How to Recover Deleted Files on Windows 11 — Complete Guide

A woman in Salt Lake City emailed us last March in genuine panic. She’d deleted what she thought was a duplicate folder of vacation photos, emptied the Recycle Bin, and only then realized she’d just permanently deleted the only copies of her wedding photos. Forty thousand images, no backup, gone.

Three minutes after she emailed us, I had her on a call. The first thing I asked: had she done anything else on that computer after the delete? She’d checked email and watched part of a YouTube video. That was it. Probably 90 minutes of light browsing.

That timeline mattered enormously. Light browsing barely writes anything to disk — maybe a few megabytes of browser cache and a Windows Update check. Compared to the gigabytes of photo data she’d just deleted, the cache writes were unlikely to have landed on the same disk blocks. We told her to immediately power off the machine, disconnect the drive, and let us walk her through a recovery session.

We recovered 39,847 of her 40,000 photos. The 153 missing ones had been the most recently saved before the deletion — those particular disk blocks had been overwritten by the cache writes from the YouTube video. Everything older came back intact.

The story illustrates the core truth of file recovery on Windows: the success rate depends almost entirely on what you do in the first few minutes after realizing the files are gone. Stop using the drive. Don’t install recovery software to the drive that has the deleted files. Don’t open new browser tabs. Don’t run Windows Update. Every write operation reduces your chances.

Try Ctrl+Z First — Seriously

If you just deleted the file and haven’t done anything else, press Ctrl+Z immediately. This is the universal undo shortcut in Windows, and it works in File Explorer. Ctrl+Z reverses the most recent action — including deletions. The file reappears in its original location instantly, no Recycle Bin needed.

This only works if you haven’t performed other file operations since the deletion (copying, renaming, creating folders). Each new action pushes the deletion further back in the undo stack. But if you literally just deleted something and panicked, Ctrl+Z before doing anything else is the fastest possible recovery — zero tools, zero clicks beyond the keyboard shortcut.

Where Did Your Deleted Files Actually Go?

Before assuming you need recovery software, check the easy places first. Around six in ten “deleted files” tickets we close turn out to have the files still recoverable from somewhere obvious that the user didn’t think to check.

The first stop is the Recycle Bin. Sounds obvious, but you’d be surprised how often people skip this because they’re certain they emptied it. Open Recycle Bin from the desktop, sort by Date Deleted (right-click the column headers → More → check “Date Deleted” → sort by it). If your file is there, right-click → Restore — it goes back to its original location with the original name.

If you’re a OneDrive user, OneDrive has its own Recycle Bin that’s separate from Windows. Files deleted from a OneDrive-synced folder go to onedrive.com’s Recycle Bin and stay there for 30 days. Sign in at onedrive.com, click “Recycle bin” in the left sidebar, find your file. This catches a surprising number of “permanent” deletions because OneDrive sync is invisible to users — they think they deleted from local disk, but the sync also deleted from cloud, and the cloud version is still recoverable.

File History is the Windows equivalent of Mac’s Time Machine, except it’s off by default and most people never know it exists. If you had it on (Settings → System → Storage → Advanced storage settings → Backup options), you can restore previous versions of any file or folder. Right-click the folder where the file used to be → Restore previous versions → pick a date before the deletion → Restore.

System Restore similarly creates restore points that include some user file states. Right-click This PC → Properties → Advanced system settings → System Protection → System Restore — pick a date before the deletion. This is hit-or-miss because System Restore isn’t designed for file recovery specifically, but it sometimes works.

Are the Files Hidden Instead of Deleted?

Sometimes files aren’t deleted at all — malware or a system glitch marked them as hidden and system-protected, making them invisible in File Explorer while the data is perfectly intact.

Quick check: Open File Explorer → View → Show → check Hidden items. If your files reappear, they were just hidden. To fully fix them:

1. Open Command Prompt as admin.
2. Run: attrib -h -r -s /s /d X:\YourFolder\*.* (replace X:\YourFolder with the path to your missing files).
3. This removes Hidden (-h), Read-only (-r), and System (-s) attributes from all files and subdirectories.

If a virus hid your files, you’ll want to run a malware scan after recovering visibility to prevent it from happening again.

Did You Try Previous Versions?

Even without File History enabled, Windows creates restore points that include snapshots of your files via Volume Shadow Copy. This is separate from System Restore and easier to use.

1. Right-click the folder where the file used to be.
2. Click Properties → Previous Versions tab.
3. If any versions are listed, select one from before the deletion → Restore (replaces current folder contents) or Open (browse and copy specific files).

This only works if System Protection is enabled for the drive (it is by default on the C: drive). It’s the last “no-tools-needed” option before moving to recovery software.

Have You Tried Windows File Recovery (winfr)?

Microsoft has a free command-line recovery tool called Windows File Recovery available from the Microsoft Store. It’s not as user-friendly as Recuva but it’s built into the Windows ecosystem and works well.

Install: Open Microsoft Store, search “Windows File Recovery,” install. It runs from Terminal only — no GUI.

Two modes:

• Regular mode — for recently deleted files on NTFS drives: winfr C: D:\Recovery /regular /n \Users\YourName\Documents\important.docx
• Extensive mode — for files deleted a while ago or after formatting: winfr C: D:\Recovery /extensive /n *.jpg

The key rule: the recovery destination (D:\Recovery in these examples) must be a different drive than the source. The tool refuses to save recovered files to the same drive you’re scanning.

winfr is surprisingly effective for NTFS drives and doesn’t require downloading third-party software — good option for anyone uncomfortable installing Recuva or TestDisk.

What Software Should You Use for Deeper Recovery?

If the easy checks fail and your file is genuinely gone from Recycle Bin, OneDrive, and any backup history, recovery software is the next step. Two free tools we use ourselves on customer recovery sessions:

Recuva (free version from Piriform) is the user-friendly option. Simple wizard interface — pick file type, pick location, scan, results. Works well for photos, documents, music, video files. The free version has all the features you actually need; the Pro version mostly adds virtual disk support and a slightly cleaner interface, but is not necessary for most home users.

PhotoRec (free, open source, part of the TestDisk package) is the heavy-duty option. Slower, command-line-style interface, but goes deeper. Recovers files even after partition formatting or file system corruption that confuses simpler tools. If Recuva finds nothing but you’re sure the files are there, PhotoRec is the next attempt.

Critical: download recovery software to a different drive than the one with the deleted files. Plug in a USB stick, download Recuva-portable or TestDisk-portable to the USB, run from the USB. Installing recovery software on the affected drive can overwrite the very data you’re trying to recover.

"The single biggest mistake I see customers make is installing recovery software on the same drive they're trying to recover from. Every write to that drive — including the recovery program's install files — could be landing exactly on the disk blocks where your deleted data was sitting. Always run recovery tools from a USB stick or a second drive."

Why Are SSDs Harder to Recover Than Hard Drives?

A modern Windows 11 laptop almost always has an SSD as the boot drive. That’s important for recovery because SSDs handle deletion differently from spinning hard drives.

On a traditional hard drive, when you delete a file, the operating system just marks the space as “free” in its filesystem index. The actual data sits intact on the magnetic platters until something else explicitly writes over it. Recovery tools work because they can read those orphaned blocks directly.

On an SSD with TRIM enabled (which is the default on Windows 11), things are different. When the OS deletes a file, it sends a TRIM command to the SSD telling the controller “this block is now free, you can erase it whenever convenient.” The SSD’s garbage collection process then physically wipes those blocks, usually within 5-30 minutes. Once the cells have been wiped, the data is irretrievable by software — no amount of clever recovery scanning can read what’s no longer there.

This is why the time window for SSD recovery is so short. On a hard drive you might have weeks. On an SSD you might have minutes.

To check if TRIM is enabled on your system: open Terminal (Admin) and run fsutil behavior query DisableDeleteNotify. If the result is DisableDeleteNotify = 0, TRIM is enabled (the default). If DisableDeleteNotify = 1, TRIM is disabled and you have more time. You can’t really disable TRIM and rely on that for safety — it hurts SSD performance and lifespan — but knowing the state of your drive helps set expectations for recovery odds.

How Do You Actually Run Recuva to Recover Files?

Walk-through for the simplest case — you’ve accidentally deleted a folder of important documents:

1. Stop using the laptop immediately. Don’t open browser tabs, don’t save anything, don’t install Recuva to the affected drive.
2. On a different computer, download the Recuva portable version to a USB drive.
3. Plug the USB into the laptop with the deleted files. Run Recuva from the USB (no installation needed for the portable version).
4. In the wizard: select the file type if you know it (Pictures, Documents, etc., or “All Files” if unsure) → select where to look (the drive you deleted from) → Start scan.
5. Wait for the scan. On a large drive this takes 10-30 minutes.
6. Review results. Recuva marks each file with a colored indicator: Green (recoverable), Orange (recoverable but possibly damaged), Red (not recoverable). Check the green ones first.
7. Click “Recover.” Save the recovered files to a different drive than the one you’re scanning. This is critical — never save recovered data to the source drive.

For OneDrive or cloud sync issues, also check C:\Users\YourName\OneDrive\.tmp or similar temporary cache locations — Windows sometimes leaves orphaned copies that aren’t visible through Explorer but are findable with file recovery tools.

One related gotcha worth flagging: if your USB recovery drive itself shows “not recognized” when you plug it into the affected laptop, you can’t run recovery at all until that’s fixed first. Our USB device not recognized guide covers the fast checks — usually a different port or a powered hub solves it in under a minute. And if Windows can’t even see the source drive you want to recover from, our hard drive not detected on Windows 11 guide covers the Disk Management / BIOS / TestDisk recovery path.

What Files Are Easiest to Recover?

Different file types have different recovery success rates because of how the file format is structured.

Easiest: Plain text (.txt), simple documents (early-format .doc and .pdf), MP3 audio, JPEG photos. These have strong “magic number” headers that recovery tools can identify even when the filesystem index is gone, and their internal structure is straightforward enough that partial recovery often produces usable files.

Medium: Modern Office documents (.docx, .xlsx, .pptx). These are actually ZIP archives containing XML, which means a partial recovery often produces an unopenable corrupted file even if 95% of the data is there. They either work or they don’t.

Hardest: Encrypted files (BitLocker-protected drives, encrypted ZIP files), database files (.mdb, .sqlite), virtual machine disk images. These often require all blocks intact to function.

Special case — photos: Photos are usually easiest of all to recover because they have strong format headers (JPEG, PNG, HEIC) and they’re often stored contiguously by Windows. We routinely recover thousands of photos from drives where every other file type is unrecoverable.

Did a Windows Update Make Files Disappear?

After major Windows updates (especially version upgrades like 23H2 → 24H2), files sometimes vanish from Desktop, Documents, or Pictures. This isn’t true deletion — Windows created a temporary user profile during the update and your files are sitting in the old profile location.

Check these locations:

• C:\Windows.old\Users\YourName\ — if it exists, your files migrated here during the update. Copy them back to your current user folder.
• C:\Users\TEMP\ or C:\Users\TEMP.000\ — temporary profile. Your real profile is intact but Windows loaded a temporary one instead.

If Windows.old exists:

Settings → System → Recovery → Go back (available for 10 days after a major update). This reverses the update entirely and restores your previous user profile with all files.

After 10 days: Windows.old gets deleted by Disk Cleanup. If you’re within 10 days of the update, “Go back” is the safest option.

Are Your Files Corrupted Rather Than Deleted?

Sometimes files are present on the drive but inaccessible — Windows says “the file or directory is corrupted and unreadable” or prompts to format the drive. This is file system corruption, not deletion.

Run chkdsk to repair:

1. Open Terminal as admin.
2. Run: chkdsk X: /f /r (replace X with the drive letter).
3. If it’s the C: drive, chkdsk schedules itself for the next boot — restart to let it run.
4. Wait — the /r flag makes chkdsk thorough, taking 30 minutes to several hours.

After chkdsk completes, check if your files are accessible again. If the filesystem was repairable, your files come back without needing recovery tools.

What About Recovering Files After a Format or Partition Loss?

If the entire drive was formatted (Quick Format, the most common kind) or a partition was deleted, the underlying file data is usually still there. Quick Format only erases the filesystem index, not the actual file content. Slow Format (the option you have to specifically choose) physically overwrites every block and makes recovery much harder.

For format recovery, PhotoRec is the better tool. It ignores the filesystem entirely and scans the raw blocks of the drive looking for known file headers. It’s slower than Recuva but much more thorough for serious recovery scenarios.

A specific story from last fall. A customer ran Disk Management on his secondary 2TB drive and accidentally deleted the wrong partition — wiped what he thought was an empty drive but was actually his entire photo archive from 2010-2024. We ran PhotoRec on the drive for about six hours overnight, recovered 71,000 photos and videos. He cried when he saw the results — most of those photos were of his late father who’d passed two years prior.

That’s the kind of case where time absolutely matters. He’d called us within 15 minutes of realizing the mistake and had stopped using the computer immediately. If he’d waited a few days while continuing normal use, the recovery rate would have dropped significantly.

When Is Professional Data Recovery Worth It?

Free tools handle a lot of cases. But there are specific situations where DIY can hurt more than help:

The drive makes clicking, grinding, or beeping sounds. That’s mechanical failure on a hard drive (the read/write head is damaged or the spindle motor is dying). Running recovery software in this state is the worst possible thing you can do — the failing head will scratch new tracks and destroy more data with every pass. This is the textbook case for sending the drive to a professional clean-room recovery service. We can’t fix mechanical drive failures remotely, but we can tell you who can.

The drive is encrypted with BitLocker and you don’t have the recovery key. No amount of recovery software can read encrypted data without the key. If you saved the recovery key to your Microsoft account, sign in at account.microsoft.com/devices/recoverykey. If not, the data is unrecoverable in any practical sense.

The data is irreplaceable and free tools have failed. This is where our remote recovery service makes sense. We use commercial recovery tools that aren’t available for consumer download, plus several years of experience working with specific failure patterns. We charge $49.90 with a no-recovery, no-fee guarantee — if we can’t recover what you need, you pay nothing.

You’ve been working on the drive for days after the deletion. At this point free tools probably can’t find your data anymore because it’s been overwritten by normal disk usage. Professional tools sometimes still find traces using forensic techniques, but the odds drop fast.

How Do You Prevent This From Happening Again?

A few habits that almost completely eliminate the risk of permanent file loss:

Turn on File History. Settings → System → Storage → Advanced storage settings → Backup options. Point it at an external drive. It runs in the background and keeps incremental copies of all your files. Restore is then a right-click affair, not a recovery operation.

Use OneDrive or another cloud sync for your important folders. Documents, Pictures, and Desktop can be auto-synced to OneDrive on Windows 11. Deletions go to the cloud Recycle Bin where you have 30 days to undo them.

For irreplaceable data — make a second backup that’s offline. Cloud sync is great but doesn’t protect against ransomware or account compromise. An external drive that you back up to once a month and then unplug is a much stronger safeguard. Drives like the 2TB Western Digital Elements or Samsung T7 work fine and run $60-120.

Don’t store everything on the system drive. A secondary internal drive (or external) for non-OS data means a Windows reinstall doesn’t take your data with it.

What If Nothing Worked?

You’ve tried Recuva, you’ve tried PhotoRec, you’ve checked every backup location. The data isn’t coming back through software.

Three remaining options:

Professional remote recovery. Our service at RebootDoctor runs $49.90 with a no-recovery, no-fee guarantee. We use commercial recovery tools (UFS Explorer Pro, R-Studio, etc.) that aren’t available to consumers and have specific techniques for SSDs, RAID arrays, and partial filesystem corruption. Most recoveries take 45 minutes to 4 hours.

Local clean-room recovery service. For physically failing drives (clicking hard drives, water-damaged drives, fire-damaged drives), you need a clean-room facility. Drivesavers, Ontrack, and Gillware are reputable. Pricing runs $300-3000 depending on drive size and damage severity. We can refer you to a vetted local option if needed.

Accept the loss. Sometimes the math doesn’t work out — the data isn’t valuable enough to justify $1000+ recovery. We’re honest about when that’s the case rather than running you in circles.

Message us on WhatsApp — tell us what you deleted, when, what drive type, and what you’ve done since. We respond within minutes with a realistic assessment of recovery odds.

Last verified: May 2026 against Windows 10 22H2, Windows 11 24H2, and current free recovery software (Recuva, PhotoRec, TestDisk).