Protect the copy you still have
When a file disappears or a device fails, rapid activity can make recovery harder. The immediate goal is to avoid overwriting the data or losing access to a trusted copy. Then choose the least invasive recovery route that fits the importance and sensitivity of the information.
Stop creating, downloading or saving new data to the affected location where practical. Check recent files, recycle or trash, version history and verified backups using a trusted account. Record what happened and protect sensitive information. Seek qualified help before attempting recovery on a physically damaged device or data with serious personal, legal, financial or business consequences.
Use a safe recovery order
- Pause activity that could overwrite the missing data, especially on the affected storage location.
- Record the file name, location, owner, last known time, changes made and why the information matters.
- Check the application’s recent files, undo history, recycle or trash area and the service’s own version history.
- Check a known, legitimate backup and confirm it is the correct version before replacing anything currently available.
- For shared, sensitive or high-value data, inform the appropriate owner and use an approved recovery route rather than working around access controls.
Match the route to the risk
| Situation | Safer next step | Reason to escalate |
|---|---|---|
| One recently deleted ordinary file | Check the relevant trash, recent files and known version history. | The file is shared, confidential or its status is uncertain. |
| Cloud-stored document changed | Use the provider’s own version-history and restore process. | There are signs of compromised access or a disputed change. |
| Account cannot access files | Recover the account through the provider’s official route first. | Recovery details changed, unfamiliar activity appears or data is sensitive. |
| Device will not start or is physically damaged | Stop repeated power cycles and preserve the device safely. | Heat, swelling, liquid, unusual sounds, important data or warranty implications apply. |
Backups need a restore check
The NCSC recommends not only keeping important data backed up but knowing how to restore it. Its backup guidance notes that a connected storage device can also be affected by malware, so consider the resilience of the backup as well as its existence. Do not use unknown data-recovery software or give a stranger remote access to a device containing sensitive files.
Data recovery FAQs
Can I recover a file after emptying the recycle bin?
Sometimes, but the chance and method depend on the device, storage and what has happened since. Stop using the affected location where possible and seek trusted, proportionate advice for important information rather than installing unknown recovery software.
Is cloud storage the same as a backup?
Not always. A synchronised folder can copy deletion or corruption as well as a useful change. Check version history, retention and whether you have an independent, recoverable copy.
Should I restore an old backup over current files?
Not before checking what would be replaced. Recover to a separate location where possible, compare versions and keep a copy of current data until you are confident the correct version has been restored.
Choose the next safe step
Use the guide that matches the evidence you have, the impact of the problem and the reversibility of the next action. Do not rush from uncertainty to an irreversible change.