Deleting a file is not the end of the world, but knowing how to act does make a difference. The first thing is to stop using the device immediately, identify whether it is an HDD or SSD, and then use software like PhotoRec or Recuva on a disk image, not on the original. On SSDs with TRIM enabled, common since Windows 10 and macOS High Sierra, files are often lost within minutes. On mechanical drives, SD cards, or USB flash drives, the chances of success are higher.
The science behind deletion: sectors and signatures 🧠
When you delete a file, the system only marks the sectors as available without erasing the data. This allows recovery software to search for known file signatures, such as JPEG or PDF headers, to reconstruct the content. On HDDs, data persists until overwritten, providing more leeway. On SSDs, the controller executes TRIM and cleans the cells in the background, reducing options to minutes. That is why creating a forensic image with dd or similar tools is key before scanning.
The drama of deletion and the false hope of TRIM 😅
Deleting a file is like hiding trash under the rug: technically it is still there, but if you have an SSD with TRIM, the system sweeps it away in a flash. That feature which extends the drive's lifespan is the same one that turns your lost photos into a distant memory. Meanwhile, on an HDD, the file continues to sleep peacefully until you decide to install Windows 11 for the third time. The moral of the story: if you deleted something important, pray you don't have a modern SSD.