What to do right now
- Deleting a file normally marks its space as free; the contents stay until something new is written there.
- Recovery reads leftover file system records first, which can restore names and folders.
- When records are gone, signature search finds files by their content, but without original names.
- On SSDs with TRIM, and wherever new data has been written, the old contents are usually gone.
What happens during a recovery scan
Stop writing to the drive
Every new file, download or update can be placed in the space a deleted file occupied. Recovery only works on data that has not been replaced, so this step matters more than any tool setting.
Choose the drive
In Deleted file recovery, select the drive, memory card or disk image. The scan only reads, so the source is not changed.
File system pass
The tool first reads the file system's own bookkeeping, such as the NTFS master file table or FAT directory entries, looking for entries marked as deleted. These still hold the name, folder, size and the location of the data, which is why files found this way come back looking like the originals.
Signature search pass
Next it reads the disk sector by sector and looks for known file headers, such as the bytes that open a JPEG, a PDF or an MP4. This finds files whose records were wiped, for example after a format, but the original name and folder are not stored in the data, so results get generic names.
Validation
Each candidate is checked by an independent validator that tries to parse it. FileFix Ultimate labels the result as validated, partially recovered, or extracted but not verified, with a high, medium or low confidence.
Save to another disk
Recovered copies are written to a different physical disk. Writing them back to the source could overwrite other files that are still waiting to be found.
Where a deleted file goes
A file system is an index. It keeps a record for each file with its name, folder, size, dates and a list of the disk areas that hold its contents. Deleting a file, including emptying the Recycle Bin or using Shift+Delete, usually just marks that record as unused and marks the areas as free. Writing zeros over gigabytes of data would be slow, so Windows does not do it.
Until those free areas are reused, the bytes are still physically there. On a large, mostly empty hard drive this can last weeks. On a nearly full system drive that constantly writes temporary files, updates and browser caches, it can be minutes. This is why recovery chances fall over time rather than at a fixed moment.
File system records versus signature search
Record-based recovery is the precise method. If the deleted entry survives, it says exactly which clusters belong to the file and in which order, so even a fragmented file can be put back together, and the name and folder come with it. On FAT32 and exFAT the chain that links clusters is often cleared on deletion, so the tool has to infer the order; FileFix Ultimate tests candidate layouts against the file's content and picks the one that validates.
Signature search, also called carving, ignores the file system and reads raw sectors. It recognises a file by its header and, where the format allows, by its internal structure or footer. It works after a quick format or on a RAW drive where the index is unreadable. Its weakness is that names, folders and dates live in the index, not in the file, and a file split into scattered pieces may come back incomplete. Photos and videos sometimes carry their own dates inside, which helps sort the results.
Why some files cannot come back
Overwriting is final. Once new data occupies the same sectors, the old bytes are replaced, and no software can read what is no longer there. A partially overwritten file can sometimes be saved in part, for example the readable top of a photo.
SSDs behave differently from hard drives. With TRIM, Windows tells the SSD which blocks are free, and the drive may erase them in the background soon after deletion. Reading those blocks then returns zeros. A full format writes over the whole volume, and physical damage such as a head crash prevents reading at all. Those cases are explained in the guides on SSD TRIM, overwritten files and bad sectors.
What recovery cannot do
- It cannot restore data that has been overwritten by new files.
- It usually cannot read blocks an SSD has already erased after TRIM.
- Files found only by signature search do not get their original names or folders back.
- Encrypted volumes need the key or password before anything can be read.
- A drive with mechanical damage should go to a lab instead of being scanned.
How FileFix Ultimate applies these methods
- Reads NTFS, FAT32, exFAT, ext2/3/4, HFS+ and optical disc file systems to recover names and folders where records survive.
- Signature search for 68 file types, from JPEG and camera RAW to Office, HWP, PST and video formats.
- Independent validation of each result, with honest labels and a confidence level.
- Read-only scanning, and saving only to a different disk.
- Free for personal use, with no recovery limit, and works fully offline.
FileFix Ultimate is free for personal use, works offline and never writes to the drive you are recovering from. Business use needs a one-year licence per PC. Check the signature before you run it.
Frequently asked questions
Why do recovered files have names like file0001.jpg?
They were found by signature search, which reads file contents but not the index where names are stored. The data can be intact even though the name is generic. Sorting by the date stored inside photos often helps.
Is deleting from the Recycle Bin different from Shift+Delete?
For recovery, very little. Both remove the file's entry from the folder and mark its space free. Emptying the Recycle Bin also removes the copy Windows kept there, so the steps afterwards are the same.
Does a quick scan find less than a deep scan?
A quick pass reads only file system records and is fast. A deep pass adds signature search across every sector, which finds more but takes much longer and returns files without names. It is reasonable to review the quick results first.
Does recovery software write anything to my disk?
A careful tool does not. FileFix Ultimate reads the source only and refuses to save results onto the same volume, so the scan itself does not reduce your chances.