Can Deleted Data Be Recovered? Usually, Yes

Pressing delete feels final. In most cases it is not. Deleted files, formatted drives and even reset devices can leave behind data that widely available recovery software, or a specialist laboratory, can bring back. Whether that is a relief or a risk depends on whether you meant to lose the data, or meant to get rid of it.

This article explains what remains after common deletion methods, and how proper sanitisation differs.

Can deleted data be recovered?

Usually, yes. Deleting a file normally removes only its reference, and the data stays on the drive until it is overwritten, so recovery software can often find it. Proper sanitisation of the whole drive makes recovery infeasible.

What happens when you delete a file

When you delete a file, the operating system usually removes its entry from the file system and marks the space it occupied as available. The data itself often stays on the drive until something else is written over it. Emptying the recycle bin or trash does the same thing one step later.

That is why recovery tools work: they scan the drive for data that is no longer referenced by the file system but has not yet been overwritten.

Hard drives and SSDs behave differently

Hard disk drives

On a magnetic hard drive, deleted data typically remains in place until it is overwritten. The longer a drive has been in use since the deletion, the more likely some of it has been overwritten, but there is no reliable way to predict which parts survive.

Solid-state drives

SSDs manage storage differently. Many operating systems send a TRIM command when files are deleted, telling the drive those blocks are no longer needed, and the drive may then clear them in the background. That can make casual recovery harder, but it is not a sanitisation method. TRIM is not guaranteed to run, may be disabled, and does nothing about the spare and overprovisioned areas that wear levelling uses. NIST SP 800-88 Rev. 2 notes that wear levelling makes it infeasible to sanitise all earlier data on flash media through ordinary reads and writes.

Formatting is not erasing

A quick format rebuilds the file system structures on a drive, giving it an empty directory. Most of the old data stays where it was. A full format may write over more of the drive depending on the operating system, but it is still not designed as a sanitisation process and does not address hidden areas. Our guide to disk sanitisation versus formatting explains the difference.

What about a factory reset?

A factory reset returns a device to its default state. On modern phones with built-in encryption, a reset that removes the encryption keys can be very effective. On computers, results depend heavily on the method chosen, the storage type and the implementation, and some reset options are designed for speed rather than thorough erasure. See does a factory reset remove everything? for the detail.

How sanitisation is different

Sanitisation is a deliberate process designed to make recovery infeasible at a defined level of assurance. NIST SP 800-88 Rev. 2 and IEEE Std 2883-2022 describe three levels:

• Clear: protects against simple, non-invasive recovery through the normal interface, for example by overwriting all user-addressable locations.
• Purge: makes recovery infeasible even with state-of-the-art laboratory techniques, while leaving the media potentially reusable. Techniques include drive-supported sanitise commands such as block erase, overwrite commands that also reach non-addressable areas, and cryptographic erase.
• Destroy: leaves the media unable to store data, for example by disintegration, incineration or melting.

The key point is that a sanitisation method is chosen to suit the media and applied to the whole device, including areas the operating system cannot see, and its outcome is checked and recorded.

Overwriting myths

You may have read that data must be overwritten many times to be safe. That advice dates from older drive technology. NIST SP 800-88 Rev. 2 states that multi-pass overwriting is not needed for Clear, and IEEE 2883 notes that a single pass can be sufficient for some hard drives. On SSDs, repeated overwriting adds wear without reaching the hidden areas that matter. The real risk on modern media is not the number of passes but the areas the host cannot address. Our article on whether overwriting SSDs is safe covers this.

When recovery is genuinely infeasible

Data is effectively beyond recovery when:

• a suitable Purge technique has been applied to the whole device and completed successfully;
• a cryptographic erase has been carried out where all data was encrypted from the start and every copy of the key has been destroyed; or
• the media has been physically destroyed to an appropriate standard.

Partial measures, such as drilling a hole through a drive, may stop it working but can leave platters or chips that a laboratory could read.

Practical advice

If you are trying to recover data you lost by accident, stop using the drive straight away, because every new write reduces the chance of recovery.

If you are trying to make sure data cannot be recovered, before selling, recycling or redeploying a device, use a proper sanitisation method. RedKey USB, our bootable erasure tool, runs outside the installed operating system on supported PCs and Intel Macs and erases the drives it detects. The Professional and Ultimate editions produce a PDF report for each erasure; the Home edition shows the result on screen. For a step-by-step approach, see how to wipe retired computers without risk.

So, can deleted data be recovered? Usually, yes. Can properly sanitised data be recovered? Not with any practical technique, which is exactly the point.

Frequently asked questions

What software is best for securely deleting files so they cannot be recovered?

File-level shredding tools are unreliable on SSDs. If the device is leaving your control, sanitise the whole drive instead.

Is erasing or reformatting enough to delete electronic records?

No. Both can leave data recoverable.

RedKey USB Home erases whole disks so deleted data cannot be recovered. Related reading: Disk Sanitisation Versus Formatting Explained and Does Factory Reset Remove Everything? The Real Answer.