a completely different question from a corrupt file system on one, where the data is still allocated and usually recoverable in full.
For a straightforward deletion on a healthy disk, a reputable tool run from a different machine is a reasonable thing to try, and plenty of people solve their own problem in an afternoon. Two rules make the difference. Never install it onto the drive you are recovering, because the installation writes into the space you are trying to read. And never let it write its results back to the same disk.
Do not run it at all if the drive is clicking, stalling, disconnecting or taking seconds to answer. A recovery tool will read the whole surface repeatedly and keep a failing disk working hard for hours, which is the worst possible use of the limited time it has left.
A single hard drive or SSD is £300 + VAT. Memory cards, USB sticks and pen drives are £250 + VAT. A CCTV or DVR recorder disk is £400 + VAT, as is an encrypted volume where you can supply the key. Deleted data from a NAS, a RAID array or a server is the array band, from £500 + VAT rising with the member count, because every member has to be imaged before anything can be assembled. Forensic work with a full written report is £800 + VAT, and a binary image with deleted-file extraction and no report is £400 + VAT.
That last figure is worth explaining, because it is the one people ask about. Where deleted material is needed for a dispute, an insurer or an employment matter, the forensic route produces a properly documented image and an extraction. Without a written report it is £400 + VAT — the same point as the recorder and encrypted band rather than a sixth tier. With a full written report it is £800 + VAT. For an ordinary domestic or business deletion, none of that applies and the standard bands are what you pay.
The diagnostic costs nothing and closes two working days after the media is booked in. It says what is recoverable, not what might be, and it comes with a fixed written figure and a realistic date. Single-drive jobs are usually finished two to four working days after authorisation.
Deletion is a logical fault, so it carries no fix, no fee. Nothing usable returned means nothing to pay. The published exclusions are electronic failures, mechanical failures, chip-level work, DVR jobs and forensic jobs, and physical work takes half the quoted figure upfront.
You get a file list before anything is returned, so you can check it against what you were expecting rather than discovering the gaps later. Where the index survived, that list looks like your folders. Where carving was needed, it looks like sorted file types with sequential names, and identifying the important ones is a matter of opening a few.
Data is returned on separate media. Nothing is written back onto the original disk, ever, which is both a matter of principle and the reason a second pass is always possible if something turns up missing.
Take the drive out of the machine and post the drive, tracked and insured. An external unit travels whole in its enclosure, a NAS travels whole, a WD My Passport or My Book goes with its cable because the encryption key sits on the bridge board, and a RAID or server sends its member disks only, labelled with the bay order and with the chassis front photographed first. Cards and sticks want a rigid case inside a padded envelope.
Or bring it: Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD, Mon–Fri 9:00am–5:30pm, about 70 miles down the M1 to J19 and then east on the A14, two minutes off Junction 32. There is no Leicester office and no collection service.
A computer left running writes constantly on its own account, and every one of those writes could land on what you are trying to get back.
Cards, sticks and single drives are the easiest things in the world to post, and posting them is gentler than a day of being carried around in a coat pocket. A padded envelope handed over in Leicester tends to reach the Cambridge bench the next working day.
The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.
↓ Print the shipping & booking-in form (PDF)
Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.
Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.