The Short Answer: Often, Yes
One of the most common misconceptions about digital data is that deleting a file destroys it. In reality, deleted files can frequently be recovered from old devices, sometimes years after deletion, and often with nothing more than freely available software. This has positive implications if you’ve accidentally lost important files, but serious security implications if you’re disposing of a device that once held sensitive information.
Understanding what’s possible in data recovery helps you make better decisions about both protecting valuable data and properly destroying data you don’t want others to find.
How File Recovery Works
When your operating system “deletes” a file, it typically does two things: removes the file’s entry from the directory listing and marks the storage space as available for future use. The actual data, the ones and zeros that make up your file, remain on the storage medium until something new is written in that exact location.
Data recovery software works by scanning the storage medium directly, bypassing the operating system’s file directory. It looks for recognisable file patterns, known as file signatures or magic bytes, which are specific byte sequences at the start of different file types. A JPEG photo starts with a specific byte pattern. A PDF starts with “%PDF.” A Word document has its own signature. By identifying these patterns in “empty” space on the drive, recovery software can reconstruct files that the operating system no longer knows about.
More sophisticated recovery tools can also reconstruct files from partial data, piece together fragmented files stored across non-contiguous sectors, and recover files even when the file system itself has been damaged or reformatted.
What Can Be Recovered from Different Devices
Computers with traditional hard drives (HDDs). These offer the highest recovery success rates. Because HDDs don’t have TRIM or wear-levelling, deleted data persists until the exact sectors are overwritten. Recovery from HDDs is well-understood and highly reliable, with success rates often exceeding 90% for recently deleted files on drives with available space.
Computers with SSDs. Recovery from SSDs is significantly harder due to the TRIM command, which actively erases deleted data blocks in the background. If TRIM has processed the deleted blocks, recovery is effectively impossible. However, if TRIM is disabled (some external drives, certain configurations) or hasn’t yet processed the blocks, recovery may still be possible.
Smartphones. Modern smartphones encrypt all data by default, which means that even if deleted data persists on the storage, it’s encrypted and unreadable without the device’s encryption keys. A factory reset on a modern encrypted smartphone destroys the keys, making data recovery practically impossible through normal means. Older, unencrypted phones are more vulnerable to data recovery.
USB drives and memory cards. These flash storage devices generally don’t support TRIM, making them behave more like HDDs for recovery purposes. Deleted photos on an SD card from a camera can often be recovered successfully, sometimes years later, as long as the card hasn’t been heavily reused.
Tablets. Similar to smartphones, modern tablets encrypt data by default. A properly performed factory reset on a modern tablet is generally secure. Older tablets without encryption may be vulnerable to recovery.
Professional vs Consumer Recovery
Consumer-grade recovery software (Recuva, PhotoRec, Disk Drill, and others) is effective at recovering files from drives where the data is intact but the file system entries have been removed. These tools typically cost nothing to low cost and require no special hardware. They work well for accidental deletions and basic recovery scenarios.
Professional data recovery services go further. They can recover data from physically damaged drives (including drives with head crashes, motor failures, or fire/water damage), reconstruct data from partially overwritten sectors, and use specialised equipment to read weakened magnetic signals that consumer tools can’t detect. Professional recovery services typically cost $500-$3,000 or more and are used for high-value recovery situations.
Forensic recovery used by law enforcement and corporate investigators employs the most advanced techniques and can potentially recover data that both consumer and standard professional tools would miss. Forensic tools can analyse individual storage sectors, recover file fragments, reconstruct timelines of file creation and deletion, and extract data from damaged or corrupted storage media.
What Makes Recovery Harder
Several factors reduce the likelihood of successful data recovery:
Time and continued use. The longer a drive is used after deletion, the more likely that new data has overwritten the deleted files. A drive that’s been in active daily use for months after deletion will have fewer recoverable files than one that was powered off immediately after deletion.
Encryption. If the drive was encrypted before files were deleted, recovered data is useless without the encryption key. This is why encryption is such an important baseline security measure.
Secure wiping. Tools that perform proper data sanitisation by overwriting data with random patterns or performing cryptographic erasure make recovery impossible through any practical means.
Physical destruction. Shredding, degaussing, or otherwise physically destroying the storage medium eliminates any possibility of data recovery.
The Security Implication
If you’re disposing of a device, the recoverability of deleted data is a security risk. Whoever ends up with your old hard drive, whether through a second-hand sale, donation, or even from a recycling stream, potentially has access to your deleted files.
For personal devices, the risk includes identity theft from recovered financial documents, privacy violations from recovered photos and messages, and account compromise from recovered credentials.
For business devices, the risks are even more serious: regulatory violations from exposed customer data, competitive harm from recovered business documents, and potential legal liability from data breaches traced to improperly disposed equipment.
The gap between what people assume happens when they delete files and what actually happens creates one of the most common data security vulnerabilities in device disposal. Closing that gap starts with understanding that deletion is not destruction, and acting accordingly when devices reach end of life.
EWV helps Victorian businesses manage e-waste and IT asset disposal compliantly and sustainably — including collection, certified data destruction, and recycling. Contact us for a free quote.