How to recover deleted files in Windows 11 and 10, step by step

Stop using the drive first

When Windows deletes a file, it does not wipe the data. It marks the space the file occupied as free, and the data stays there until something new is written over it. That is why Microsoft's own advice, before any recovery attempt, is to minimize or avoid using the computer: any activity can create files, and any new file can land on that free space.

Until you have the file back:

• Do not save, download or copy anything to that drive. That includes large downloads and files syncing down from the cloud.
• Close the programs you do not need. Browsers, chat apps and updaters all write to the disk in the background.
• Check OneDrive from your phone or another computer where you can, so the search itself does not write to the affected drive.
• Do not create, delete or resize partitions. Microsoft warns that creating a partition after losing data reduces the chance of recovering it.
• If the file matters a great deal and was on the system drive (usually C:), consider shutting the PC down and having the drive read from another computer, or by a professional, rather than working on it in place.

This caution protects the last-resort options, Windows File Recovery and a lab. It costs nothing to check the Recycle Bin, OneDrive and your backups first, because they hold full copies rather than leftovers.

Check that the file is deleted, not just missing

A file that seems lost is sometimes just saved somewhere unexpected. Microsoft's checklist for missing OneDrive files, adapted to a Windows PC:

1. Search the PC. Use the search box in File Explorer, and try part of the name or a word from the document.
2. Search OneDrive on the web. Sign in at onedrive.com and use Search everything. Microsoft recommends searching by description, tag, date or place as well as by file name.
3. Check the account. If you have a personal and a work account, or used someone else's PC, the file may be in another OneDrive. Sign in to the other account and search there.
4. Check the Personal Vault. Files in OneDrive's Personal Vault do not appear in search results until you unlock it.

One case you cannot fix yourself: if someone else shared a file with you and then deleted it, it is no longer available to you. Ask the owner, who can restore it from their own recycle bin.

Restore the file from the Recycle Bin

A file or folder you delete in File Explorer goes to the Recycle Bin rather than off the disk. Open Recycle Bin from the desktop, find the file, right-click it and select Restore. It returns to the folder it was deleted from, with its name.

If it is not there, one of these is usually the reason:

Storage Sense's clean-up is set in Settings > System > Storage > Storage Sense, under the option for deleting files that have been in the recycle bin for a chosen time. It works on the system drive only.

Check OneDrive's recycle bin and version history

If the file was in a folder that syncs to OneDrive, deleting it on the PC deleted it in OneDrive too, and on every other device that syncs the folder. Windows Backup syncs Desktop, Documents, Pictures, Videos and Music to OneDrive when you switch those folders on. Microsoft also notes that deleting a shared item deletes it for everyone.

To restore from the OneDrive recycle bin:

1. Go to onedrive.com and sign in with your Microsoft account, or your work or school account.
2. Select Recycle bin in the navigation pane.
3. Select the files or folders, then select Restore. For files deleted from the Personal Vault, select Show Personal Vault items first.

The OneDrive app on a phone has the same recycle bin, under your account. How long deleted items wait there, and the related options:

Version history is for a file that still exists but was overwritten or damaged. In File Explorer, with the OneDrive app installed, right-click the file, select Version history, then select the ellipsis next to the version you want and Restore. The website offers the same, one file at a time.

Restore your OneDrive is for many files at once: a mass deletion, a sync accident or ransomware. It needs a Microsoft 365 subscription on a personal account (Settings > Options > Restore your OneDrive on onedrive.com), and is at Settings > Restore OneDrive for work or school accounts. You pick a date, or the earliest activity to undo, and OneDrive rolls every file back to that moment; files created since then go to the recycle bin rather than disappearing. After automatic ransomware detection, OneDrive suggests the restore date for you.

For files deleted from SharePoint or a Teams channel, open the SharePoint site, select Recycle bin in the Quick Launch bar, select the items and select Restore. If they are no longer there, a site collection administrator may still be able to restore them from the site collection recycle bin.

Restore it with File History or Previous Versions

File History is the Windows backup that copies your libraries (Documents, Pictures, Videos and Music) and Desktop to an external drive or a network location, and keeps earlier versions of each file. If it was switched on before the deletion, the file is probably there. Connect the File History drive first.

1. In File Explorer, go to the folder that used to contain the file.
2. Right-click the folder and select Restore previous versions. If the file was at the top level of a drive, such as C:\, right-click the drive instead.
3. The Previous Versions tab lists the saved versions. Pick a version of the folder from before the deletion: for a file deleted today, choose yesterday's.
4. To look inside first, expand Open and select Open in File History.
5. To get the file back, expand Restore and select Restore to..., and choose another location.

For a file that sits in a library, right-click it where it is actually saved, not in the library view. If the list is empty with the File History drive connected, nothing was backing that folder up, and it is time for the next step.

Restore it from Windows Backup or another backup

Windows Backup in Windows 11 and 10 backs up files by syncing the folders you choose to OneDrive, and saves apps and settings to your Microsoft account for setting up a new PC. So a file deleted from a backed-up folder is recovered from OneDrive, as in the section above. Windows Backup works only with personal Microsoft accounts, not work or school accounts.

Other backups are restored with the tool that made them:

• An external drive or a network drive with backup software: restore from that software, to a different folder, then compare.
• The older Backup and Restore (Windows 7) tool: if you still use it, restore your file from it, and then move to a current backup method, which is what Microsoft recommends.
• A company file server: ask IT. A server with Shadow Copies of Shared Folders keeps point-in-time copies that let users recover deleted or changed files on the network themselves, and the server's own backups are another route.
• Microsoft 365 at work: the OneDrive and SharePoint recycle bins above come first. Beyond them, your administrator may have retention policies or a separate backup.

Can System Restore recover deleted files?

No. System Restore rolls back system files, registry settings and installed programs to the moment a restore point was made, and Microsoft states that it does so without affecting your personal files. It will not bring back a deleted document, photo or spreadsheet. It will not delete them either, which answers the other common question. What it can undo is software installations, driver updates and settings changes made after the restore point, and Scan for affected programs shows which programs are affected before you confirm.

Classic restore points come from System Protection, which is not turned on by default. When it is on, it saves snapshots of system files, installed applications, the registry and system settings, before significant events such as updates, or when you create one manually.

The exception: point-in-time restore

Windows 11 now has a second kind of restore point that does include files. Microsoft began rolling out point-in-time restore to Windows 11 versions 24H2 and 25H2 with the June 23, 2026 preview update (KB5095093), gradually, so as of September 2026 some PCs have it and some do not. Look for it in Settings > System > Recovery > Point-in-time restore.

So if your PC has point-in-time restore and the file was on the Windows drive and deleted less than about three days ago, a restore point taken before the deletion contains it, as long as the file already existed when that point was taken. The cost is that the restore rolls everything on that drive back: new files, installed apps, settings changes and passwords made since then are lost. Files stored in OneDrive and other drives are not touched, and a restore can undo recent security updates. Before you use it:

1. Copy everything you created or changed since the restore point to OneDrive or an external drive.
2. Find your BitLocker recovery key: the restore asks for it on an encrypted drive. Our guide to setting up Windows on a new computer explains where the key is kept.
3. Plug the laptop in, and make sure the drive has at least as much free space as all the restore points together.
4. Open Settings > System > Recovery and use Advanced startup to restart into the Windows Recovery Environment, then select Troubleshoot > Point-in-time restore. Enter the key, choose the restore point, select Continue to acknowledge the risks, and select Restore.
5. Once Windows starts, copy your file somewhere safe and run Windows Update.

On an SSD, where Windows File Recovery's chances are limited (see below), a point-in-time restore point from before the deletion is often the better option. It is not a backup, though: restore points live on the same drive, and Windows deletes them after 72 hours, or earlier when free space drops to 20 GB.

Recover deleted files with Windows File Recovery

When no copy exists anywhere, Windows File Recovery is Microsoft's own tool for reading what is left on the disk. It is a free command-line app from the Microsoft Store for Windows 10 version 2004 and later, including Windows 11. It works on local storage (internal drives, external drives and USB devices), not on cloud storage or network file shares.

You need a second drive for the results: the source and destination must be different, so if the PC has one drive, plug in a USB flash drive or external disk. Installing the app writes to your system drive; if the file was on C: and is very valuable, weigh that against running the tool from another PC with the drive attached.

1. Install Windows File Recovery from the Microsoft Store.
2. Open it from the Start menu, and select Yes when Windows asks to allow it to make changes.
3. In the window that opens, type a command in this format:

winfr source-drive: destination-drive: [/mode] [/switches]

4. Enter Y to start. A scan can take a long time on a large drive; press Ctrl+C to stop it.
5. Look for the results in a folder named Recovery_<date and time> on the destination drive.

Choose the mode

Check the drive's file system first: right-click the drive in File Explorer and select Properties. Computer drives, external hard drives and USB drives larger than 4 GB are usually NTFS; SD cards and smaller flash drives are usually FAT or exFAT.

If you are not sure, start with Regular. If it finds nothing, run Extensive. Microsoft's examples:

:: your Documents folder from C: (keep the backslash at the end)
winfr C: E: /regular /n \Users\<username>\Documents\

:: every PDF and Word file on C:
winfr C: E: /regular /n *.pdf /n *.docx

:: any file with "invoice" in its name, from E: to C:
winfr E: C: /extensive /n *invoice*

:: one file whose name has spaces
winfr C: E: /regular /n "\Users\<username>\Documents\Quarterly Statement.docx"

Replace <username> with your account's folder name, which you can see by typing C:\users in File Explorer's address bar. When recovering from the Windows drive, always narrow the search with /n: Windows creates and deletes files constantly, and without a filter the results fill with them.

A few switches are worth knowing. winfr /! lists the advanced syntax, including /segment (NTFS recovery using file record segments) and /signature (any file system, recognizing files by their headers, with /y: to pick file types). /u recovers undeleted files, for example from the Recycle Bin, and /e turns off the default filter that hides program and system file types. In NTFS and segment modes, files recovered from the Recycle Bin, including ones permanently deleted from it, may appear as $files.xxx in a folder called $RECYCLE.BIN.

If nothing useful comes back, Microsoft's explanation is the usual one: the free space may already have been overwritten, especially on a solid-state drive.

Why SSDs make deleted files much harder to recover

On a hard disk drive, a deleted file's data stays on the platters until other data is written over it, which is why recovery tools can work on one. A solid-state drive behaves differently. When a file is deleted, Windows sends the drive a delete notification, known as TRIM (or unmap), listing the clusters that the deletion freed. On NTFS, TRIM is on by default unless an administrator turned it off. The SSD's controller then manages those blocks itself and can erase them in the background, with no further instruction from the computer.

This is not theoretical. A 2010 peer-reviewed study in the Journal of Digital Forensics, Security and Law showed that SSDs can destroy recoverable data on their own, without any command from the computer. Microsoft's Store listing for Windows File Recovery says recovery from an SSD is limited by TRIM.

You can check whether TRIM is on from a Command Prompt opened as administrator (fsutil requires it):

fsutil behavior query DisableDeleteNotify

DisableDeleteNotify = 0 means TRIM is enabled; 1 means it is disabled. Turning it off after a deletion does not help, because the notice went to the drive when the file was deleted. On an SSD, the realistic options are the ones that keep a copy: the Recycle Bin, OneDrive, File History, backups and point-in-time restore.

When to use a professional data recovery service

Software cannot fix hardware. Stop and call a data recovery lab, rather than running any tool, when:

• The drive has failed physically. It is not detected, makes clicking or grinding noises, was dropped, or got wet. Power it off: running a failing drive can make things worse, and recovery software reads the whole disk.
• The data is worth more than the cost, and Windows File Recovery found nothing on a hard disk drive. On an SSD with TRIM, be prepared for a lab to find nothing too.
• The drive held other people's data, such as client or patient records. Keep the drive, write down what happened, and decide who may handle it before it leaves your hands.

Ask for an assessment and a quote before any work starts, what happens to the drive and the recovered copy afterwards, and how the lab protects confidentiality. If the drive is encrypted with BitLocker, find the 48-digit recovery key before the drive leaves your hands: it is what unlocks the drive when BitLocker cannot do so automatically, and Microsoft Support cannot retrieve or recreate a lost one.

Set up backups so a deletion is easy to undo

Every step above works only if a copy exists. A backup worth having keeps history (so a deletion or overwrite does not replace the good copy) and lives somewhere else (so one failure cannot take both). Sync on its own is not enough, because it copies your deletions too, with a 30-day recycle bin as the safety net.

A setup that covers most people:

1. Turn on Windows Backup to sync Desktop, Documents, Pictures, Videos and Music to OneDrive. A free Microsoft account includes 5 GB, and the recycle bin and version history come with it.
2. Turn on File History to an external drive or a network location: Control Panel > System and Security > Save backup copies of your files with File History, then Turn on. It keeps its own versions, independent of the cloud.
3. Keep one copy offline. CISA recommends offline backups because many ransomware variants look for reachable backups and delete or encrypt them. An external drive you unplug after each File History run is the simple version.
4. Leave point-in-time restore on if your PC has it. It covers the last three days on the Windows drive; it does not replace a backup.
5. Test a restore now and then. Restore one file to a different folder and open it; CISA also advises testing backups regularly.

If you are setting up a new PC, our guide to setting up Windows on a new computer walks through turning on Windows Backup and finding your BitLocker recovery key.

For a business, deleted files are a policy question as much as a technical one: who can restore from the Microsoft 365 recycle bins, what the backups cover, and whether anyone has tested them. Our IT support service puts a security baseline in place that includes backups, and covers Microsoft 365 administration, including backup of mailboxes and files.