First move: If a file disappeared from a Windows PC, stop saving new files to the affected drive. Check Recycle Bin and your backups, then choose a recovery path. Deleted data may remain on the drive until its space is reused; installing tools, downloading files, or continuing normal work can reduce the chance of recovery.
This is why the first search for a recovery app can make matters worse. The tool itself may need to be installed, and the operating system continues writing temporary data in the background. If the file is valuable or the drive is making unusual noises, disconnect it safely and consider professional help before experimenting. Recovery software can sometimes restore a recently deleted file, but it cannot guarantee recovery after the data has been overwritten or a storage device has failed.
Start with the low-risk places
| Where the file was | Check first | Why |
|---|---|---|
| Desktop, Documents, Pictures | Recycle Bin and the original folder | The file may have been moved, renamed, or deleted normally |
| OneDrive-synced folder | OneDrive recycle bin and version history | Cloud deletion and prior versions have separate recovery paths |
| External drive or USB stick | Recycle Bin may not apply; check another backup copy | Removable-drive deletion behaves differently depending on how it was removed |
| Shared work folder | Organisation’s recycle/version history and IT administrator | Retention and recovery may be managed centrally |
| Important business or legal records | Stop using the source and contact IT or a recovery professional | Uncontrolled attempts can change evidence or reduce recovery odds |
Do not empty the Recycle Bin or run a disk-cleaning utility while you are investigating. If the missing item was in a synced folder, also check whether the deletion was synchronised to other devices; the cloud provider’s recycle bin may still contain it, but sync alone is not a full independent backup.
Why “stop using the drive” matters
When Windows deletes a file, it can mark the file’s space as available for reuse. The data may remain physically present for a time, but new writes can overwrite it. Browsing the web, installing software, downloading a recovery app, or copying files to the same drive may create new writes. Microsoft’s guidance specifically advises minimising or avoiding computer use when trying to recover a deleted local file.
On SSDs, recovery may be even less predictable because storage maintenance can clear discarded blocks. Do not promise yourself that a file will be recoverable merely because it was deleted recently. If the drive is failing, disconnecting and reconnecting it repeatedly can also worsen the situation. For a high-value file, the safest next step may be to power down and ask a qualified recovery provider rather than run a scan.
Windows File Recovery: what it can and cannot do
Microsoft offers Windows File Recovery, a command-line app from the Microsoft Store, for files deleted from local storage devices that cannot be restored from the Recycle Bin. Microsoft says it does not support recovery from cloud storage or network file shares. Check those services’ own recovery tools instead.
The tool uses a source drive and a different destination drive. Do not save recovered files back to the same drive you are scanning. If your laptop has only one internal drive, connect a separate external drive and use it as the destination. Microsoft warns not to create a new partition after file loss, because this can reduce the chance of success.
| Situation | Microsoft’s suggested mode | Practical note |
|---|---|---|
| Recently deleted from a healthy NTFS drive | Regular | Start with a narrow file path or file-type filter |
| Deleted a while ago from NTFS | Extensive | Can take longer; results may include extra files |
| Formatted or corrupted NTFS drive | Extensive | If the disk is physically failing, stop and seek expert help |
| FAT or exFAT media, such as some cards or USB drives | Extensive | Confirm the drive’s file system in Properties |
A cautious recovery sequence
- Identify the source drive. Determine whether the missing file was on C:, another internal drive, or removable media. If you are unsure, do not guess in a recovery command.
- Check backups and cloud history. This is usually safer than scanning the original drive. Look for File History, OneDrive version history, another backup disk, or a managed work backup.
- Prepare a different destination. Connect an external drive with enough free space. Verify its drive letter in File Explorer so recovery results do not go to the source by mistake.
- Use only Microsoft’s official app. If Windows File Recovery is appropriate, install it from Microsoft Store. If the file is extremely valuable and stored on the same Windows drive, even installing the tool can create writes; consider using a different computer or a recovery specialist.
- Start with a narrow filter. Microsoft’s command format is
winfr source-drive: destination-drive: [/mode] [/switches]. Use the official examples for the path and file type you need. A targeted search is easier to review than recovering every possible file. - Save recovered files to the other drive. Microsoft creates a recovery folder on the destination drive. Open the results and check that the file is readable before making another copy.
- Stop if the disk behaves abnormally. Clicking, repeated disconnects, SMART warnings, or read errors are reasons not to keep scanning. A long scan can add stress to a failing drive.
Do not copy a command from a random forum without checking the source drive, destination drive, path, and mode. A mistyped destination can fill the wrong disk or overwrite something. Microsoft’s support page explains the command switches and provides examples; follow the current instructions for the exact file system.
How to interpret a failed scan
A scan that finds nothing does not prove the file never existed. It may have been overwritten, trimmed, stored in a cloud folder, excluded by a filter, or located on a file system the selected mode did not cover. Conversely, a filename in the results does not guarantee that the recovered content is complete. Open the recovered copy from the destination drive and check its contents.
If Regular mode finds nothing on a healthy NTFS drive, Microsoft says you can try Extensive mode. Do not repeat scans indefinitely on a drive that is producing errors. When the data is valuable, preserve the current state and get professional advice.
After recovery: fix the gap that caused the panic
Once the file is safe, set up a backup that can restore previous versions. Windows File History can back up personal folders to an external drive or network location. A backup is only useful if it includes the folders you care about and you have tested a restore. Keep at least one copy disconnected when it is not being used; ransomware can target backups that remain writable and attached.
Our earlier backup guide explains how to plan a restore rather than merely copy files. The practical rule is simple: keep more than one copy, use more than one storage location or medium where possible, and test that you can open a restored file. File sync is convenient, but if a deletion propagates, sync alone may copy the mistake.
Bottom line
Check Recycle Bin, cloud history, and backups first. If the file is truly deleted, stop using the source drive, choose a recovery tool only when it fits the file system and risk, and save results to a different drive. Avoid cleaners, new partitions, and repeated scans on failing hardware. Recovery is never guaranteed; the reliable fix for next time is a backup you have actually restored from.
Sources
- Microsoft Support: Windows File Recovery
- Microsoft Support: Back up and restore with File History
- CISA: StopRansomware Guide
Windows File Recovery is a best-effort tool, not a guarantee. If the device is physically failing or the data is irreplaceable, stop using it and seek qualified recovery help.