Where Do Deleted Files Go? Recovery and Secure Disposal for Business
When you delete a file, it feels gone. Usually it is not. Depending on where it was stored, a deleted file might be sitting in a recycle bin, in a cloud service’s retention area, or still physically on the drive, waiting to be overwritten.
That is good news when someone deletes the wrong folder. It is bad news when you sell, recycle or hand back a computer that still holds client records. This guide explains where deleted files actually go, how to get them back, and how to make sure business data is properly destroyed when it needs to be.
What really happens when you delete a file
Step one: the Recycle Bin
On Windows, a deleted file normally goes to the Recycle Bin (on a Mac, the Bin). Nothing has been erased yet. You can open the bin and restore the file to where it was.
Step two: emptying the bin
When you empty the bin, the file disappears from view, but the data is often still on the drive. The operating system simply removes its record of where the file lives and marks that space as free. Until something new is written over it, specialist recovery tools can sometimes piece the file back together.
SSDs behave differently
Most modern business laptops use solid-state drives (SSDs). SSDs use a feature called TRIM, which tells the drive that deleted space can be cleared. That makes deleted files on an SSD much harder, and often impossible, to recover with ordinary tools. Older spinning hard drives (HDDs) are more forgiving for recovery, and more risky for disposal.
Where deleted files go in the cloud
Most business files now live in Microsoft 365, Google Workspace or similar services, and each has its own safety net.
- OneDrive and SharePoint (Microsoft 365 business accounts): deleted files go to a recycle bin, then a second-stage recycle bin. By default, they can be recovered for up to 93 days.
- iPhone and iPad Files app: deleted files sit in Recently Deleted and are permanently removed after 30 days.
- Version history: in Microsoft 365, earlier versions of a file can often be restored even if it was overwritten rather than deleted.
These features are helpful, but they are not a backup. They have time limits, they can be emptied, and ransomware or a rogue user can affect them too.
How to recover a deleted file
- Check the Recycle Bin or Bin on the computer first.
- Check the cloud recycle bin in OneDrive, SharePoint or Google Drive if the file was synced or stored online.
- Try version history if the file still exists but the content is wrong.
- Restore from backup. This is where a proper backup earns its keep.
- Stop using the device if the file was only on a local drive and none of the above worked. Every new file saved can overwrite what you are trying to recover. Call your IT provider before trying recovery software yourself.
A tested backup removes most of the stress from this list. Our guide to simple backup and recovery plans explains how to set one up.
Why “deleted” is not good enough for business data
If deleted data can sometimes be recovered, then a laptop you sell, donate or return at the end of a lease could still contain client files, emails or saved passwords.
For Australian businesses covered by the Privacy Act, this is not just good practice. Australian Privacy Principle 11.2 requires organisations to take reasonable steps to destroy or de-identify personal information once it is no longer needed. The OAIC’s guidance notes that the right steps depend on the hardware used to store the information, and that if you outsource destruction you should confirm it has actually happened.
If data on a disposed device ends up in the wrong hands, it could also become a data breach under the Notifiable Data Breaches scheme.
How to securely dispose of business devices
Encrypt devices from day one
The simplest protection is to encrypt every laptop and desktop while it is in use, using BitLocker on Windows or FileVault on a Mac. If an encrypted device is lost or stolen, the data is unreadable without the key. At disposal time, encryption also makes wiping far more reliable.
Wipe properly, not just delete
- Windows computers: use a full reset with the option to clean the drive, ideally on an encrypted device.
- Macs, iPhones and Android phones: sign out of Apple or Google accounts first, then erase all content and settings.
- Managed devices: if you use Microsoft Intune or a similar tool, a remote wipe can be triggered and recorded centrally.
Destroy what cannot be wiped
Failed drives, old servers, USB sticks and backup disks often cannot be wiped reliably. Have them physically destroyed by a reputable e-waste or data destruction provider and ask for a certificate of destruction. The ASD’s Information Security Manual includes detailed guidance on sanitising and destroying media if you need a standard to follow.
Keep a record
Record each device’s serial number, who wiped or destroyed it, how and when. If anyone ever asks what happened to a device, you have the answer. Our lifecycle and asset management service handles this from purchase to disposal.
Quick checklist
- Business files stored in OneDrive, SharePoint or another managed cloud service, not only on local drives
- A separate, tested backup of business data
- Every laptop and desktop encrypted
- A written process for wiping devices before they leave the business
- Failed drives and old media physically destroyed, with a certificate
- A register of disposed devices
Could your old devices still be holding client data?
Our free IT Health Check looks at your backups, encryption and device disposal process and shows you how to recover what you need and destroy what you do not.
Or call 1300 133 770.
