What happens when you delete a file?

Deleting a file is a smaller act than the word suggests. Your computer does not grind the contents into nothing: it updates its bookkeeping so that the space the file occupied counts as free, and leaves the contents sitting there until something else needs the room. What happens next depends on three things: whether the file passed through a bin first, how quickly new data arrives, and whether the drive is a spinning hard disk or a solid state one.^[1][2]

The Recycle Bin is a waiting room

The Recycle Bin is best thought of as a waiting room rather than a disposal chute. Microsoft's own troubleshooting pages confirm it is real storage: a hidden folder called $Recycle.Bin, kept separately on each drive. A file sitting in it has lost nothing except its usual address, and restoring it puts everything back exactly as it was. The stage that matters begins when the bin is emptied. If your file never appeared in the bin at all, it is already at the stage described below.^[3]

Deleted is not the same as erased

Once the space has been handed back, the drive treats it as available, but the bytes themselves are usually still there. Microsoft's SDelete documentation describes deletion as deallocating the space rather than erasing the contents, and notes that disk-level recovery tools can read back data the operating system has deallocated. The file's name can survive too. PhotoRec's documentation explains that after a deletion the name is often still present while the record of where the data begins has gone, and that the data stays on the file system only until something writes over it.^[1][2]

That combination is why a deleted file is genuinely lost to everyday use even though it is physically present. Windows no longer holds an address for it, so nothing can open it, and its space is available for reuse. Anything the system writes next, from a saved document to a browser cache, can land on top of some or all of it.^[2]

Solid state drives change the clock

On a conventional hard disk, deleted data usually stays put until it happens to be overwritten. On a solid state drive (SSD) the drive itself is told to let go much sooner. Microsoft's documentation describes a deletion on an SSD as a change to the Master File Table alone, with the drive's sectors left intact until NTFS sends the TRIM command, at which point the affected areas are permanently removed from the storage media. Because TRIM is sent as part of ordinary running rather than as one dramatic wipe, a file that looks recoverable today may be partly or wholly gone sooner than you would expect.^[4]

SSD TRIM and deleted files: why the window is shorter

Delete versus erase

Because deleted data usually survives until overwritten, an ordinary deletion is not a way to dispose of anything sensitive. Microsoft is direct about this: its SDelete documentation states that the only way to be sure deleted files are safe from recovery is to use a secure delete application that overwrites the data. Until that has happened, the contents remain recoverable in principle, which is worth bearing in mind before a drive is sold, given away or recycled.^[1]

A quick format is the same story on a larger scale. Microsoft's format documentation describes it as deleting the file table and root directory of a volume rather than scanning and clearing every sector, and notes that a format normally sends a trim notification too. The index is gone. The data underneath usually is not, at least straight away.^[5]

That is also why recovery tools can sometimes work after a format. PhotoRec's documentation explains that the tool ignores the file system entirely and reads the raw data instead, checking blocks against a library of known file headers, so it can find files even where the file system has been damaged or reformatted, and it opens the drive read-only while doing so.^[2]

What this means for your file

Three plain consequences follow. A file still in the Recycle Bin is one step from home, so look there before anything else. If it is not in the bin, the clock is already running, and the most useful thing you can do is stop using that drive. And if the drive is an SSD, the clock runs faster, so the sooner you act the better.^[4]

If you are at that second stage, our first steps guide covers what to check, and in what order. If you suspect the data has already been written over, the overwritten files FAQ explains when recovery is and is not possible.

Deleted files: the first steps

Can you recover overwritten files?

Not sure what happened to your file, or which of these situations you are in? Guided help asks a few plain questions and points you to the right place.

Guided help: not sure what happened?