The most critical aspect in recovering deleted files is correct recovery procedure and tools. The second most important factor is time.
When you delete files on a traditional hard drive they are not immediately removed from the disk. What is deleted is the “File record” at the start of the disk that “tells” your operating system where to find the file.
The area occupied on the disk is now considered “free” by the disk, but the information (for a while) is still there.
IMPORTANT — IF YOU NEED DELETED FILES TURN OFF YOUR DEVICE IMMEDIATELY.
Now that the space is marked as free, a number of things will happen even if your computer is just idling.
- Your hard drive / device may initiate self cleanup (very fast with SSD drives)
- Your Windows or Mac operating system may use that space for updates, files or any other function
There is NO WAY for somebody without the proper tools to prevent these activities from occuring. Even if the drive is connected to a new computer, the target machine will investigate and write to your disk, possibly destroying data forever.
Unlike the movies, you can’t scan “underneath” a file to find missing bits of information. Once the data is overwritten, it is essentially gone.