How to Recover Deleted Files on Windows 10 and 11

Quick Answer
Check the Recycle Bin first. If it is empty, try these in order:

Recycle Bin → right-click file → Restore
Previous Versions → right-click the original folder → Properties → Previous Versions
File History → Control Panel → File History → Restore personal files
OneDrive → onedrive.live.com → Recycle Bin → Restore (30-day window)
No backup? → Use winfr (Windows File Recovery) via Command Prompt or Recuva (free)

Problem Summary

When you delete a file on Windows — whether with the Delete key or Shift+Delete — the file is not immediately erased from disk. Windows removes the file's entry from the Master File Table (MFT) and marks that disk space as available. The actual file data remains on the drive until new data overwrites it.

Recovery is often possible if you act quickly and avoid writing new data to the drive.

How Windows Deletion Works

Understanding this helps you choose the right recovery method and avoid common mistakes.

NTFS (Windows default): Windows marks the MFT entry as free. File data stays on disk until overwritten.

SSD with TRIM enabled: The drive firmware actively zeros deleted blocks in the background, often within minutes. Recovery on SSDs is significantly harder and time-sensitive.

Symptoms

• File is missing from its original folder
• Recycle Bin is empty
• "File not found" error when opening a saved path
• Folder appears empty after a crash, reset, or power loss
• Drive shows as RAW or Windows prompts "You need to format the disk"
• Files missing after Windows Update, system restore, or OS reinstall

Common Causes

1. Accidental deletion — Shift+Delete or emptying the Recycle Bin without checking its contents
2. Drive formatting — Quick Format removes the file table; Full Format overwrites sectors
3. File system corruption — Caused by sudden power loss, bad sectors, or improper ejection of external drives
4. Ransomware or malware — Files encrypted or deleted by malicious software
5. Windows reset or OS reinstall — System partition wiped; user files on the same partition lost

Before You Start

Warnings

• Do not save anything to the drive where files were lost
• Do not install recovery software on the affected drive — use a separate USB or second drive
• Do not run CHKDSK on a RAW drive — it can make recovery harder
• Do not click "Format disk" if Windows prompts you on the affected drive

Requirements

• Administrator access to your Windows account
• A second drive, USB, or separate partition to save recovered files to
• For winfr: Windows 10 version 2004 (May 2020 Update) or later

Check These Before Using Any Tool

• Recycle Bin on the desktop
• OneDrive Recycle Bin at onedrive.live.com (if files were synced)
• File History → Control Panel → File History → Restore personal files
• Previous Versions → right-click the original folder → Properties → Previous Versions tab

Step-by-Step Solutions

Fix 1 — Restore from Recycle Bin (Easiest)

Why it works: Files deleted with the Delete key are moved to the Recycle Bin, not erased. They stay there until the bin is manually emptied.

Steps:

1. Double-click Recycle Bin on the desktop
2. Find your file — use the search bar if needed
3. Right-click the file → Restore

Expected result: File returns to its original folder path immediately.

Fix 2 — Restore Previous Versions (Medium)

Why it works: Windows creates shadow copies of files and folders automatically when System Protection is enabled. These snapshots are stored independently of the live file.

Steps:

1. Navigate to the folder where the file was stored
2. Right-click the folder → Properties
3. Click the Previous Versions tab
4. Select a version dated before the deletion
5. Click Open to confirm your file is present, then click Restore

Expected result: File restored to its state at the selected snapshot date.

Fix 3 — File History Recovery (Medium)

Why it works: File History continuously backs up files in Libraries, Desktop, Contacts, and Favorites to a connected external drive or network location — when configured.

Steps:

1. Open Control Panel → File History
2. Click Restore personal files
3. Navigate to the folder containing the deleted file
4. Use the left/right arrows to browse backup dates
5. Select the version you need and click the green Restore button

Expected result: File is restored to its original location from the backup copy.

Fix 4 — OneDrive Recovery (Medium)

Why it works: OneDrive retains deleted files in its own Recycle Bin for up to 30 days. For ransomware or mass deletion, you can roll back your entire OneDrive to a point before the damage occurred.

Steps:

1. Go to onedrive.live.com and sign in
2. Click Recycle Bin in the left sidebar
3. Select the file and click Restore

For ransomware or mass deletion:

1. Click the gear icon → Options
2. Click Restore your OneDrive
3. Select a point in time before the damage and click Restore

Expected result: Files restored to their synced folders on your PC.

Fix 5 — Windows File Recovery / winfr (Advanced)

Why it works: winfr is Microsoft's official command-line recovery tool. It scans raw disk sectors for file signatures and MFT remnants, recovering files that are no longer listed in the file system.

Requirement: Install Windows File Recovery free from the Microsoft Store. Run Command Prompt as Administrator.

Recovery Modes:

Steps:

1. Open Command Prompt as Administrator
2. Run the appropriate command (see CMD Reference section below)
3. Wait for the scan to complete — do not interrupt it
4. Recovered files appear in the destination folder you specified

Expected result: Recovered files saved to your destination drive, organized by type.

Fix 6 — CHKDSK for File System Errors (Advanced)

Why it works: CHKDSK repairs logical file system errors that make files inaccessible. Use this when a drive appears corrupt but the data should still be physically intact.

Steps:

1. Open Command Prompt as Administrator

Flag reference:

• /f — fixes file system errors
• /r — locates bad sectors and recovers readable data

Expected result: File system errors repaired; previously inaccessible files become readable.

CMD / PowerShell Commands Reference

Hidden file recovery — common after malware infection:

Replace D: with your affected drive letter.

Alternative Solutions — Third-Party Recovery Tools

Use these when built-in tools fail. Always install the recovery software on a different drive than the one you are recovering from.

Recommended Workflow

1. Install the recovery tool on a USB drive or separate partition — never on the affected drive
2. Run a deep or full scan of the affected drive
3. Preview files before restoring to confirm they are intact
4. Save recovered files to a separate drive — never back to the source drive

HDD vs SSD — Recovery Expectations

Formatted Drive Recovery

After Quick Format

• File table was reset; data sectors are largely intact
• Use Disk Drill, EaseUS, or Stellar in deep scan mode
• Recovery rate is good if no new data has been written

After Full Format

• Sectors were overwritten during format
• Recovery is significantly less reliable
• Use Signature-based scan: winfr /signature or PhotoRec

Drive Showing as RAW

1. Do not format when prompted
2. Do not run CHKDSK on a RAW drive
3. Use TestDisk to scan for lost partition headers
4. If TestDisk finds the partition, write the corrected partition table
5. Verify the drive is accessible, then copy data off to a safe location

Ransomware File Recovery

1. Disconnect the infected machine from the network immediately
2. Do not pay the ransom — payment does not guarantee decryption
3. Check nomoreransom.org for a free decryptor for your ransomware variant
4. If OneDrive was synced, use Restore your OneDrive to roll back to a pre-attack state
5. If a backup exists, wipe the drive and restore from backup after removing the malware

Verification — Confirm the File Is Intact

• Open the recovered file and check all content is present and readable
• Check file size — a 0 KB result means recovery failed for that file
• For documents: scroll through the full file to check for truncation or corruption
• For images or video: open and play fully to confirm no data is missing
• Run a hash check if file integrity is critical:

Prevention Tips

1. Enable File History — Settings → Update & Security → Backup → Add a drive
2. Enable System Protection — Control Panel → System → System Protection → Configure → Turn on
3. Use OneDrive or Google Drive — active documents get automatic version history
4. Follow the 3-2-1 backup rule — 3 copies of data, on 2 different media types, with 1 copy offsite
5. Monitor drive health — use CrystalDiskInfo (free) to detect failing drives early
6. Avoid Shift+Delete — use the standard Delete key so files go to the Recycle Bin
7. Run periodic scans — chkdsk C: /scan catches file system errors before they cause data loss