03 · Workflow
Deletion drops pointers first; data may linger until overwritten. What you do next matters more than any single click.
Pause downloads, installers, sync, and games that patch often. Every new write competes with the clusters you hope are still intact.
Standard pass for speed when deletes are recent and the volume still behaves; deep scan when files vanished, the card was “empty,” or the filesystem took damage.
Never recover onto the partition you are scanning. Use external or secondary storage with enough free space for the largest files you care about.
Back up what mattered, document what failed (TRIM, full format, encryption), and retire flaky media. If the drive clicked or SMART looks ugly, clone or image before another heavy scan—software cannot fix mechanical failure.
The highest-risk window is immediate: installs, updates, and sync that reuse freed space. In the first hour, prioritize stopping writes and choosing the shallowest scan that still sees your paths.
Over the next day, you can afford a deep pass, swap cables, or image a flaky disk—but delay increases the odds of background churn. If the machine is a daily driver, schedule recovery when you can leave it on wall power uninterrupted.
Hyper-V checkpoints, VMware snapshots, and “undo disks” change what “deleted” means—sometimes the file still lives inside an older differencing layer. Check the hypervisor or backup product before you treat the guest OS as the only source of truth.
On shared or family machines, another profile’s installers or game patches may be writing to the same volume while you scan. A quick sign-out of other sessions (when policy allows) reduces surprise overwrites.
Mini checklist