Something is missing: a folder, a spreadsheet, an object in a cloud bucket. Getting it back is a matter of order, and the order you work in decides how much returns. This guide to data recovery is for an IT manager or business owner in India or the GCC who needs to recover deleted files now. It covers where to look first, how to run backup and restore without making things worse, and how to prove the result. It also says when to stop and call a specialist.
Last reviewed 2026-11-02 by Manish Sharma.
Data Recovery in Plain Terms
Data recovery means getting back data that is lost, deleted, damaged or unreachable. IBM describes enterprise recovery in the same terms, and the idea covers everything from one deleted spreadsheet to a failed server.
Two kinds of loss need different handling. Logical loss means the drive still works while the data has disappeared or degraded: a deletion, a format, a corrupted file. Physical loss means the hardware itself has failed. This guide covers the logical side and says where physical loss begins.
Time matters because of how deletion works. Wikipedia notes that a deleted file can stay on the disk until the system reuses its space. Every new write is a chance to overwrite the deleted files you hope to recover. For the full list of ways data goes missing, see how business data gets lost.
The First Hour of Data Recovery: Stop, Scope, Tell
Start with the steps that protect whatever remains. Work through them in order.
Stop writing to the affected drive, share or bucket. Pause sync clients and clean-up jobs that could delete or overwrite more.
Write down what is missing, such as the deleted files you need to recover, and where it lived, when anyone last saw it in good shape and who changed it, if known.
Name the likely cause in one word (deletion, overwrite, corruption, failed hardware, suspected attack). The word only chooses your route.
Tell the data owner before restoring anything, and the security contact if an attack is possible.
Decide where the recovered data will land. It goes to a different drive or folder from the original.
If an attack is possible, pause here. The runbook in how to prevent ransomware covers the response, and why restores fail after an attack explains what goes wrong. This guide does not repeat either.
Where to Recover Deleted Files First, by Where They Lived
To recover deleted files, try the nearest and most recent source first: the platform’s recycle bin or trash, then version history, then a snapshot or backup, then recovery software, then a lab. This is Signisys’ working order, not a standard. Which data recovery route fits depends on where the data lived, so the table starts there.
| Where the data lived | First place to look | Caution |
|---|---|---|
| Windows PC | The Recycle Bin, then Windows File Recovery if the bin is empty. | Using the PC after a deletion can overwrite data, especially on an SSD, according to Microsoft Support. |
| File server or network share | Ask the backup owner which copy covers this share and how old it is. | A copy that is older than the loss date may miss recent work. |
| SharePoint or OneDrive in Microsoft 365 | In SharePoint, the site recycle bin, then the second-stage bin; check Microsoft’s OneDrive help pages for OneDrive. | Items stay for a limited time, so check the date. |
| Amazon S3 | Earlier versions of the object, if versioning was on. | If versioning was off, only a separate backup can help. |
Key Takeaway Start with the nearest source for where the data lived, and move outward only when it comes up empty.
Recover Deleted Files on a Windows PC
To recover deleted files on a PC, check the Recycle Bin first. If the file is not there, Microsoft Support describes Windows File Recovery, a command-line app from the Microsoft Store. Microsoft Support lists cloud storage and network file shares as unsupported, so the app only helps for local drives.
The source and destination drives must be different. Microsoft describes Regular mode as the standard option for non-corrupted NTFS drives, and Extensive mode as the thorough option for all file systems. In practice, try Regular for a recent deletion and move to Extensive for older deletions, formatted disks or FAT and exFAT drives. Microsoft also advises using the computer as little as possible, since any use can write over free space.
Send recovered files to a different drive or folder, so a failed attempt leaves the original untouched.
Data Recovery in SharePoint and OneDrive
Microsoft 365 uses a two-stage recycle bin. A deleted item lands in the site’s first-stage bin, and deleting it from there moves it to the site collection bin. Microsoft says SharePoint Online keeps deleted items for 93 days from deletion from the original location, as of November 2026. If the item has left both bins, an administrator can ask Microsoft Support to restore the whole site collection from a backup kept for 14 more days beyond deletion. That restore applies to the site collection only, not to single files, so it is a last resort. The steps are on Microsoft’s page, restore deleted items from the site collection recycle bin.
S3 Recover Deleted Files With Versioning
In a versioning-enabled bucket, deleting an object adds a delete marker instead of removing the object. An overwrite creates a new version, and the earlier one remains. AWS documents this in Amazon S3 Versioning, and says you can restore the previous version.
A bucket starts with versioning off, and you switch it on yourself. A bucket without versioning has no earlier versions to fall back on, so recovery there depends on a separate backup.
Backup and Restore: Choose the Copy, Then Restore Safely
Pick the newest copy from before the loss, not simply the newest copy. A copy made after the deletion or corruption holds the problem too. Compare each copy’s date with the time you wrote down in the first hour.
Then restore with care. These habits keep a bad day from getting worse:
- Restore to a different location first, not over the live data.
- Restore only what you need, not the whole share.
- Leave the damaged original untouched until the checks in the next section pass.
- If a drive is failing, make an image of it and work on the image. Wikipedia notes that an image gives a second copy to test recovery on without harming the source.
Put four questions to whoever owns backup and restore. Which copy covers this data? How old is it? Who can run the restore? Has anyone tested a restore like this? If nobody can answer the last one, treat the first restore as a test and go slowly.
Choosing between copy types is its own decision, covered in which kind of copy to restore from. Keeping the copies safe from deletion is a separate topic; see protecting the copies themselves.
Key Takeaway Pick the newest copy from before the loss, and restore it somewhere other than the original.
Check Data Recovery Before You Call It Done
A backup and restore job that finishes without errors is not yet a recovery. Check the result against what you wrote down at the start, before users return to it.
| Check | What to do | If skipped |
|---|---|---|
| Files open | Open a sample of files in the programs that normally use them. | Otherwise, damaged files reach users unnoticed. |
| Count and size | Compare the restored count and size with the expected list. | If only part of a folder comes back, the gap may surface after users return. |
| Dates | Confirm modified dates fall before the loss. | A date after the loss means you restored the wrong copy. |
| Owner spot-check | Ask the data owner to review the files they know best. | For example, a missing tab in a finance workbook only the owner would spot. |
| Permissions | Confirm permissions and ownership match the original before reopening access. | Otherwise, the wrong people may see restored files. |
| Sign-off and record | Get the owner’s sign-off and write down what you restored, from which source, and when. | Without a record, the next incident starts from nothing. |
When Data Recovery Needs a Specialist
Some losses are beyond a careful administrator when the task is to recover deleted files, and an honest answer is better than a hopeful one. Call a specialist in these cases:
- The drive does not show up, or it makes unusual noises. In Signisys’ working view, that points to physical failure, and more attempts to power it up can add damage.
- The files were overwritten and nothing else holds them. Wikipedia notes that overwritten data on a hard drive is generally assumed to be unrecoverable.
- You suspect a breach. Security comes first, and a forensic or legal process may apply.
- Regulation applies to the data. Check your contract and the rules that apply to you before touching it.
If you use a recovery lab, ask how it assesses the drive and whether you can check the data before the lab delivers it. No one can promise a result in advance, so treat any promise of a result with caution.
What to Change After Data Recovery
Once the data is back, record the cause, the source you used and how long it took. Those three facts show what to fix.
Each system’s owner also sets two limits. IBM defines the recovery point objective as the age of the oldest backup you can tolerate, and the recovery time objective as the longest downtime you can afford. If this recovery missed either limit, change the backup and restore setup. To check a plan before the next loss, see scoring the plan you hold today. That guide shows how to score a written plan, and the use case Improve Backup Reliability and Stop Failures covers restore testing.
The review looks at where your data lives and whether you could restore it. It makes no recovery promise. See Recover from Data Loss, the Data Protection and Cyber Recovery solution and our cybersecurity services.
Frequently Asked Questions
Can You Recover Permanently Deleted Files?
What should I do first after deleting a file by mistake?
How do I recover deleted files from SharePoint or OneDrive?
Can I recover a deleted object from Amazon S3?
Should I use recovery software or a specialist service?
How do I know the restored data is complete?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.