Deleted the content of the recycle bin? Deleted the folder using shift-delete? Watched as someone else cleaned up the shared drive and deleted everything? Deletion does not remove your files. It merely removes a pointer to them. The files remain in the exact same place on the drive. They are now designated as reusable disk space. The recovery race begins immediately: it is a race against the next write to the drive. First rule: stop using this drive. Second rule: read this page.
The file system operates on the principle of being lazy when it comes to data elimination. When you delete a file, all that happens is that the file's directory entry (name, location, owner) gets erased and the space the file was using gets marked as available. However, if nothing has requested use of that space yet, the actual bytes remain intact until they are overwritten. Therefore, deleted-file recovery is dominated by the time frame since the files were deleted. If a hard drive is immediately removed from an active computer before anything else occurs, virtually all deleted files will likely recover. However, if a deleted file was removed from an actively used system and the user continued to download data, perform operating system updates or engage in web browsing for a week after the deletion occurred, then only a small percentage of previously deleted files would have been able to survive. Every action writes to the disk, even booting the machine, so the correct response to a serious deletion can feel out of proportion: power the machine down, get a quote first, by phone or with the form, and bring the drive in (no appointment needed, Monday to Friday, 9am to 5:30pm), rather than 'just quickly installing a recovery tool' onto the very disk holding your deleted files.
Deletions from network shares or NAS devices do not pass through a recycle bin and have an additional element to consider (whose deletion, when); the snapshot feature and our forensic services may be able to address this as part of recovery. In-camera and card deletions that occur on-device will go down the standard path, but will have an added rule regarding no new images being captured. As for the honest asterisk: modern SSDs are generally able to erase deleted content within minutes via TRIM. We’ll let you know during diagnostics whether your case has crossed over to the wrong side of that physics, rather than invoicing you for hope.
Strong, if you stop using your machine at this point: an hour of light usage will overwrite very little. Stop the machine. Jot down some approximate information about what is missing and where it came from. Get a quote first, either on the phone or using our form. Then send us the drive. Our recovery lists tell you exactly what data remains before you make any commitment.
Recovery first: for the most part, NAS deletions recover well when the volume comes in quickly. If a NAS device has enabled snapshots, then recovering from those is easy. The "who and when" issue is related to forensic data collection (timestamps, log files and access patterns). Yes, the forensic piece can travel along with recovery; at initial intake, please tell us that attribution is important.
There are two paths with two possible answers. If file system records still exist, then the data will recover with all original naming conventions, folder structures and date information available. However, if the original file system records have been lost and the files have to be carved from the raw content, then images may be restored completely, but without any specific name or structure. Images would be listed by date and grouped by camera based on metadata within each image where applicable.