Lost Data on Windows or macOS: Immediate Response and Recovery

When a file disappears, your first actions can determine whether it remains recoverable. This guide covers accidental deletion and missing local files. If the device is encrypted by ransomware, physically damaged, making unusual noises, or involved in a security or legal matter, stop and contact IT immediately.

First response: protect what remains

1. Stop writing new data to the affected location. Do not install recovery software, download large files, run cleanup tools, reset the computer, or reinstall the operating system. Deleted local data can be overwritten by normal use.
2. Record the facts. Note the file name, original path, device name, user, last-known-good time, what happened just before the loss, and whether the folder was synchronized.
3. Check scope. Determine whether one file, one folder, an external drive, or the entire profile is affected. If many items changed at once, disconnect from the network only if your organization’s incident procedure says to do so, then call IT.
4. Preserve the device. For physical failure, repeated clicking, liquid exposure, or a drive that disconnects, power down and avoid repeated restart attempts.

Safe checks on Windows

Search File Explorer and check the Windows Recycle Bin. If the file was in OneDrive, also check the OneDrive website and its recycle bin; a cloud deletion may have synchronized across devices.

If File History was configured before the loss, open File Explorer, browse to the folder that contained the item, right-click the folder, and select Restore previous versions. Preview the available version before restoring. Microsoft documents that File History protects configured libraries and can restore deleted content or an earlier file or folder state. Microsoft Support

Windows File Recovery is a Microsoft command-line application for attempting recovery from local storage, but it should be used by IT or an experienced technician. Recovery output must go to a different destination drive so new writes do not overwrite the source. Results are not guaranteed, especially on solid-state drives where deleted blocks may be cleared quickly. Do not install the tool onto the affected drive when the missing data is critical. Microsoft Store

Safe checks on macOS

Search with Finder or Spotlight, then open Trash. If the item is present, select it and choose File > Put Back. Apple warns that items emptied from Trash are permanently deleted; iCloud Drive items placed in Trash are automatically emptied after 30 days regardless of Finder’s local Trash setting. Apple Support

If Time Machine was configured before the loss, open the folder where the item belonged, launch Time Machine, move through the timeline, select the item or version, and choose Restore. Apple states that restored items return to their original locations. Some applications also support File > Revert To > Browse All Versions. Apple Support

For iCloud Drive, check Recently Deleted on iCloud.com. Apple allows recovery of eligible files deleted from iCloud Drive or supported apps within the last 30 days, unless they were permanently removed. Apple Support

What not to do

Do not save recovered files back to the source disk, initialize or format a drive, run repair utilities repeatedly, or open a computer that is under warranty or company management. Do not connect a potentially infected backup disk to a ransomware-affected device. Avoid consumer recovery utilities on company data unless IT has approved the product, licensing, privacy terms, and recovery plan.

Limits and escalation

Recycle bins, version history, File History, Time Machine, and cloud recovery work only when the relevant feature existed before the loss and the retention period has not expired. SSD behavior, encryption, hardware damage, overwritten sectors, and permanent cloud deletion can make recovery impossible.

Escalate immediately when the data is unique or regulated, a drive is physically failing, credentials may be compromised, multiple users are affected, or the loss could trigger a contractual or legal duty. Provide the device asset tag, operating system, file path, deletion time, cloud service involved, symptoms, and business deadline. IT can then decide whether to use backups, cloud administration, forensic imaging, or a professional clean-room recovery service.