A deleted file on an HDD and the same deleted file on an SSD can have very different recovery prospects. The file system may mark both as free space, but an SSD can also receive a TRIM notification telling the storage device that those blocks are no longer needed.
What deletion changes first
Deleting a file normally removes or changes the file-system records that point to its data and marks the occupied space as reusable. On an HDD, the old magnetic data may remain until another write reuses those sectors. That is why stopping writes matters immediately.
An SSD adds a controller and flash-translation layer between Windows and the physical memory. With delete notification enabled, Windows can tell the device that freed clusters are no longer in use. The controller may then prepare those blocks for reuse. Recovery software cannot read data the device no longer returns.
Check the Windows delete-notification setting
Open Terminal or Command Prompt as administrator and run:
fsutil behavior query DisableDeleteNotifyFor the NTFS result, 0 means delete notifications are enabled and 1 means disabled. This is a system setting, not a forensic verdict. It does not prove that a specific command reached a specific SSD, when its controller acted, or that the old file content still exists.
How the scenarios differ
| Scenario | What most affects the next decision |
|---|---|
| Recent deletion on an HDD | New writes and fragmentation. Stop use and scan from another drive if backups fail. |
| Recent deletion on an SSD | TRIM support, controller behavior, elapsed powered-on time, and subsequent writes. Manage expectations before buying software. |
| Quick format on an HDD | File-system metadata loss and overwrite after formatting. Preserve the source and use a separate destination. |
| Quick format on an SSD | The format operation may issue delete notifications across a large range. A filename list is not proof that file content remains. |
| Unstable HDD or SSD | Hardware symptoms take priority. Repeated full scans can add stress and are not the safest first step. |
Safe steps for either media type
- Stop using the affected device and keep it powered off when it is not being assessed.
- Identify whether it is an HDD, SATA SSD, NVMe SSD, USB flash drive, or memory card.
- Check backups, version history, cloud trash, and other copies first.
- Use a different physical drive for the recovery program and output.
- For unstable hardware or irreplaceable files, stop DIY scanning and obtain a professional assessment.
- Keep the source unchanged until representative recovered files have been opened and verified.
Four common myths
- “I can turn TRIM off and bring the file back.” A later setting change does not reverse prior discard activity.
- “A quick format never erases data.” That generalization is unsafe, especially on solid-state storage.
- “The scanner found the filename, so the file is intact.” Metadata, thumbnail, and file content can survive differently. Preview and open the recovered output.
- “More scans improve the odds.” Scans do not restore discarded blocks; on failing hardware, repeated reading can make the situation worse.
Before purchasing a license, use the evidence gates in our free-vs-paid recovery software guide. If the loss just happened, begin with the deleted-file first-response checklist.
Official sources checked: Microsoft fsutil behavior documentation for delete notification and Microsoft Windows File Recovery guidance.