Deleted files rarely disappear the instant you hit the button. On phones, computers and cloud services, most items sit in a trash or recycle bin with a fixed expiry date. Once that window closes, a backup is the only dependable route. On modern solid-state drives, even specialist recovery tools often have little to work with, thanks to a storage command called TRIM.
- Cloud bins buy time: OneDrive, iCloud Drive, Google Drive and Google Photos usually keep deleted items for 30 days on personal accounts, with longer retention in some business setups.
- Backups beat recovery tools: Windows File History and macOS Time Machine restore earlier copies only if they were enabled before the loss.
- SSDs are different: TRIM lets drives erase freed blocks in the background, sharply reducing the chance of reconstructing deleted data.
Start with the cloud trash—and its deadlines
OneDrive keeps deleted files for 30 days on personal accounts and 93 days on work or school accounts, unless an administrator changes the policy. Files deleted only in the web interface do not appear in the PC’s recycle bin; they must be recovered from the web bin. iCloud Drive and iCloud Photos each offer 30 days. Deleting an item from iCloud Drive’s “Recently Deleted” folder removes it immediately, while iCloud.com can restore items deleted on any device with iCloud Drive enabled.
Google Drive and Google Photos also use 30-day bins. In Google Photos, deleting an image in the app also removes it from other devices using backup. On Android 11 or later, even photos that were never backed up spend 30 days in the trash. Once Google permanently deletes them, they cannot be recovered, not even through its Takeout export service.
Windows: File History first, winfr second
Windows’ File History automatically copies libraries such as Documents, Pictures, Videos, Music and Desktop to an external drive or network location, and it can restore earlier versions of a file. The obvious catch is that it only helps if it was switched on before the file disappeared.
Without a backup, Windows File Recovery is a command-line app for Windows 10 and 11, available from the Microsoft Store. It works on internal, external and USB drives, but not on network shares or cloud storage. The winfr command has two main modes: /regular for undamaged NTFS drives and recent deletions, and /extensive for older deletions, formatted or damaged disks, and non-NTFS media such as SD cards or small USB drives in FAT or exFAT.
A documented example, winfr C: E: /regular /n \Users\name\Documents\, searches Documents on drive C and writes results to drive E. The destination must differ from the source; with only one drive, Microsoft recommends an external one. Microsoft also warns against creating new partitions after data loss, which can reduce success.
macOS and the TRIM problem
On macOS, the official path is Time Machine. Open the window where the file used to be, enter Time Machine, move through the backup timeline and choose Restore. Many apps also allow File > Revert To > Browse All Versions. In the Apple documentation reviewed for this guide, recovery depends on Time Machine or iCloud; there is no official tool for rescuing deleted files without a copy.
The SSD caveat is technical. Deleting a file only marks its space as free; the data remains until something overwrites it, which is the gap recovery tools exploit. TRIM tells the drive which blocks are free so it can clean them on its own. In NTFS, Windows’ usual file system, TRIM is enabled by default. Microsoft’s Windows File Recovery page concedes that free space can be overwritten, “especially on a solid-state drive.”
The risk has been known in forensics for years. A 2010 study by Graeme B. Bell and Richard Boddington in the Journal of Digital Forensics, Security and Law showed that SSDs can destroy traditionally recoverable data on their own, without instructions from the computer. For a forensic examiner, that is a complication. For someone who deleted the wrong folder, it means the clock starts ticking immediately.
That does not make SSDs safe to pass on without care. Wear levelling can leave readable fragments in spare blocks that ordinary overwrite tools cannot reach, so resale or recycling still requires proper sanitisation. For recovery, stop using the affected device at once: every new file can occupy the space you are trying to rescue.
Recovery software is a rescue plan, not a strategy. Cloud sync is not a backup either; a deletion can propagate to every device, and version history or trash folders last only so long. The only recovery that works consistently is the copy made before disaster struck. A separate backup, tested for restore, is worth more than an afternoon spent wrestling with winfr.