Data Recovery

If the drive is still active in a running computer, every second matters. This is not hyperbole -- modern operating systems write constantly to disk in the background. Windows Update, browser cache, temp files, log files -- all of it is potentially landing on the exact sectors where your deleted files sit. For an external drive: unplug it now. Do not eject normally -- just pull it. A corrupted file table is recoverable. Overwritten data sectors are not. For an internal drive in a running PC: power the machine off by holding the power button for 5 seconds. Do not let it shut down normally -- a normal shutdown writes temp files, logs, and hibernation data. For a laptop with the affected drive as the boot disk: close the lid (sleep), then hold power to force off. Do not open it again until you have a recovery plan. The goal is to freeze the drive's state at this exact moment. Every byte written to the drive after deletion has the potential to overwrite a recoverable file. Do not boot from that drive again until you have a recovery environment ready.

Before running any recovery software, check these -- they take 2 minutes and might save you hours of scanning: Windows Recycle Bin: open it, search for your filename. Right-click → Restore. Files deleted normally (not Shift+Delete) sit here until the bin is emptied or hits its size limit. Mac Trash: open Finder → right-click Trash in the Dock → Open. Drag files back to a folder. Cloud sync trash -- check every service you use: -- OneDrive: onedrive.live.com → Recycle Bin (retains files 30 days) -- Google Drive: drive.google.com → Trash (30 days) -- iCloud Drive: icloud.com → Recently Deleted section (30 days) -- Dropbox: dropbox.com → Deleted Files (30 days on free plan, 180 days on paid) Previous Versions (Windows): right-click the folder where the file lived → Properties → Previous Versions tab. Windows may have a shadow copy from a restore point. File History (Windows): if enabled, open Start → search "Restore your files with File History." This is Windows' built-in versioning -- if it was on, your files may be here. Time Machine (Mac): if you have a Time Machine backup drive, connect it and open Time Machine from the menu bar. Navigate to the folder and date.

Recovery approach depends entirely on what type of failure you have. Get this wrong and you waste hours on the wrong tool -- or worse, make physical damage permanent. Logical failure (software-level) -- DIY recovery is viable: -- Files accidentally deleted or Shift+Deleted -- Drive formatted by mistake -- Partition deleted or corrupted -- Drive shows in Device Manager / Disk Utility but files are gone or inaccessible -- File system shows as RAW instead of NTFS/APFS/ext4 Signs: the drive appears in File Explorer or Disk Utility, even if it shows as RAW or unformatted. The drive spins up normally, makes no unusual sounds, and stays detected. Physical failure -- stop immediately and call a professional lab: -- Clicking, grinding, or scraping sounds from the drive -- Drive not detected at all (not in Disk Management, not in BIOS/UEFI) -- Drive detected but immediately disappears after a few seconds -- Drive gets very hot very fast -- Drive was dropped, submerged, or exposed to extreme heat Signs: sounds, heat, or complete non-detection. Running a physically failing drive -- even for one scan -- can scratch the magnetic platters and make professional recovery impossible or double the cost.

If the affected drive is the boot drive in a desktop or laptop, you need to get it out and connect it to a working computer as a secondary drive. Booting from the affected drive writes to it -- which is exactly what you're trying to avoid. Desktop: power off, unplug from wall, open the side panel. Find the drive (usually in a bay or caddy). Disconnect the SATA data cable and SATA power cable. Slide the drive out of its caddy (usually 2-4 screws). Touch the metal case before handling the drive to discharge static. Laptop: power off, flip over, find the drive access panel (some laptops require removing the entire bottom panel -- check a YouTube teardown for your exact model). Remove the screws holding the drive caddy, slide the drive out, disconnect the SATA or M.2 connector. Once removed, connect the drive to a working computer using a USB-to-SATA enclosure or docking station. The working computer's OS will detect it as an external drive. Do NOT format it if Windows asks -- click Cancel. If the drive is an M.2 NVMe SSD, you'll need an M.2 NVMe to USB enclosure (different from SATA enclosures). Check the connector type before buying.

Recuva (by Piriform, makers of CCleaner) is the best free recovery tool for Windows. Download it from piriform.com/recuva -- not a mirror, not a download aggregator, not the first Google result that says "free Recuva download." CRITICAL: Install Recuva on a different drive than the one you're recovering. If the affected drive is now connected externally, install Recuva on your working computer's C: drive. If you're recovering from C: and can't remove it, install Recuva on an external USB drive. How to run it: 1. Open Recuva → select file type (All Files for best results) → select the affected drive letter 2. Check "Enable Deep Scan" -- it takes longer (30 min to several hours depending on drive size) but finds significantly more 3. Let the scan complete fully -- do not interrupt it, do not use the computer for anything else heavy 4. When results appear, sort by "State" column -- green circle = excellent recovery chance, yellow = partial, red = likely gone 5. Select the files you want → right-click → Recover Checked → save to your external USB drive (NOT the source drive) If Recuva shows your files but they all open as corrupted or blank, the data sectors were partially overwritten. A professional tool like R-Studio ($80) or a professional service may recover more.

Mac users have two solid options -- one with a GUI, one free with no limits: Disk Drill (Free tier -- CleverFiles): -- Download from cleverfiles.com -- free version scans and previews recovered files -- Open Disk Drill → select the affected drive → click Search for Lost Data -- Preview files before recovering (the free version lets you see what's recoverable before paying) -- The free version recovers up to 500MB -- paid ($89) removes that limit -- Save recovered files to a separate drive, never the source PhotoRec (completely free, unlimited -- but command line): -- Download from cgsecurity.org (it comes bundled with TestDisk) -- Open Terminal → navigate to the PhotoRec directory → run it → select your drive → choose file types to recover → choose destination folder on a different drive -- PhotoRec is extremely powerful but recovers files without original filenames (generates names like f0001234.jpg) -- Excellent for photos and documents, harder to sort through the output For both tools: save output to an external drive, not the recovery source. And don't run both tools simultaneously -- run one, check results, then decide if you need the other.

When Recuva, Disk Drill, or PhotoRec finishes, you'll have a folder of recovered files. Before declaring victory and closing everything: 1. Open a representative sample of the recovered files -- images, documents, videos, spreadsheets -- and verify they actually open correctly and contain real content. Some files recover structurally (correct file size, correct extension) but are corrupted internally -- you'll see garbled text, half-rendered images, or videos that play 3 seconds then freeze. 2. Rename and organize what you recovered. PhotoRec in particular generates generic names (f0001234.jpg) -- sort by date modified or file size to find related files and identify what's what. 3. Cross-reference with what you know you lost. Make a mental checklist: wedding photos, tax returns, that novel draft, the client presentation. If critical files are missing or corrupted after the deep scan, stop -- don't keep running recovery tools over and over. Each scan risks minor additional writes to the source drive. If the first deep scan didn't find it, a professional service is the next step. 4. Back up everything you recovered immediately -- copy to at least two separate locations. You just experienced data loss. Do not let the recovered files exist in only one place.

After recovery, you need to decide the fate of the drive itself. If the failure was logical only (accidental deletion, format, corrupted partition): The drive hardware is likely fine. Run a full health check before trusting it again: -- Windows: open Command Prompt as admin → run "chkdsk X: /r" (replace X with drive letter) -- this scans for and repairs bad sectors -- Download CrystalDiskInfo (free) → check the S.M.A.R.T. status. "Good" = the drive's internal diagnostics say it's healthy. "Caution" or "Bad" = replace the drive. If the failure involved any physical symptoms (sounds, heat, non-detection): Replace the drive. Do not reuse it. A drive that has exhibited physical failure symptoms will fail again -- the only question is when. Use it as a paperweight or recycle it responsibly (Best Buy, Staples, and most e-waste centers accept drives). If the drive is an HDD over 5 years old: Replace it regardless of the failure type. Mechanical drives have a finite lifespan. You got lucky this time. Upgrade to an SSD for your boot drive and use the HDD budget toward a backup solution instead.

The only reason data recovery exists as a service is because backups weren't in place. Fix that now, while the pain is fresh and the motivation is high. Next week you'll forget. Next month you'll say "I should set up backups." Next year you'll be reading this guide again. The 3-2-1 rule: -- 3 copies of your data (the original + 2 backups) -- 2 different storage types (e.g., internal drive + external drive) -- 1 copy offsite or in the cloud Practical setup for most people: Windows: -- Enable File History: Settings → Update & Security → Backup → Add a drive (select an external USB drive). It runs automatically in the background. -- Enable OneDrive or Google Drive sync for your Documents, Desktop, and Pictures folders. That's your offsite copy. Mac: -- Enable Time Machine: System Settings → General → Time Machine → select an external drive. It runs every hour automatically -- set it and forget it. -- Enable iCloud Drive for Documents and Desktop folders. That's your offsite copy. Cloud-only is not a backup (the service can change terms, get hacked, or delete your account). External-only is not a backup (fire, theft, or drive failure takes both copies). Both together is the minimum viable backup strategy.