Deleting a file removes the signpost to it, not the file itself, and the contents stay on the disk until a later save happens to land on top of them. Stop using the device quickly and, in most cases, we can recover what went missing from a hard drive, SSD, memory card or USB stick, all in-house.
The chance of recovery is lost as soon as new data is written to the space the deleted files occupied, and devices are rarely as idle as they look, with photos, saves and app updates writing away in the background. So write nothing new to it, don’t install recovery software onto it, and put the device aside until we have had a chance to look. Act quickly and far more survives.
Deleted data is still recoverable almost all of the time, and only a few specific things put it truly beyond reach. These are the cases we see most often.
Whatever the media and whoever made it, if your deleted files were on it, there is a very high likelihood that our team can recover them.
The disks inside laptops, PCs and Macs; hard drives and SSDs; external and portable units; and flash of all sorts — USB sticks, SD, microSD and CF.
Deleted-file recovery is copy-first and methodical. Your original device is never worked on directly: we copy it to an image and carry out each step on that image, in a set order.
Walk us through what was lost and from which device. We determine whether there is still data to recover and send a written quote, typically within 48 hours.
Before anything else, a forensic image of your device is created. Every step that follows is performed on that image, and nothing is ever written to your original.
The cleanest route is the file system’s own record-keeping. A delete simply frees the space: on NTFS, the $MFT record and its clusters in $Bitmap, and on FAT and exFAT, the directory entry and cluster chain. Wherever those records survive, we relink your deleted files complete with their names, folders and dates.
If the metadata has gone, we switch to carving: searching the raw image for the signatures each file format leaves, such as FF D8 to FF D9 for a JPEG, %PDF to %%EOF for a PDF, and a PK header for ZIP and Office files, and rebuilding files that have no index at all. File names and folders don’t survive this route and fragmentation makes it harder, so both methods are run and their results are merged.
Every file is tested before it goes back: signatures rechecked, images and documents opened, checksums compared, and carved output de-duplicated against the metadata pass so no file appears twice. What you receive opens properly instead of crumbling.
The final set is written to new storage media, organised and ready to use.
That media is then posted back to you, or the entire recovery can be downloaded free of charge for anything up to 75GB.
Every recovery is carried out from a forensic copy, whether it is deleted documents, photos, videos or emails from a hard drive, an SSD, an external unit, a USB stick or a memory card.
Tell us what you’ve lost and we’ll get back to you, usually within a working day.
We’ll be in touch shortly. If it’s urgent, call 01483 901310.
There are no hidden fees and no hard sell: a free diagnostic and a written quote come before any work starts.
A few recent deleted-file jobs across various devices. All identifying information has been removed, and every result was verified.
Nothing had been saved to the card since the deletion, so we imaged it and carved the JPEG and RAW frames back by their signatures, and almost all of the originals came back.
There is no recycle bin between you and a deletion on removable media, so it was instant, but the file table still knew where the files were stored and we were able to pull them back out whole.
After imaging the drive, we ran a deep scan that let us pull the entire folder and its contents back out before any of those clusters could be reused.
Simply send your device to us for a free diagnostic and describe briefly what happened. An engineer will review it and confirm your exact quote in writing before any work begins.
The first step to getting your data back is sending the device to us. Pack it safely, put your contact details inside the package and send it in. Once we have completed the free diagnostic, we will confirm the exact cost in writing before any work starts.
Sending it by post? We’d recommend a tracked, insured service. Dropping it in? No problem: Monday to Friday, 9am to 5:30pm. Please package the device as described above first.
Would you like more information first? Complete the form with further details about your issue, and one of our engineers will review it and send you a tailored quote.
We’ll be in touch shortly. If it’s urgent, call 01483 901310.
What people generally would like to know about recovering deleted files.
Generally yes. Consider a deletion of an item (file) as removing the entry in the index versus destroying the entire volume. When you delete a file under NTFS, the operating system essentially unlinks the $MFT (Master File Table) entry and allows the associated clusters in the Bitmap ($Bitmap) to be released while FAT & exFAT update the directory entry and allow the cluster chain to go but leave the actual contents intact. As long as those clusters haven’t been used again by a subsequent write, the contents are recoverable using some form of linkage to the remaining metadata or through “carving” them directly from the raw sectors. Continued usage is typically what terminates this potential, so turn the device OFF.
After this point treat the device as read only. Do not save any data to it. Do not shoot any additional photographs. Most importantly do NOT install recovery software onto the drive holding your lost data, as doing any of the above will risk overwriting the exact files you wish to recover. Once you’ve completed this task contact us and we’ll handle things from here.
Often; in fact, this is probably one of our most common jobs. If few new pictures have been shot on the card since, then they are likely still stored within flash memory and should be able to be pulled out by signature; JPEG images identify themselves with FF D8/FF D9 at both beginning & end of each file while camera RAW images also have unique identifiers. Even after a quick format or emptying of the card has occurred, since only the index has been cleared and not the image data itself, recovery may still be possible.
We are going to give you some honest advice: the chances of recovering your data are less likely than on a hard drive, stick or card. The reason for this is because of TRIM. On most internal SSDs when you delete a file the drive immediately gets a signal telling it to clean out that block and then its garbage collection does so in real-time (often in a matter of seconds), leaving no chance for carving. If TRIM has been turned off or you are dealing with an older SSD or a USB connected one which does not pass the TRIM command, then the recovery odds may be higher. The diagnostic provides a realistic picture of how much potential there may be for recovery prior to committing to any course of action.
Doubtful. When you empty the trash or recycle bin all you are doing is deleting the path to where the data resides. It takes physical overwrite of the location by new data for what was once stored there to actually disappear from existence. Simply stop using the storage device and there should be ample opportunity for successful recovery.
Anything with a storage unit in it; hard drives, SSDs and memory sticks for laptops, desktops and Macs, external storage devices, portable flash media and every type of removable media such as SD, microSD, CF cards. If your files reside on any of these devices, we can most likely assist with your needs.
As per our company policy regarding recovery fees, we have a tiered pricing model. For memory cards and USB sticks, we charge £250 + VAT. For hard drives, we charge £300 + VAT. Prior to commencing any work we will carry out a free diagnostic and provide you with written documentation as to our fees. In most cases you only pay if we recover your data. Since this form of data recovery is categorised as logical data recovery, it falls into the lower end of our pricing spectrum. Regardless of the cost, you will receive it in writing prior to commencement of work.
Most jobs take anywhere from one to three working days to complete, often quicker. However, in most cases we find that the diagnostic can be completed in less than 48 hours. If your job requires expediency please inform us at your earliest convenience, as well as provide us with a timeline for completion, and we will do what we can to speed things up.
All the large well-known suppliers of all types of storage devices are included. Such products include drives, like those produced by Seagate, Western Digital, Toshiba, Hitachi and Maxtor; and flash and SSD products produced by other companies (Samsung, SanDisk, Crucial, Kingston, Lexar, Sony, Transcend, Kioxia, ADATA, Corsair, PNY, Integral, Verbatim, Silicon Power & Team Group).
It’s easy. Just bring it into our Guildford premises during office hours Monday to Friday between 9am and 5:30pm or send it fully insured via the postal service. Please make sure it is properly packaged and include your contact details (name, address, phone number and email) so we can book in the drive for a free diagnostic. We will then send you a written quote and nothing will be done to your drive until you have accepted the quote.
Free diagnostics and deleted-file recovery from any type of storage device. In most cases you only pay if we recover your data. The quicker you stop using it, the more likely some files will come back.