How to recover deleted files on Windows and Mac (2026 complete guide)

You deleted a file, emptied the Recycle Bin, or pressed Shift+Delete out of habit — and now you need it back. Before you panic: on both Windows and Mac, a deleted file is almost never immediately and permanently gone. The directory entry is removed, but the actual bytes stay on the disk until another file overwrites them.

This guide covers every scenario in 2026: which native tools to try first, when to reach for recovery software, and what to do for USB sticks, SD cards and formatted drives. Methods are ranked by success rate measured across 160 recovery sessions.

Transparent affiliation. Save My Disk earns a commission if you purchase a license through the EaseUS links in this article. It does not affect the price or the editorial content: EaseUS is benchmarked under the same protocol as Recuva, Disk Drill, PhotoRec and Windows File Recovery in our public methodology.

1. Where do deleted files actually go?

Understanding what deletion really means is the key to acting fast.

On Windows: pressing Delete moves the file to the Recycle Bin — a hidden system folder on the same drive. The file stays there, intact, until you empty the Bin or the Bin reaches its auto-limit (5 % of the drive, by default). Shift+Delete skips the Bin entirely: Windows marks the clusters as free in the NTFS allocation table, but the data remains physically on disk until overwritten.

On Mac: the Trash works the same way for APFS and HFS+ volumes. Deleting moves the file to ~/.Trash. An optional "Remove items from Trash after 30 days" setting (Finder → Settings → Advanced) purges files automatically if enabled. As on Windows, "empty Trash" only removes the file's entry from the filesystem — the actual content persists until overwritten.

External drives, USB sticks, SD cards: files deleted from FAT32 or exFAT volumes (common on removable media) follow the same principle — the allocation entry is cleared, the data remains. Because these drives are often re-inserted and reused, the overwrite window is shorter. Unplug them immediately after deletion.

2. First steps: native recovery methods (no software required)

Recycle Bin (Windows)

1. Open the Recycle Bin from the desktop (or type recycle bin in Start).
2. Sort by Date deleted to locate the file.
3. Right-click → Restore. The file returns to its original folder.

Limits: the Bin is bypassed by Shift+Delete, and files deleted from USB/SD/network drives often do not go to the Bin.

Trash (Mac)

1. Click the Trash icon in the Dock.
2. Locate the file, right-click → Put Back.

Or drag it to the desktop. The file is restored without running any tool.

File History / Previous Versions (Windows)

If you had File History configured on an external drive:

1. Type file history in Windows search → Restore your files with File History.
2. Browse to the parent folder, use the arrows to select a snapshot before the deletion.
3. Click the green Restore button.

Alternatively: right-click the parent folder → Properties → Previous Versions tab. Windows lists snapshots from System Restore points.

Important: this only works if File History or System Restore was active before the loss. If not, move on.

Time Machine (Mac)

1. Connect the Time Machine backup drive (or rely on local APFS hourly snapshots, available since Big Sur).
2. Open Time Machine from the menu bar.
3. Navigate into the folder where the file lived, travel back using the timeline, click Restore.

Time Machine local snapshots exist for up to 24 hours even without an external backup drive — useful for same-day recovery.

3. Recovery software: when native methods aren't enough

When the Bin/Trash is empty and no backup exists, recovery software is your next option. These tools scan the unallocated disk space for file signatures and reconstruct files the OS has forgotten.

The golden rules before you start

1. Do not install the software on the affected drive. Every write reduces your chances. Download to a USB stick or a second drive.
2. Do not restore files to the source drive. This risks overwriting other recoverable data.
3. Act fast. On SSDs with TRIM, the window closes within seconds to hours (see Section 5).

EaseUS Data Recovery Wizard — recommended

EaseUS Data Recovery Wizard covers both Windows 11/10/8/7 and macOS Sonoma 14 / Sequoia 15 with the same interface:

1. Download EaseUS to a separate drive, install and launch.
2. Select the drive where the file was stored, click Scan.
3. Use the filter panel (type, date, size) to locate your file faster.
4. Preview the file before recovery to confirm it's intact.
5. Check the file(s), click Recover, choose a destination on a different drive.

Measured yield across our 160 sessions: 87 % average, 94 % on HDD under 24 h, 71 % on trimmed SSD. The deep scan mode adds 10-15 minutes per 100 GB but significantly improves results for older deletions or formatted volumes.

PhotoRec — free, CLI, last resort

PhotoRec from the TestDisk suite is open source and works on Windows, Mac and Linux. It reconstructs files by signature scanning without relying on the filesystem, making it useful when the partition table is destroyed.

Major limitation: PhotoRec discards all original filenames and folder structure — it dumps thousands of numbered files you must sort manually. For a casual user this is brutal. Reserve it for situations where EaseUS fails, or when you're comfortable at the command line.

4. Recovery by scenario

Different situations call for slightly different approaches. Identify your case below.

Scenario A — File accidentally deleted, Bin/Trash already emptied (HDD or SSD)

The most common scenario. Stop all disk activity immediately. Open EaseUS, run a quick scan first (5-10 min), then a deep scan if the file doesn't appear. On HDD: expected yield 87-94 % within 24 h. On SATA SSD: 50-71 % depending on TRIM timing. On NVMe SSD: scan within minutes of deletion for any meaningful chance.

Scenario B — File deleted on USB stick or SD card

Unplug the device now. Do not reformat, do not use the drive further. Run EaseUS targeting the removable volume — FAT32/exFAT recovery is well-supported. Measured yield on USB/SD: 82 % with EaseUS vs 58 % with PhotoRec. See also our external hard drive recovery guide.

Scenario C — Drive accidentally formatted

A quick format only erases the partition table — all file data remains until overwritten. Run EaseUS deep scan on the formatted volume. Expected yield: 78-89 % on quick format, 35-52 % on full (zero-write) format. Full guide: recover files after format.

Scenario D — Emptied Trash on Mac (APFS volume)

If the Mac uses an Apple Silicon chip, the internal SSD is hardware-encrypted by the Secure Enclave. Even without FileVault enabled, recovery software must run on that Mac — not from a second machine — because the decryption keys never leave the chip. Run EaseUS Data Recovery for Mac on the same machine where the files were stored. See the full guide: recover deleted files on Mac.

Scenario E — Windows Shift+Delete on NTFS HDD

The NTFS Master File Table entry is removed but clusters are not zeroed. EaseUS reconstructs the full folder hierarchy in most cases. On a lightly used drive under 24 h: 94 %. Between 1 and 7 days: 78 %. Beyond 7 days: scan anyway — passive drives recover at 60-70 % even after two weeks in our tests. See the dedicated guide: recover deleted files on Windows.

5. SSD and TRIM: the critical exception

Solid-state drives behave fundamentally differently from hard drives at deletion time.

When you delete a file on an SSD, the OS may immediately issue a TRIM command (Windows) or Deallocate (Mac APFS). This tells the SSD controller to pre-erase the freed blocks so future writes land on blank cells — improving performance, destroying your recovery window.

• NVMe SSD (Deallocate active): blocks can be physically erased in 70-95 seconds after deletion. Recovery after this point yields 15-40 % of blocks at best.
• SATA SSD (weekly TRIM via Windows Defrag): typical erase window is 4 to 7 days after deletion if the drive isn't aggressively used.
• SSD nearly full (> 85 %): the controller often defers TRIM/Deallocate to avoid write stalls — extending your window by hours or days.

Best practice: the instant you realize you deleted something on an SSD, power off the machine cleanly (not hibernate — full shutdown) to stop background TRIM cycles. Then scan from a bootable USB with EaseUS on a second PC, or at minimum stop all writes before launching the scan. Full technical details in our SSD data recovery with TRIM guide.

6. Windows vs Mac: key differences at a glance

On Windows, the winfr command-line tool (free, Microsoft Store) provides a decent baseline — 41-56 % yield in our tests — but its CLI ergonomics place it far below EaseUS for most users. See Windows File Recovery full guide for syntax and examples.

7. Common mistakes that kill your chances

• Continuing to use the drive. Every download, system update, cookie write, or antivirus scan can land on top of your file.
• Installing recovery software on the affected drive. Use a USB stick or second drive.
• Running chkdsk before recovery. chkdsk may fix filesystem inconsistencies by deleting "orphaned" clusters — exactly the data you want back. Run it only after recovery is complete.
• Reformatting "to fix the drive." Wait until you've recovered what you need.
• Running two scanners simultaneously. Each scanner opens the device in intensive read mode; concurrent access via Windows cache layers can trigger opportunistic writes.

8. Once you've recovered: prevent the next loss

The right time to set up a backup is right after surviving a scare — not before the next one.

The 3-2-1 rule remains the gold standard: 3 copies of the data, on 2 different media, with 1 stored off-site (cloud or physically remote external drive).

Practical implementation:

• Windows: File History to an external USB drive + OneDrive (or Backblaze) for cloud. Set it up in 10 minutes via Settings → Backup.
• Mac: Time Machine to an external APFS SSD + iCloud Drive or Backblaze for cloud. Local hourly snapshots are automatic as of Big Sur.

Full setup guide: Automatic backup for Windows and Mac 2026.

9. Frequently asked questions

Where do deleted files actually go?

On Windows, to the Recycle Bin. On Mac, to the Trash. In both cases the data stays on the drive intact until the Bin/Trash is emptied — and even after emptying, only the directory entry is erased. The actual bytes remain until a new file writes over them.

Can I recover a file deleted with Shift+Delete or Option+Delete?

Yes, in most cases. These shortcuts bypass the Bin/Trash but do not erase the data from disk. On HDD, measured recovery rates reach 87-94 % within 24 h. On SSD with TRIM, the window can be as short as seconds on NVMe — act immediately.

How long do I have to recover a deleted file?

No fixed deadline — every disk write reduces the chances. On a lightly used HDD: 7 to 30 days. On a SATA SSD: 4 to 7 days. On an NVMe SSD with Deallocate: sometimes 70-95 seconds for already-erased blocks.

Does the free version of EaseUS recover enough?

For small losses (a handful of documents or photos), the free 2 GB tier is often sufficient. For video files, large archives or full folder trees, the Pro license ($89.95) removes the cap and unlocks deep scan mode.

What if software fails — is lab recovery possible?

Yes. Professional labs (Ontrack, DriveSavers) use hardware-level read heads and cleanroom techniques for physically damaged drives. Prices in 2026: $300-$800 for logical HDD failures, $800-$2,400 for SSD controller failures, $1,200-$4,500 for encrypted enterprise NVMe. Always try software first — it solves 85 % of cases for $0-$99.

Should I run recovery software on Windows or Mac differently?

The workflow is nearly identical: download to a separate drive, scan the affected volume, preview before restoring to a different location. The key Mac-specific note: on Apple Silicon Macs, run EaseUS on the same machine because the Secure Enclave hardware-encryption keys never leave the chip.

Resources

• Microsoft — Restore files from the Recycle Bin
• Microsoft — Windows File Recovery (winfr)
• Apple — Restore items from the Trash on Mac
• Apple — Restore a previous version of a file with Time Machine
• CGSecurity — PhotoRec & TestDisk
• Zenodo dataset — 160 recovery sessions 2026