Often, but it depends on the storage and on elapsed time. Deleting a file usually removes the pointer rather than the content, so it survives until overwritten. On a traditional hard disk that can be weeks; on a solid-state drive the drive's own housekeeping may erase it permanently within hours.
Why deletion usually is not deletion
When a file is deleted, the file system marks the space it occupied as available and removes the entry pointing to it. The content itself is untouched. It stays there, intact and recoverable, until the operating system happens to reuse that space for something else.
That is why a forensic image captures every sector rather than every file — the recoverable material is precisely the part the file system says is empty.
The SSD exception, which is the important one
Solid-state drives behave differently, and the difference is decisive.
To write efficiently, SSDs need free space prepared in advance. Modern systems tell the drive which blocks are no longer in use, and the drive's controller erases them on its own schedule, in the background, with no user or operating system involvement. This runs whenever the drive has power.
The consequence is stark: deleted content on an SSD may be irrecoverable within hours, and the erasure happens whether or not anyone touches the machine. On a traditional hard disk the same content would likely still be there weeks later.
This is the single strongest argument for preserving a device immediately rather than after the weekend.
What survives even when the file does not
Even where content is gone, the record that it existed frequently is not. Examiners routinely reconstruct activity from artifacts that outlive the files:
- File system metadata recording names, sizes and timestamps of deleted entries.
- Link files and jump lists, which record documents that were opened, including from removable media that has since been disconnected.
- Registry and system logs, recording connected devices, installed applications and user activity.
- Thumbnail and preview caches, which regularly retain images of documents long after the originals are deleted.
- Backups, cloud sync and other devices, where a copy may never have been deleted at all.
In practice these are often more useful than the file itself, because they establish a sequence rather than a document.
Deliberate destruction leaves its own evidence
Wiping tools overwrite content so that recovery genuinely fails — but installing and running one leaves traces of the installation and execution, even when it succeeded at its job. Mass deletions produce a distinctive timestamp signature. A device reset before return is itself a recorded event.
So the answer to "can you recover what they deleted" is sometimes no, and the follow-up answer — that the deletion was deliberate, and when it happened — is frequently more valuable in litigation than the files would have been.
What to do
Stop using the device and have it imaged. Every hour of continued use writes to disk and reduces what is recoverable, and on an SSD every hour of power does so even without use. There is no version of this where waiting improves the outcome.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.