Storage keeps its files in one place and its account of them in another, and deleting only edits the account. The contents stay exactly where they were until something new is written on top, which is why deleted data can be recovered at all and why every further hour of use costs you some of it. Here are the six places files go missing from, why solid state storage answers differently, and what genuinely comes back.
£300 + VAT a drive, £250 + VAT a card or stick, from £500 + VAT for a network box or an array. Deleting edits the account and hands the space back without clearing it, so the only thing costing you anything at this moment is carrying on using the disk.
Deletion means six different things depending on where it happened, and the place sets the odds before anybody has looked at anything. These are the versions people ring about, arranged roughly from those that end well to the one that does not.
Not deleted in any meaningful sense. The file has been moved and renamed and it is still on the disk. Open the bin, right-click, restore. Where the bin has since been emptied you belong in the next category, but it is always worth looking first, because it costs nothing and settles a surprising proportion of these calls outright.
The entry has gone from the catalogue and the space is marked available, while the contents themselves sit untouched until something new lands on top. Decent odds on a spinning disk where the machine was stopped promptly. On an SSD those released blocks are usually cleared in the background within minutes, and that part does not reverse.
Nothing sits between a PC and a share unless a bin was configured on the box itself, so the removal is immediate and total. It is also frequently recoverable, and what decides it is whether the unit was powered down or left serving the rest of the office while everybody continued writing to the same volume all afternoon.
Removable media has no bin either. The file goes at once and the space returns to the pool. Take the card or the stick out of every device now, because a single further photograph or saved document can land exactly where the missing ones are lying. Cards and sticks are the £250 + VAT band whatever the capacity.
The removal reaches every machine within seconds, which feels catastrophic and frequently is not. The major services keep a web recycle bin for a period and most keep version history beside it, so the copy you want may be sitting in a browser rather than on any disk. Check that interface before doing anything else at all.
Saved on top of, replaced by something carrying the same name, or buried by continued use of the machine. This is the version that ends badly. A shadow copy or previous version occasionally holds an earlier revision, but once new data has physically occupied the old ground, nothing anywhere retrieves what was there.
Storage keeps its files in one place and its account of those files in another. The account records the name, the size, the dates and the list of blocks each file occupies; the blocks themselves hold the contents. Deleting edits the account and returns the blocks to the pool of available space. It does not go near the contents. That is why removing a fifty-gigabyte film takes no longer than removing a shopping list, and it is the whole reason recovery is possible at all: for a period, the file remains entirely present and simply unlisted.
What closes the window is reuse, and reuse requires nothing dramatic. An update installing itself. A browser writing its cache. A document saved. Photographs coming off a phone. Which is why the instruction never varies and never waits: stop using the disk. On the drive Windows is running from, that means shutting the machine down, because the operating system writes steadily on its own account whether or not anybody is touching the keyboard.
The first route repairs the account. Removed records often survive in the file table with enough intact to establish where a file started and how far it ran, so names, folders and dates come home alongside the contents. That is the better outcome and it is what happens with most recent deletions on a disk nobody has used since.
The second route ignores the account entirely and reads the blocks. Documents, images, video and archives each open with a recognisable pattern and carry enough internal structure to be followed from beginning to end, so the file can be lifted out whole and written to fresh storage with a sequential name and no folder. That route also struggles where a file was written in scattered pieces, because reassembling them in the correct order needs the very map that has been lost.
Between them the two explain something people find odd: why a job can return a thousand files of which most open perfectly and a handful will not. The good ones were found intact. The bad ones were partly overwritten, or fragmented in a way that could not be resolved without the map.
Delete something on an SSD and the operating system generally notifies the drive that those blocks are no longer wanted. The controller then clears them in the background so they are ready to be written to again, and it does that within minutes, on its own initiative, without the computer being involved and without asking anyone. No laboratory reverses it, and any service claiming to is selling something. That is why an honest answer about a deleted file on an SSD is so often a disappointing one.
The exceptions are genuine and worth knowing. A machine switched off within moments may still hold blocks the drive had not yet got to. Older drives, external SSDs behind a USB bridge and certain array configurations do not always pass the notification through at all. And a deleted file on an SSD is an entirely separate question from a corrupt file system on one, where the data is still allocated, still wanted and usually recoverable in full — deleted files on an SSD takes that distinction apart properly.
For an everyday deletion on a healthy disk, a reputable tool operated from a different machine is a reasonable thing to attempt, and plenty of people solve their own problem in an evening without paying anybody a penny. Two rules separate that from a disaster. The tool must not be installed onto the drive being recovered, because the installer writes into exactly the space you are trying to read. And its output must go somewhere else entirely, never back onto the same volume.
Where the drive is clicking, stalling, disconnecting or taking whole seconds to answer, run nothing. Scanning software reads the entire surface repeatedly and will keep a failing disk labouring for hours, which is the worst possible use of however much life it has left. That situation belongs on the hard drive repair page rather than this one.
One hard drive or SSD is £300 + VAT. A memory card, a USB stick or a pen drive is £250 + VAT. A CCTV or DVR recorder disk is £400 + VAT, as is an encrypted volume where the key can be produced. Deleted material on a network box, a RAID set or a server is the array band, from £500 + VAT climbing with the member count, because every member is imaged before anything can be assembled and read.
Looking costs nothing and closes on the second working day after your media is logged in. It reports what is recoverable rather than what might conceivably be recoverable, and it arrives with a fixed written figure beside a realistic date. Single-drive jobs usually finish two to four working days after you authorise. Deletion is a logical fault, so no fix, no fee applies: nothing usable back means nothing to pay. Chip-level work, DVR jobs, forensic jobs and mechanical or electronic failure sit outside that, and invasive work takes half the agreed figure upfront.
Everything above assumes the files are yours and you would like them back, which describes almost every enquiry that arrives. A different situation exists where the removal itself is what is being argued about: which files left a machine, on what date, under whose account, and whether somebody cleared them out before handing a laptop back at the end of a notice period. That is deleted file forensics — largely the same underlying records, read for a different purpose, and documented so that an expert paid to disagree can follow each step and try to break it.
They are priced apart because they are different work with different outputs. An investigation reported in full is £800 + VAT. The verified image with its deleted material extracted, without a written report, is £400 + VAT, sharing a rung with the recorder and encrypted bands rather than adding one. Where nobody is in dispute and you simply want the files, none of that applies and the ordinary bands above are what you pay.
A file list comes first, before anything is returned, so it can be checked against what you were expecting rather than leaving the gaps to be found in six months. Where the account survived, that list looks like your folders. Where the blocks had to be read directly it looks like sorted file types with sequential names, and picking out what matters is a question of opening a few.
Everything comes home on separate media. Nothing is written back onto the original disk under any circumstances, which is a principle and also the practical reason a second pass stays available whenever something turns out to be missing from the first.
Take the drive out and post the drive, tracked and covered. An external unit travels whole and sealed in its case, a network box travels whole with its disks in their bays, and a RAID or server sends members only, marked with the bay order and photographed first. Cards and sticks want something rigid inside a padded envelope rather than a bare envelope that will meet the sorting machinery. Storage soldered to a mainboard cannot be removed, and phones and tablets are not handled here at all.
Or bring it: Oxford Data Recovery, John Eccles House, Oxford Science Park, Robert Robinson Avenue, Littlemore, Oxford OX4 4GP, weekdays between 9:00am and 5:30pm. From Coventry that is about fifty-five miles of M40 and roughly an hour. There is no Coventry office and no collection service. Where what happened was a format rather than a deletion, formatted SD card recovery covers cameras and card readers, and data after a Windows reinstall covers the version where the whole machine was set up again from scratch.
A machine left switched on writes steadily whether anybody is using it or not, and any one of those writes can land on the thing you want back.
Something rigid, some padding and a tracked label treat an ailing device far better than a week of being carried about in a bag while its owner decides what to do next. Handed in at a Coventry counter during the afternoon, it generally reaches the Oxford bench the following working morning, which beats what most people manage by clearing a day for the M40.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.