You emptied the Recycle Bin — here is what still helps

Emptying the Recycle Bin does not erase your files. It deletes Windows’ map to them. That difference is the reason recovery is often possible at all — and it is also why the next few minutes decide more than the tool you end up choosing.

Do this before anything else: stop saving, downloading, copying and installing on that drive. Every new file can land on exactly the sectors your deleted file still occupies. This page is ordered so that the safest steps come first — follow it top to bottom.

What emptying the Recycle Bin actually does

On an NTFS volume a file is two things: a record in the master file table (the MFT) that says “these bytes form report.xlsx, they start at cluster X”, and the clusters themselves — physically somewhere on the platter or the NAND.

Moving a file to the Recycle Bin touches neither. Windows renames the record and files it into a hidden folder called $Recycle.Bin at the root of each drive. Nothing is lost, which is why restoring from the bin is instant and exact.

Emptying the bin is different. Windows removes those MFT records and hands the clusters back to the free-space pool. The bytes are still physically there; they are simply no longer claimed by anything, and the operating system is now free to give those exact clusters to the next file that asks for them.

So there are two separate failures, and it is worth keeping them apart:

• The map is gone. This is recoverable. Recovery software walks the raw volume, recognises file signatures and directory leftovers, and rebuilds a map — usually with the original filename intact on NTFS, sometimes only with a generated name if the record itself was damaged.
• The bytes are overwritten. This is not recoverable. Not by software, not by anybody, at any price. The moment new data lands on those clusters, what was there before stops existing.

Everything below is really about one thing: keeping the second case from happening while you work on the first.

Rule number one: stop writing to that drive

If you read one section, read this one. Your odds are mostly decided in the first fifteen minutes, and nothing you install afterwards can undo a careless write.

Do this now

• Stop saving, downloading, copying and printing. Close the browser if you can — its cache alone writes megabytes a minute.
• Decide where recovered files will go: a USB stick, an external disk, another machine, a cloud upload. Never back onto the drive you are rescuing from.
• If the files were on the system drive (usually C:), understand that Windows itself writes constantly — page file, hibernation file, telemetry, OneDrive sync, Windows Update downloads, search index. An idle desktop is not an idle disk.
• If the data is genuinely irreplaceable, shut the PC down properly and restart it from another disk or a rescue USB. That one decision is worth more than any tool you can buy.

Don’t do this

• Don’t install recovery software onto the affected drive. It is the most common way people lose their own files. Use a portable build copied onto a different disk, or install it on a second PC and scan the drive from there.
• Don’t run Disk Cleanup, Optimize / Defragment, or chkdsk /f. These are repair tools; they write to the very metadata you are trying to read.
• Don’t format “because Windows asked”. If the drive has since started showing errors, formatting turns a difficult case into an impossible one.
• Don’t tidy up the surviving files by dragging them into another folder on the same partition. Every move is a write.

Two-minute checks before you scan anything

Roughly a third of the people who reach this page do not need recovery software at all — they need to look in the right second place. Work through these first: they cost nothing and they write nothing.

1. Another Recycle Bin. Every drive has its own hidden $Recycle.Bin, and every Windows user gets one too. If the file came from a second drive, or was deleted under another account, it may still be sitting intact.
2. The same file through a cloud service. If the folder lived inside OneDrive, Google Drive or Dropbox, your file very likely has a second life in that service’s own trash or version history. Consumer accounts typically keep deleted items for somewhere around 30 days before permanent deletion — check the service itself rather than trusting the number. This is the most common two-minute win on the list, which is why it sits ahead of every tool.
3. Previous Versions. Right-click the folder the file was in → Properties → Previous Versions. If System Protection was enabled before you deleted anything, older copies of that folder may be listed, and they can be opened or copied out with no software at all.
4. File History or Windows Backup. If either was ever switched on, restore from there instead of scanning: a backup gives you the file intact, a scan may hand you fragments.
5. The copies you forgot exist. Office auto-recovery files, temporary folders, the copy you emailed to a colleague, the version still sitting in a chat application’s download cache. Before fighting for the deleted copy, check whether another one is alive.
6. Write the facts down. Exact filename, full folder path, drive letter, roughly when it was deleted, and how — emptied bin, Shift+Delete, format, or “it just vanished”. You will need all five, and the fourth is the one that moves your odds most.

What Windows can do by itself

Three built-in paths, in ascending order of effort. The first two write nothing to the drive; the third is Microsoft’s own command-line recovery tool.

Restore previous versions

Properties → Previous Versions on the containing folder, or search Restore your files with File History from the Start menu. It only works if protection was already on before the deletion — plenty of machines ship with it disabled. Worth checking anyway, because when it works it is instant.

Windows File Recovery (winfr)

Published by Microsoft, free, installed from the Microsoft Store, run from an elevated Command Prompt. There is no graphical interface. Install it on a different disk from the one you are recovering from, or you will overwrite exactly what you came for.

winfr C: D: /regular /n \Users\your-name\Documents\report.xlsx
winfr C: D: /extensive /n *.jpg
winfr E: D: /extensive /n \Photos\2025\*

The order is always source first, destination second, and the destination must be another drive. Two modes matter:

• /regular reads the NTFS file records and usually restores the original names and folder structure. Try this first on a healthy NTFS drive.
• /extensive works from file signatures. It finds data the metadata no longer describes, but recovered files generally lose their original names and come out grouped by type.

Two practical notes. Switch names have changed between versions, so run winfr /? and use whatever your copy prints. And there is no preview: everything is written out first and sorted afterwards, which means you need free space on the destination roughly equal to what you hope to recover.

SSD vs HDD: why the same mistake costs more on an SSD

This is the part most guides skip, and it is why two people can make the apparently identical mistake and get completely different results.

On a hard disk, deleted data simply sits where it is until something else is written on top. The odds fall slowly — mostly as you keep using the machine — and files deleted weeks ago still come back surprisingly often.

On an SSD there is an extra mechanism: TRIM. When blocks are freed, the operating system tells the drive “these pages are stale”, and the controller’s garbage collection may physically erase them the next time it gets a spare moment — often while the machine looks idle to you. Once a block has been erased, its contents are gone before you finish reading this sentence.

Two things make SSD recovery harder still:

• Encryption. On hardware-encrypted drives, and on any system where BitLocker or Device Encryption is on, discarding the key material for a block is enough to make its contents unreadable forever. Changing nothing else, that alone turns a recoverable case into a hopeless one.
• Wear levelling. The logical address written to is not the physical location used, so “nothing has been written there recently” is a far weaker assumption than it is on spinning rust.

In practice: on an SSD, speed matters more than software. Shut down, move the drive to another machine, or scan it read-only from a rescue USB — and treat anything more than a few hours old as a long shot.

How to judge a recovery tool before you pay

The tool matters less than the order you do things in. But among tools there is a real difference between those built for operators and those built for sales funnels, and four checks separate them.

1. Does it scan read-only? A recovery tool’s first job is not to touch the drive. Anything that wants to “repair”, “optimise” or “check” the disk before showing results should be closed.
2. Can it run from somewhere other than the affected drive? Portable builds and rescue media are not a luxury. Installing onto the disk you are recovering from is the single most damaging mistake described on this page.
3. Does it show you what it found before payment? A scan that reports nothing until a licence key is entered is asking you to buy a promise. Serious tools list filenames, sizes and previews first.
4. Is it honest about failure? “Recovers 100% of your files” is advertising. Real tools talk about file systems, partial recoveries, and cases where nothing comes back — because those cases exist.

Two smaller things worth checking: whether the licence covers your situation (plenty of tools are free for personal use only), and whether there is an actual refund policy rather than a contact form.

Free options genuinely work for the simpler cases — a signature-based tool such as PhotoRec will happily pull JPEGs off a formatted card, usually without the original filenames. What free tools rarely give you is a defensible order of operations, and that is the thing deciding the outcome when the case is not simple.

Realistic odds by scenario

A recovery checklist, in the right order

Print it, or keep this page open on a phone — not on the affected machine.

1. Stop writing. Close everything that saves automatically.
2. Write down: filename, folder, drive letter, approximate time, how it was deleted.
3. Check the cloud service’s trash and version history first.
4. Check Previous Versions, File History, and any backup.
5. Choose your destination: a different physical disk.
6. If the data is irreplaceable, shut down and boot from a rescue USB instead.
7. Scan read-only, running from that other medium.
8. Recover to the other disk — nothing back onto the source.
9. Open the recovered files and check their real size before deleting anything.
10. Only once everything is verified elsewhere: re-enable TRIM if you disabled it, let updates run, carry on.
11. Afterwards, switch on File History or any backup you will actually leave running. Every case on this page is cheaper to prevent than to recover.