Someone deleted important files: what can be recovered?

We deleted important files, can they be recovered?

Most of the time, yes. Work down this list in order and stop as soon as you find the file. The order is deliberate: each step is faster, cheaper and less risky than the one after it.

1. Stop working in that location. Do not save new files into the same folder, do not empty anything, and if the file was on a local disk, stop using that computer entirely. New data written to a disk is what makes deleted data unrecoverable.
2. Write down exactly what is missing. The file name, the folder path, roughly when it was last opened, who was working on it and whether it was deleted or overwritten. Those five facts decide which path works.
3. Check the recycle bin on the computer where the file lived, and on the server if it was a shared drive. Restore rather than drag out, so it goes back where it came from.
4. Check the cloud recycle bin. If the file was in OneDrive, SharePoint or Teams, look in the site or OneDrive recycle bin, then the second-stage recycle bin behind it. In Google Drive, look in Trash and in shared drive trash.
5. Check version history if the file still exists but the contents are wrong. This is the fix for overwritten files, and it is a completely different button from the one that restores deletions.
6. Check previous versions on the file server. Right-click the folder, choose Restore previous versions, and see whether a shadow copy exists from before the deletion.
7. Go to the backup. Whatever backup system you have, find the most recent copy that predates the deletion and restore to a scratch folder first, never over the top of live data.
8. Ask an administrator to look deeper. Microsoft 365 and Google Workspace both give administrators recovery options that end users cannot see, including restoring a whole library or a departed employee's files.
9. Only then consider specialist recovery, and only for a physically failed or wiped drive. It is slow and expensive, and it is a last resort.

If you would rather not work through that alone while people are waiting, call (214) 612-7080 and tell me where the file lived. That one answer usually shortens the list to two steps.

Why does acting fast change what you can get back?

Because every recovery path has a clock on it, and several of those clocks started the moment the file disappeared. Waiting a week to mention it can turn a five-minute restore into a permanent loss.

There are two separate reasons speed matters. The first is retention. Cloud services hold deleted items for a fixed period and then purge them for good. Backup systems keep a set number of days, weeks or monthly copies, and older ones roll off to make room. A file that vanished a month ago may already be past the point where anybody can produce it, even though nothing failed.

The second reason is overwriting. When a file is deleted from a local disk, the data is not scrubbed. The space it used is marked as available, and it survives until something else is written on top of it. A computer that is still running writes constantly: temporary files, browser cache, log entries, updates. So the honest guidance for a local deletion is uncomfortable but simple. Stop using that computer. Do not install recovery software on it, because installing software writes to the very disk you are trying to read.

There is a third clock in one specific case. When an employee leaves and their account is deleted, their mailbox and personal cloud storage are held for a limited period and then removed. If you deleted the account and now need something from it, that is urgent rather than routine. It is one of the reasons the order of operations in offboarding an employee who left with the laptop matters so much.

Where do you look first on a Windows computer?

Start with the recycle bin, then previous versions, then the file's own application history. Between them they cover the ordinary cases without anybody needing administrator rights.

• The recycle bin. Open it, sort by the date deleted, and use the search box in the corner if the list is long. Right-click and choose Restore so the file goes back to its original folder rather than to the desktop. Note that files deleted from a network drive normally do not land in the local recycle bin at all.
• Shift-deleted files. If someone held Shift while deleting, or emptied the bin, the file skipped the bin entirely. Move to the next options and stop writing to that disk.
• Previous versions. Right-click the folder the file was in, choose Properties, then the Previous Versions tab. If File History or a restore point exists, you will see snapshots you can open and copy out of. This is empty on a lot of business machines because nobody enabled it, which is worth fixing.
• Application recovery. Word, Excel and PowerPoint keep autorecover copies and an unsaved-documents area under File, then Info, then Manage Document. For a file that was never saved rather than deleted, this is the one that works.
• The temp folder. Office and many other programs leave working copies behind with odd names. It is a long shot, but it costs nothing to look.
• Search the whole machine. Sometimes the file is not deleted at all. Somebody saved it into a Downloads folder, dragged it into the wrong folder, or it is sitting in a sync folder that has not finished uploading.

That last one is more common than the rest combined. Before declaring a file lost, search the computer for part of the name and check the Recent Documents list in the application that made it.

How do you recover files from Microsoft 365?

Microsoft 365 gives you three separate recovery mechanisms, and people routinely try the wrong one. Deletions, overwrites and mass changes each have their own tool.

For a deleted file, open the recycle bin in the OneDrive or SharePoint site where it lived. Items normally stay there for 93 days by default. If it is not in the first recycle bin, a site collection administrator can look in the second-stage recycle bin, which holds items that were deleted from the first one for the remainder of that same window.

For an overwritten or damaged file, use version history instead. Right-click the file in SharePoint, OneDrive or Teams, choose Version history, and you can preview and restore an earlier version. Libraries keep a substantial number of versions by default, which means the version from before somebody pasted over the whole spreadsheet is almost certainly still there.

For a mass deletion or a ransomware-style event, Files Restore rolls an entire OneDrive or SharePoint library back to any point within the last 30 days. It is the right tool when hundreds of files changed at once and picking through them individually is hopeless.

Two administrator-only cases are worth knowing. When a user account is deleted, their OneDrive is retained for a limited period, 30 days by default, before it is removed, and an administrator can grant someone access to it during that window. And a deleted Microsoft 365 group or Teams team, along with its files, can normally be restored within 30 days.

The important caveat is that none of this is a backup. Microsoft keeps your tenant running and protects itself against its own failures. It does not keep an independent copy of your data past those retention windows, and a deletion that is discovered four months later is simply gone. That gap is why an independent backup of Microsoft 365 is part of managed backup and disaster recovery, and why the tenant settings behind these windows are worth reviewing alongside Microsoft 365 security for a small business.

How do you recover files from Google Drive?

Google Workspace works the same way in principle with different names and shorter windows, so check it in the same order: trash, then version history, then an administrator.

Trash holds deleted files for 30 days and then removes them automatically. Files in a shared drive go to that shared drive's trash rather than your personal one, which is where people usually fail to look. Restoring from trash puts the file back in its original folder.

Version history covers overwrites. In Docs, Sheets and Slides, use File, then Version history, then See version history, and you can name, preview and restore any earlier revision. For uploaded files such as PDFs and images, right-click and choose Manage versions. Google keeps revisions for a limited time and a limited count unless you mark a version to keep forever, so an old edit will not necessarily still be there.

An administrator can go further. From the Admin console, an administrator can restore files a user deleted from their trash for a limited period after the trash was emptied, commonly around 25 days, and can restore the Drive contents of a recently deleted user account. Both are time-limited, and both need somebody with admin rights, which is a good reason to know today who holds those credentials.

The same caveat applies as with Microsoft. Google keeps the service running; it is not a backup product. If a departed employee's account was deleted two months ago and nobody exported their Drive, that data is not coming back through support. Deciding who owns which files, and exporting a leaver's data before the account is removed, is part of a proper offboarding routine rather than an emergency.

What are shadow copies, and does your server have them?

Shadow copies are point-in-time snapshots that a Windows server takes of a shared folder, and they are the fastest recovery there is when they are turned on. Most small-business servers I look at either have them enabled and forgotten, or never had them at all.

When they are enabled, anyone can use them. Right-click the folder on the mapped drive, choose Properties, then Previous Versions, and you get a list of snapshots by date. Open one, find the file, and copy it out. No administrator, no restore job, no waiting. For an accidental deletion on a shared drive at eleven in the morning, this is usually the whole fix.

The limits matter. Snapshots are taken on a schedule, commonly twice a day, so you get back the version from the last snapshot, not the version from ten minutes ago. They consume a slice of the same disk, and when that space fills the oldest snapshots are dropped, which means the history is often shorter than people assume. And because they live on the same volume as the data, they do not survive a failed disk, a destroyed server or ransomware with administrator rights. Shadow copies are a convenience feature, not a backup.

If you have a file server and nobody can tell you whether shadow copies are on, that is a five-minute thing to check and a worthwhile one. Alongside it, check whether the server's data actually lives on a separate volume from its operating system, because that single design decision changes what a rebuild looks like. That is covered in what to do when the office server will not boot.

Where should you look, and how long do you have?

Match where the file lived to the row below. The windows are the common defaults; yours may have been changed, which is itself worth knowing before you need it.

The row that catches people is the last one on the physical devices. A NAS in the closet with no snapshots and no offsite copy has exactly one version of your data, and a deletion on it is immediate and final.

When is a file genuinely unrecoverable, and what does specialist recovery cost?

Some files really are gone, and I would rather tell you that on the phone than bill you to discover it. Being honest about which cases those are also tells you what to protect against.

• Overwritten local data. Once new data has been written on top of the old blocks, no tool recovers it. This is why continuing to use the computer is so damaging.
• Anything past its retention window. A cloud item purged after 93 days, a Google file gone from trash after the admin window, a backup that rolled off. Support cannot conjure it back, and asking repeatedly will not change the answer.
• Data on an encrypted drive with no key, including a BitLocker volume when nobody has the recovery key. The data is intact and permanently unreadable, which is somehow worse.
• Securely wiped or reformatted-and-reused drives, and most solid-state drives after deletion, because SSDs actively clear unused blocks in the background. Recovery from an SSD is markedly less likely than from an old spinning disk.
• Physically destroyed media beyond what a cleanroom can read, which does happen with fire, flood and severe head crashes.

Specialist recovery is the remaining option when a drive has failed physically but the data still exists on the platters. It is a laboratory service: the drive is opened in a clean environment, imaged, and reconstructed. It works surprisingly often, it takes days to weeks, and it costs many times what a year of proper backup would have cost. It is worth it for something irreplaceable and almost never worth it for anything else. I will refer you to a recovery lab when that is genuinely the right call, and I will tell you plainly when it is not.

How do you make the next deletion a non-event?

Design it so that losing a file is boring. That takes four things, and none of them are expensive at the size of a typical Dallas office.

1. Get files off local disks. Anything that only exists in somebody's Documents folder is one spilled coffee from gone. Work in OneDrive, SharePoint or a shared drive that is backed up, and make that the default rather than the exception.
2. Back up your cloud data independently. Microsoft 365 and Google Workspace protect their service, not your history. An independent backup of mailboxes, OneDrive, SharePoint and Teams gives you a copy that outlives the retention windows and survives a deleted account.
3. Keep one copy an attacker or a mistake cannot reach. Offline, offsite or immutable. A backup on a drive plugged into the server is a backup of convenience only.
4. Test a restore and write down the date. This is the step everybody skips and the only one that proves the other three work. Pick a random folder, restore it somewhere harmless, open a file, note that it worked.

Alongside those, two small habits prevent a good share of deletions in the first place: give people access only to the folders they actually need, so a mistake has a smaller blast radius, and stop using shared logins so you can tell who deleted what and when. Both are ordinary parts of how I set up managed IT for a small office, and both cost nothing but the decision.

If you are not sure whether your current backup would survive any of this, that is a short conversation and a useful one. Reach me through the contact page or on (214) 612-7080. If files are missing right now, say so when you call and we can start with the fastest path for wherever they lived. Emergency work runs through my hourly IT support at $100 per hour remote and $150 onsite during business hours, $150 and $225 after hours, with a one-hour minimum, and remote help is available around the clock.

Questions people ask

Written and reviewed by

Anthony Omini, founder of Cross River Tech

Over 15 years in IT across many industries, now running Cross River Tech, a small owner-led managed IT company in Dallas. Every article is written from his own client work and checked by him before it is published.

Files missing right now? Tell me where they lived and when they vanished. Call (214) 612-7080 and stop using the computer they were on.

Ask Anthony(214) 612-7080About Anthony