Deleting a file does not delete it

When you delete the operating system simply marks the area on the disk as available and logically removes it from the index.

So whilst the data remains, the pathway to that data does not. A little like tearing out the contents table of a book, does not destroy the chapters. Recovery of that data depends on a few factors.

When was the file deleted?

If the file was deleted sometime ago, there’s a strong possibility that the data area on the disk, has been reallocated for another file. If the original file is fully or partially ‘overwritten’, it cannot be recovered.

Has the disk been cleaned up?

If the disk has been defragged or cleaned up in any other way, chances are deleted data won’t be recoverable. The operating system rearranges data for efficiency and it’s much easier to recover a sequential file as opposed to a fragmented one.

What about SSDs?

Although a SSD uses a file system to communicate data storage areas to the operating system, it shuffles the data for even wear across all memory blocks. Adding new data requires a complete rewrite of blocks known as ‘wear levelling’. This extends the life of the SSD. Whilst the same data recovery tools cannot be used for HDDs and SSDs, thankfully the SSD file system can still be interpreted. The TRIM command informs the SSD which data blocks are unneeded and represents a shortcoming in the event of data loss. Nevertheless a deep scan of the affected drive will often (although not always like in HDD recovery) unveil the deleted data.

Further reading

Hard drive clicking

Data Recovery following firmware failure

What is data and how is it stored?