Loss & Recovery
What is truly deleted – and what is just marked as "gone". Recovery practices for hard drives, SD cards, USB & smartphones.
Accidentally emptied the trash, formatted, or simply messed up? In most cases, the data is still there – just marked as "deleted". Here you'll learn how file recovery works, on which devices and systems it's possible, and when you should rather go to a professional.
📋 Page Contents
How File Recovery Works
When you delete a file and empty the trash, it's not gone. The operating system only marks the file as "deleted" – the data physically remains on the hard drive until it is overwritten.
The Directory Index Trick
Imagine your hard drive as a library: The data are the books, the file system is the catalog. When you delete something, only the catalog entry is removed – the book is still on the shelf. Recovery software scans the hard drive sector by sector, without relying on the catalog, and finds the "books" again.
⚠️ Time Factor: The more you write after deletion, the higher the chance that the data will be overwritten. Immediately after deletion, the success rate is highest – it decreases with every subsequent action.
When It Works — and When It Doesn't
Accidentally deleted, trash emptied, file renamed & not found. Quick format. Corrupted partition table.
After full format with overwriting. With mechanical hard drive defects. With encrypted files without keys. On TRIM-enabled SSDs after a long time.
💡 Important Rule: Never install recovery software on the affected drive. Always install it on a second drive – or work directly from a bootable medium.
Recovery for Windows, Mac, Linux
Recovery works on all operating systems – with minor differences:
| System | File System | Specifics |
|---|---|---|
| Windows | NTFS, FAT32, exFAT | Best tool selection, wide range of recovery software. Loss may occur with metadata from portable programs. |
| macOS | APFS, HFS+ | APFS has been standard since 2017 – uses snapshots, which sometimes simplifies recovery. Time Machine is the official backup solution. |
| Linux | ext4, btrfs, XFS | Tools like TestDisk, PhotoRec, or extundelete are often the first choice – also usable on Windows via live CD. |
Cross-System: Recovery from a Linux Boot Stick
A clever approach: Instead of recovering under a running Windows (where the system constantly writes), boot a Linux stick like Rescue Stick. Advantages:
- Windows is shut down – no unintentional write operations
- Linux tools can read NTFS, APFS, and ext4 – cross-platform
- Booting externally bypasses even corrupted Windows installations
Recovery for SD Cards, USB Sticks, Smartphones
USB Sticks & SD Cards
Both use flash memory and are usually formatted with FAT32 or exFAT. Accidental deletion or formatting is common here – the recovery success rate is high as long as nothing new has been written.
For physically damaged sticks (broken contacts, water, heat), a professional is needed – home users lack the soldering equipment and cleanroom facilities.
External Hard Drives
External HDDs are essentially the same as internal ones, just connected via USB. Recovery tools work identically. Important: If you hear clicking noises, disconnect immediately and take it to a professional.
Smartphones (Android & iPhone)
This is where it gets more complicated. Modern smartphones use encrypted storage – without device access, you can't get to the data. Options:
- Android: SD cards can often be recovered separately (see above). Internal memory can be backed up with root access – otherwise, only via the manufacturer's cloud (Google Drive).
- iPhone: Practically only accessible via iCloud or iTunes backup. Internal data is hardware-encrypted – recovery without passcode/Face ID is virtually impossible.
- WhatsApp, Photos & Co.: Often, only the cloud backup created by the apps themselves helps here.
📱 Smartphone Tip
Activate automatic cloud backup for your most important data (contacts, photos, messages) on both systems. Today, this is the only reliable smartphone data recovery method.
Data Forensics for Private Users
The Windows Explorer doesn't show what's really going on on your PC. With forensic tools, you can dig deeper: find deleted files, analyze hidden areas, discover traces of malware or unauthorized access.
What Data Forensics Is Useful For
- Finding files that normal recovery tools overlook – deep in free space, in slack space, in old file system structures
- Reconstructing browser history – even if it was deleted
- Finding malware traces – unusual files, hidden processes, manipulated system files
- Timestamp analysis – when was what changed, by whom (system user)
- Securing evidence – e.g., for legal disputes, legally admissible only by certified professionals
🔬 What Forensic System Does
Our tool Forensic System is designed precisely for these tasks – and is also usable by private users. It finds what standard recovery tools overlook, analyzes suspicious files, and provides an honest assessment of what is still present on the data carrier.
DIY or Professional?
There are clear differences between performing file recovery at home and using a professional – and no single universally correct answer.
🏠 At Home
- ✅ Ready to start immediately, no shipping needed
- ✅ Low cost (often < €100)
- ✅ Data remains in your hands
- ✅ Often successful with logical errors
- ⚠️ Risk of making things worse through DIY attempts
- ⚠️ No cleanroom available for hardware defects
👨🔬 To a Professional
- ✅ Cleanroom Lab & Special Equipment
- ✅ High Success Rate even with Mechanical Defects
- ✅ Reliable Diagnosis in Advance
- ⚠️ High Costs (€200 to €4,000+)
- ⚠️ Waiting Time of Days to Weeks
- ⚠️ Data Temporarily Out of Your Hands
Rule of Thumb
- Logical error + data that can still live for a few hours without urgency: Try it yourself with good recovery software
- Hardware defect (clicking, burning smell, drop): Go to a professional immediately, do not start again
- Data of highest value (wedding photos, tax records, business): Go directly to a professional, no self-attempts
- Self-attempt failed: Call a professional before taking on deeper risks
Free vs. Paid Tools
There is a multitude of file recovery tools, both free and paid. Both have their justification:
Free Tools
Examples: TestDisk, PhotoRec, Recuva (Free), R-Linux. These tools are often surprisingly powerful and completely sufficient for simple cases (accidentally deleted, recycle bin emptied).
- ✅ Free, immediately available
- ✅ Open Source for some (TestDisk, PhotoRec)
- ⚠️ Often technical, less user-friendly
- ⚠️ Limited support, no guarantees
- ⚠️ Poor performance in complex cases
Paid Tools
Advantages: Better success rate, easier operation, support. Our software Rescue Stick and Forensic System also belong to this category.
- ✅ Higher success rate, especially in complex cases
- ✅ User-friendly, often with a wizard
- ✅ Support & Updates
- ✅ Additional features (boot medium, forensics)
- ⚠️ One-time costs (often €30–€100)
💡 Practical Tip: For simple cases, try the free version first. If that's not enough, investing in a paid tool is worthwhile – still cheaper than professional data recovery.
The right software for your recovery
Rescue Stick as a boot medium for quick recovery. Forensic System for deep analysis when other tools give up.