05 March 2024  —  Acronis

How to restore a deleted file: A step-by-step guide

Table of contents
Importance of file restoration
What are the costs associated with recovering deleted files?
Built-in operating system tools for recovering recently deleted files
How does file recovery software work?
Recover deleted files with Acronis True Image
Criteria for choosing the right software
How to restore a deleted file for Mac
How to restore a deleted file for Linux
What are the most common challenges in file restoration?
Acronis True Image
formerly Acronis Cyber Protect Home Office

Whether you're a casual user, an SMB owner, or an enterprise CEO, we all create and handle data in various ways.

Here, "data" can mean a funny picture you took and want to share with friends. It can also refer to a work-related document you use to keep track of orders for a small grocery shop. For larger companies, "data" can describe a critical information database containing sensitive client and payment details. Whichever the case, a common trait between users and businesses is the will to safeguard valuable data. There are numerous threats to the integrity of your essential files and documents, such as data corruption, hardware failure, cyber attacks, and accidental deletion.

While protection against all of the above is critical, each threat to your data's availability deserves its article. Rather than diving deep into every potential cause of data loss, this piece will explore how to restore files or folders following a breach or compromise event, accidental or malicious. It will guide you through the importance of data restoration, the different approaches to recovering deleted files, and the successful implementation of reliable data recovery software to ensure your information is always protected and available for access.

Importance of file restoration

In today's data-driven world, data loss can be perceived in two critical aspects. First, most users experience it daily, whether they operate a home office or a successful business. It is a common event that can happen to every user. However, its commonality doesn't imply that we should accept it as something that just happens and that there's nothing we can do about it. Data loss can cause significant damage to both home and corporate systems. Knowing how to counter it is crucial to ensure the integrity and availability of your essential files.

The primary approach to counter data loss caused by accidental deletion, cyberattacks, system failures, and natural disasters is reliable data recovery software. You can attempt to recover files independently (manually), via a native recovery tool, or by using dedicated backup and recovery software.

Common scenarios for file deletion

Before we explore the different ways to restore deleted files, let's quickly go over the common reasons involved in a data-loss scenario.

  • Accidental deletion

Accidentally deleted files are among the most common scenarios for data loss. If you mistakenly delete files (or folders) without realizing you've done so and empty the Recycle Bin, your files may be lost for good. Moreover, if you use the perma-delete function, permanently deleted files won't be retrievable via the Recycle Bin.

To avoid such a scenario, it's best to exercise caution when organizing, selecting, and deleting files on your computer. However, even perfect data-handling hygiene may fall short if the cause for deleted files is among the ones discussed below.

  • Operating system errors

OS errors can lead to file corruption or deletion. Such errors can be due to improper shutdowns, software glitches, system crashes, faulty updates, etc. Active (currently open) files can be improperly saved in such cases, leading to missing data or inaccessibility.

To battle OS errors regarding data protection, it's best to keep your OS updated by applying the latest bug fixes and patches as soon as possible. Moreover, you can make a habit of regularly saving documents you're working on. It's also advisable to enable auto-save features to ensure data changes are applied as soon as they are created.

  • Hardware failure

Your hard disk drive, SSD, or external storage device are all susceptible to physical (or logical) damage for numerous reasons, such as physical impact, power surges, and manufacturing defects. A failed storage hardware can delete data or render it inaccessible. (which, in some cases, is as bad as deletion)

To counter hardware failure-induced data loss, it's best to regularly back up your personal files and business data to external storage. (preferably, the cloud) Having multiple backup copies, you can satisfy the 3-2-1 Rule of Backup and ensure at least one reliable backup copy to restore files.

  • Malicious attacks

Viruses, worms, and ransomware are significant data integrity and availability threats. Such attacks can delete, corrupt, overwrite, or change data, as well as encrypt it and hold it hostage until you pay a ransom to "unlock" it. Malware can infiltrate user systems via fraudulent links, email attachments, compromised websites, or infected software.

To counter malware attacks, it's crucial to rely on dedicated anti-virus and anti-malware solutions and, again, regularly back up your data to ensure a successful recovery, even if an attack bypasses your defenses. Moreover, it's helpful to foster and follow sensible internet browsing hygiene and avoid suspicious links, attachments, clickables, and websites altogether.

Definition of file deletion

You can delete files on your computer in the following two ways:

Sending a file to the Recycle Bin (or "Trash" for macOS devices) 
Direct delete (Shift+Delete) 
Permanence of deletion (Erasure) 
A deleted file sent to the Recycle Bin can be recovered directly from it. If you empty the Recycle Bin, you won't be able to restore them directly from the system options. 
Deleting files directly from the system is equivalent to emptying the Recycle Bin. Files deleted via Shift+Delete can't be restored via the system settings.After a perma-delete or emptying the Recycle Bin after a normal delete, the specific file you deleted is moved from its existing location to another location, inaccessible to you. This is due to the file being assigned a new index and erasing the available links to find the file via, let's say, File Explorer.Nonetheless, the file is not yet erased from your hard drive. After its transfer to the new directory, your machine frees up the space previously occupied by the file to store new data. Until the system writes new data to the space occupied previously by the file, the file is still retrievable via dedicated data recovery software. However, after the system writes new data to the old file's location on the hard drive (or SSD), the file can hardly be restored, even via dedicated software. 
Erasure refers to permanently eliminating files, rendering data unavailable for recovery. During the erasure process, the system overwrites the particular file with random junk data. The overwriting process can be initiated multiple times, with the junk data consisting mainly of zeroes and ones. After successful overwriting, the file is unreadable for the user. This process also eliminates the possibility of restoring the file via data recovery software. 

Types of deleted files

All deleted files have one thing in common - they aren't directly accessible by the user. In some cases, you can gain access to accidentally deleted files. In others, data is lost for good unless you can retrieve it from a reliable backup.

We can divide the different types of deleted files as follows:

  • Individual files/folders deleted manually and emptied from the Recycle Bin (Windows) or Trash (Mac).
  • Files deleted and bypassed the Recycle Bin (Shift+Delete)
  • Files deleted by malicious software, such as viruses, worms, Trojans, or encrypted by ransomware. As encryption makes them inaccessible to the user, the files are as good as deleted unless you get a decryption key, even if they still exist on the system (behind a ransomware wall).
  • Files that have been overwritten by different files of the same name. (e.g., if you attempt to save a file via a specific filename that already exists on the hard drive, the system can ask if you want to replace the old file; clicking "Yes" will replace the old file with the new, rendering the former inaccessible)
  • Files deleted or corrupted due to an unknown event, such as hardware failure, software bugs, system crashes, etc.

Regardless of the cause, deleted files can cost time, effort, and money to be recovered. Whether it's cherished media files for home users or critical company data for organizations, permanent file deletion is an unpleasant scenario. Moreover, it can carry risks and consequences, both for home users and businesses.

Let's explore those below.

Risks and consequences

There are two primary risks of accidental file deletion. While the first one mainly affects companies, the second can apply to both casual users and organizations.

  • Hindered business processes

For businesses, data is critical for seamless day-to-day operations. If essential data is deleted, corrupted, or lost, it can affect the entire functionality chain within the organization (e.g., bottlenecks, obstructed resource allocation). Moreover, companies would have to divert time and resources from everyday business processes to remediate the data-loss event, further hindering productivity and business continuity.

Prolonged downtime or data breaches can hurt the brand's reputation and lower customer trust. Even if the company is transparent with clients and announces the data breach early, customers may perceive the event as a catalyst for distrust, pointing to an apparent unreliability within the business. This can be especially true if the data loss includes client data. While some clients can stick with the brand despite a negligence event, others may take their business elsewhere. A significant drop in client volume and trust would demand the company to rebuild customer relationships, requiring more time, effort, and resources.

Moreover, hindered business processes can affect a company's revenue stream. Since data recovery would require extra expenditure, it can stretch business finances and even lead to bankruptcy.

Lastly, data loss (be it due to accidentally deleted files or a malicious attack) can expose a business to legal actions and lawsuits. Loss of customer-related data can carry potential fines for not adhering to industry and regional data protection laws and regulations. Moreover, customers can also file lawsuits against the organization in such an event.

  • Sensitive data theft

As discussed, deleting a file doesn't mean it's gone for good. Even the Shift+Delete function can leave remnants of the file on your hard drive, although you would seemingly be unable to access them. However, unauthorized parties who get ahold of said hard drive may be able to recover deleted files and misuse them for ill-intended purposes, such as identity theft or financial fraud. Such an event can have dire consequences for both individuals and businesses.

What are the costs associated with recovering deleted files?

 A professional data recovery service has various criteria for determining the pricing for data restoration, including the device type, damage type, damage severity, and selected turnaround time.

According to Checkatrade, the average cost for:

  • Standard data recovery (plus advanced features) is £222.50. (ranging from £125 to £325)
  • A hard drive data recovery service is £475. (ranging from £350 to £600)
  • Recovery software is £50.
  • Cloud backup storage is £120.74. (ranging from £1.49 to £239.99)

Data recovery professional services typically claim that they can restore permanently deleted files or otherwise deleted data from HDDs, SSDs, external hard drives, laptops, personal computers, USB flash drives, memory cards, smartphones, tablets, and digital cameras. However, depending on the data-loss scenario, there's no 100% guarantee that your files are recoverable.

While some data recovery professionals utilize a "No data, no charge" policy (meaning you won't pay for their services if they fail to recover permanently deleted files), this is not an industry-wide policy. Some providers may ask you to pay for the service even if they haven't recovered your lost or deleted files.

The price can also vary depending on additional fees, such as Attempt, Second Attempt, Part, Uncommon, and Transfer Media fees, which can go up to around $1000.

Built-in operating system tools for recovering recently deleted files

Recoverable files can be restored via built-in functions for Windows, Mac, and Linux machines. Let's explore the primary approaches below.

Windows File Recovery

Windows File Recovery is a native command-line utility (meaning you must use the command prompt to utilize it) designed to recover deleted files from local drives, memory cards, and USB flash drives.

The utility has two modes:

  • "Regular", used to recover recently deleted files, and
  • "Extensive", used for more complex scenarios, such as recovering files deleted long ago or from drives/disks that have been corrupted or formatted.

The File Recovery feature supports two file systems - NTFS and FAT (or exFAT). The feature is operational in Windows 11, but you must download and install it manually.

To use File Recovery, you must learn its general (and advanced) syntax to set recovery parameters, switches, and filters. A typical command to restore a folder would be as follows:

winfr source-drive: destination-drive: [/mode] [/switches]

In Windows 11, you can run the File Recovery option on Windows Terminal, accessible via pressing the Windows Button + X key and selecting "Windows Terminal". Keep in mind, the recovery feature won't recover lost or deleted files that have been overwritten (by new data).

Windows File History backup feature

You can utilize a File History backup to restore deleted data. You can do so from a backed-up drive or opt for a particular date to restore previous versions of the specific file. If restoring lost files from an external drive backup, ensure the storage device is connected to the computer.

  1. Type "Backup settings" in the Windows Search bar -> select "Open" -> select "More options".
  2. Scroll down the page to find and select the option labeled "Restore files from a current backup".
  3. Here, you can choose a "file/folder", "multiple files/folders", or all available folders from the backup to restore them.
  4. After choosing what files to recover, select "Restore". Windows will start restoring the selected files.

You can also use the previous versions feature via the left and right arrows to browse available previous versions for both files and folders by date.

Mac Time Machine

If you rely on Time Machine to back up files on a Mac computer, you can use the steps below to recover lost files or restore older file versions.

  1. On your Mac device, open a window for the particular item you wish to restore. (e.g., to recover accidentally deleted files from the Documents folder, open the Documents folder; if the deleted files were residing on your desktop, you don't need to open a specific window)
  2. Open Time Machine via Launchpad (in the "Other" folder). You may see a message while your Mac device connects to the backup disk.
  3. Browse the local snapshots and backups via the arrows and timeline. (here, some backups may take some time to load or validate the backup disk; such processes are marked by a pulsing light-to-semi-dark-gray tick mark)
  4. Select which items you want to restore (e.g., folders, entire disk) -> click "Restore".

Recovered data will return to its original location (e.g., a folder that was deleted from the Documents folder will be returned to the Documents folder)

Linux snapshots

Snapshots are read-only copies of the entire Linux file system and all files contained within it. Each snapshot corresponds to the specific system state at the time of its creation. You can browse directories, folders, and files as they were when the snapshot was created. Then, you can utilize the UNIX command line interface to restore deleted files from a relevant snapshot.

To do so, follow the steps below:

  1. All Linux directories contain a hidden directory called ".snapshot". Go to the directory where the altered or deleted file or folder was located. Keep in mind, the ".snapshot" directory won't appear via "ls" but is accessible via "cd".The path to the snapshot sub-directory would correspond to the directory where the deleted files resided. For example, if а deleted file was from the "workprojects" directory, the path should be as follows:/home/username/workprojects/.snapshot
  2. Now, you should see the backup snapshots for the WorkProjects directory organized by time and date.
  3. Move to the sub-directory corresponding to the specific time before you changed or deleted the file.
  4. Copy the file (or folder) to the directory you wish to store it post-recovery.An example line will look as follows:cd/home/username/workprojects/.snapshot/CronJob_engnas_users_2.2024-02-26_1000cp mydeletedfile /home/username/workprojects/

How does file recovery software work?

As discussed, a deleted file isn't technically "erased" from your hard drive unless your system writes new data to the location the file occupied before deletion. File recovery software attempts to recover (or repair) lost files depending on the data loss cause and the potential corruption to the data you're trying to recover.

In the event of an accidental deletion, data recovery software leverages deterministic and heuristic algorithms to locate the deleted files and attempts to restore as much data as possible. The success rate of the process depends mainly on your device's file system.

For example, a robust solution can recover deleted files on a Windows NTFS system because this system doesn't permanently delete files until new data overwrites them. So, unless you are attempting to restore an unsaved or overwritten document, data recovery software can comprise the files and restore them. However, your operating system constantly writes data to the hard disk, even if you aren't initiating any processes. Unless you turn off your device as soon as you've permanently deleted a file, the data will probably suffer some form of corruption or inaccessibility.

For macOS devices using the ApFS file system, the recovery chance is high due to the ApFS system leveraging a copy-on-write system, meaning that each data block is copied before applying changes.

Recover deleted files with Acronis True Image

Acronis True Image is an industry-leading data protection, backup, and recovery solution designed to fortify your data and system against various data loss events.

The solution can initiate a deep search to inspect data records and retrieve permanently deleted files quickly and efficiently. Acronis True Image utilizes top-shelf recovery techniques and tools to scour your hard drives and retrieve permanently deleted files bit by bit.

Whether you've accidentally deleted photos, documents, videos, or other file types, the software will do its best to recover your critical data. The recovery management process is easy to pilot via an intuitive interface and advanced data recovery tools.

Is there an alternative to file recovery software?

Whether you want to recover permanently deleted files or data from a corrupted hard drive, the process may be challenging and cumbersome. Moreover, even the most advanced file recovery tool may not be able to salvage lost files, depending on the scenario.

Instead of relying on data recovery professionals and various solutions, users and businesses can implement a strategy that ensures disaster recovery regardless of the data loss event. This is where dedicated, continuous backup enters the field.

Alongside its data recovery tools, Acronis True Image streamlines regular, reliable backups to create copies of all device data (or specific files and folders, depending on your preferences). As long as you store several backup copies in separate locations - on-site (local physical) and off-site (physical off-site and/or the cloud) - you can always have at least one readily available backup to recover data following a breach event.

Solutions, such as Acronis True Image, enable users to create full-imageincremental, and differential backups to backup partitions or the entire hard drive of your device to store backup data outside of your home network safely. Such an approach counters data loss caused by accidental deletion, hardware failure, cyberattacks, and natural disasters.

With Acronis True Image, you can quickly browse backups to find and recover accidentally deleted files (or folders) from local backups, external hard drives, or the Acronis cloud. Not only will you save time and effort, but you can also minimize expenditure, as data recovery won't require piloting multiple solutions and various data recovery services. Instead, you can manage backup and recovery processes for all protected devices via a single, easy-to-pilot, centralized console.

Criteria for choosing the right software

Choosing the best backup and recovery software is critical to ensure regular, reliable backups are created in line with your data restoration needs and preferences. While every user can outline a unique approach to choosing the most suitable solution, you can implement the guidelines below to streamline the process and make an educated decision.

Evaluating critical data for backup 
The first step to defining a suitable backup solution is critical data identification. Ask yourself which data is crucial to you or your business. Do you need to continuously backup operation systems or only safeguard individual files and folders? Your chosen backup solution should be capable of creating flexible, customizable data copies to protect various data types and ensure seamless recovery. 
Recovery Time Objective and Recovery Point Objective 
RTO and RPO are primary business concerns, but individuals can also benefit from optimized recovery times. For example, a freelancer relies on critical data being available to finish important projects on time, meaning RTO can play a significant role in their data recovery requirements.As for businesses, data loss can dramatically impact day-to-day processes, customer trust, and business continuity. RTO and RPO optimization are crucial to ensure your business is up and running in no time following a data breach event. 
Hybrid backup options 
The 3-2-1 Rule of Backup requires multiple backup copies stored in different locations (both on- and off-premises) to ensure reliable disaster recovery. Ideally, you would choose a solution supporting local and cloud backups to easily access and restore files at home, at the office, and remotely via the internet. 
Robust backup software, such as Acronis Cyber Protect Home Office, offers complete backup automation. After configuring the backup schedule and retention policies, the solution will automatically create regular, continuous backups and store them securely in local and cloud storage.Automating backups means you can't "forget to create a backup", ensuring your backup schedule is met and you always have newly-created data secured in backup storage. Moreover, automation requires less oversight, meaning you will save on effort and time spent managing the backup process. The same goes for businesses - automation enables your on-site IT teams to focus on critical business projects instead of repetitive, mundane backup tasks.

How to restore a deleted file for Mac

Utilizing Trash and Time Machine

You can recover deleted files on Mac via two quick approaches - Trash and Time Machine. Let's explore them both below.

Restore deleted files via Trash

  1. Open the Trash Bin on your Mac device.
  2. Locate and select the deleted files.
  3. Right-click on any of the selected files.
  4. Choose the "Put Back" option to recover files to their original location on your Mac device.

If you have an external drive connected to your Mac, you can access its trash bin by showing hidden folders on your Mac. Then, you can search for the folder labeled ".Trashes" and follow the steps above to restore deleted files on the external drive.

Recover deleted files via Time Machine and Spotlight

If you rely on Time Machine to back up your Mac device, you can recover deleted files via Spotlight and Time Machine. Moreover, for apps that enable document creation and saving, such as Preview and TextEdit, you can restore a previous version of the deleted files within the app.

  1. Open a Finder window on your Mac, type in a word or phrase in the search bar, refine the results, and then click the Time Machine icon from the menu bar -> choose "Browse Time Machine backups".If you don't see the Time Machine icon in the menu bar, you can access the feature from the Apple menu -> System Settings. Open the Control Center (from the sidebar) -> scroll down to Time Machine -> select "Show in Menu Bar" from the pulldown menu.
  2. Browse Time Machine backups via the arrows and timeline.
  3. Select the items you want to recover (individual folders or the entire disk) -> click "Restore".As discussed earlier, restored items will return to their original location.

Employing third-party software

You can use Acronis True Image to restore deleted files on your Mac device via the following steps:

  1. Launch Acronis True Image on your Mac.
  2. Go to the "Recovery" section -> select the "Data Recovery"option -> select the specific location where the lost data was stored.Once the selection is complete, the software will use advanced scanning algorithms to inspect for traces of the deleted files. The process will scan your Mac's hard drive to identify any recoverable data elements associated with the deleted data.
  3. Following a complete scanning process, the data recovery solution software will present a list of recoverable files. Preview those to ensure they are the specific files you want to restore. Once you've identified which files to recover, select them and initiate the restoration process.

How to restore a deleted file for Linux

Recovering deleted files with terminal

Whether you emptied the trash bin, used the "rm" command by accident, or experienced hardware failure, you can restore deleted files in Linux via terminal commands. Let's explore how to do so below.


The first (potentially the most crucial) step in recovering deleted files in Linux is unmounting the file system. This will prevent further write operations from the file system that could otherwise overwrite the deleted files. To unmount a file system, follow the steps below.

  1. Start by identifying the affected file system.
  2. Terminate processes involving file access to ensure data integrity.
  3. Use the unmount command to unmount the file system:sudo umount /mnt/files
  4. Proceed with the file restoration process via foremost, TestDisk, or other tools. We will explore some of those below.
  • Recover files via foremost
  1. Install "Foremost" via the package manager corresponding to your Linux distribution. For Ubuntu (or any Debian-based system), you can use this command:sudo apt-get install foremost
  2. Identify which disk (or drive) you wish to restore files from. Type down the device name (e.g., /dev/sdXY, where X stands for the drive letter and Y - for the disc number.
  3. Open a terminal/command prompt and configure the settings to run the foremost command. The basic syntax can be:foremost -t [file type(s)] -i [input device or disk image] -o [output directory]Here, modify the [file type(s)] according to the file types you need to restore. For example, -t doc will recover DOC files. If you want to recover all file types, use -t all.Next, insert the path to the disk image (or device) you wish to scan over [input device or disc image].Next, change the [output directory] to your preferred location to store the recovered files. You can create a new location so as not to overwrite current files in an existing location.
  4. Run the foremost command, let it initiate the recovery process, and wait for it to complete.

After a completed recovery, you can access the restored files via the output directory.

  • Leverage the lsof command

The lsof command isn't a dedicated recovery tool but can show a list of open files and the processes using them. You can employ it to recover deleted files via the following steps:

  1. Open a terminal, initiate the lsof command, and configure the relevant options and filters. Common examples of relevant options are:-c (process name) - to filter the results based on a specific process name.-u (username) - to filter the results based on a particular user.-p (process ID) - to display open files for a particular process ID.-n - to prevent the command from hostname resolving attempts.-i - to show all files opened by network connections.
  2. Review the generated list and identify which processes are holding deleted files.
  3. Then, you can check all deleted files held open by processes via DEL in the TYPE column. If you are attempting to restore deleted files that are still active due to system processes, you can identify such files and take appropriate action to recover them (e.g., restarting a process to "release" its hold on a deleted file).
  • Recover deleted files via TestDiskInstall TestDisk via the package manager corresponding to your distribution. For Ubuntu or Debian-based systems, the command is as follows:sudo apt-get install testdiskOpen a terminal to execute the testdisk command.Once launched, TestDisk displays a list of available disks and partitions. Select the location where the deleted files resided -> press "Enter".Select the partition table type used on the disk. If unsure, select the default option (typically, that's "Intel").testdisk will now analyze the partition structure and try to pinpoint lost or deleted partitions. It will also display all current partitions and potential issues within them.testdisk will list any detected deleted partitions. You can select the partition that contains the deleted file (or files).testdisk will enable several recovery options - copying files, listing files, and undeleting files. You can select the one you find appropriate based on your preferences.testdisk will help you go through the restoration process. The procedure may involve identifying file systems, searching for lost or deleted files, or copying restored files to a new location. Here, you need to follow the prompts and make sure to provide the required additional information.testdisk will notify you once the recovery process is complete. You can then access the restored files from your preferred output directory.
  • Install TestDisk via the package manager corresponding to your distribution. For Ubuntu or Debian-based systems, the command is as follows:sudo apt-get install testdisk
  • Open a terminal to execute the testdisk command.
  • Once launched, TestDisk displays a list of available disks and partitions. Select the location where the deleted files resided -> press "Enter".
  • Select the partition table type used on the disk. If unsure, select the default option (typically, that's "Intel").
  • testdisk will now analyze the partition structure and try to pinpoint lost or deleted partitions. It will also display all current partitions and potential issues within them.
  • testdisk will list any detected deleted partitions. You can select the partition that contains the deleted file (or files).
  • testdisk will enable several recovery options - copying files, listing files, and undeleting files. You can select the one you find appropriate based on your preferences.
  • testdisk will help you go through the restoration process. The procedure may involve identifying file systems, searching for lost or deleted files, or copying restored files to a new location. Here, you need to follow the prompts and make sure to provide the required additional information.
  • testdisk will notify you once the recovery process is complete. You can then access the restored files from your preferred output directory.

Employing reliable backups via third-party software

An easier way to recover deleted files is via sensible, reliable backups. Instead of DIY-ing terminal commands or employing an expensive data recovery service, you can quickly and reliably recover deleted files from local or cloud backup.

For example, Acronis Cyber Protect for Linux offers all-around data management, backup, and recovery powered by the AnyData engine. You can create image-based or partial backups and employ encryption and flexible recovery options to ensure secure, fast disaster recovery of all accidentally deleted data.

You can store backups locally (disks, network storage) or in the Acronis Cloud to ensure everywhere-recovery whenever needed. Moreover, you can automate the backup process to schedule full and incremental backups, thus optimizing backup times and resources. All backups are protected by military-grade AES-256 encryption, safeguarding data at rest and in transit, ensuring your data's integrity and immediate availability.

In addition to the comprehensive backup options, you can easily navigate and restore specific files or folders without the need to recover an entire disk-image backup. Moreover, the solution's cross-platform compatibility enables seamless data access across various Linux distributions and file systems to ensure optimal operation in diverse home and work environments.

How to restore a deleted file from cloud backup via Acronis Cyber Protect

If you decide to utilize Acronis Cyber Protect to create regular, continuous backups, you can follow the steps below to recover files from your personal cloud backup.

  1. Log in to the Cyber Protection console -> select the machine for which you want to restore files -> click "Recovery".
  2. Select the specific backup location from which you want to recover deleted files.
  3. Select the relevant recovery point (if the backup contains multiple recovery points).
  4. If you want to recover individual files from a full disk backup, click on "Recover..." -> select "Files/folders" from the drop-down menu.If you want to recover deleted files from a file/folder backup, click "Recover files/folders".
  5. Select which files and/or folders to recover and click "Recover". Keep in mind, when recovering from cloud storage, you can either restore the files or download them as an archive. (the latter is only possible if the selected data volume is smaller than 100MB)
  6. Select the target destination you want to restore or download the data to.
  7. Click "Start recovery" to initiate the recovery.

What are the most common challenges in file restoration?

Accidental deletion occurs commonly for many users. While the deleted file can often be quickly restored from the Recycle Bin or Trash, other scenarios can be more challenging. For example, corrupted or fragmented files can "evade" data recovery software, meaning even a "successful" restoration process may not grant access to critical files.

Let's explore both concepts below so you can avoid them efficiently.

Corrupted files

Corrupted files are essentially unusable unless you can remediate the corruption.

Files can become corrupted for numerous reasons - software bugs, viruses, ransomware, incomplete downloads, etc. When you attempt to access a corrupted file, the system may show an error message or lock up to identify a problem with the specific file. While the corrupted file can be fixed via various methods - the CHKDSK command, a system restore, or previous file version recovery - these methods may not always yield optimal results. Even professional file repair software may hit a wall, leaving corrupted files inaccessible.

If you run dedicated data recovery software to restore corrupted files, the solution may do its best to gather data elements and comprise them in a file resembling the one you deleted (or lost due to corruption). However, even though the tool may indicate a "successful restoration", the corrupted files may remain inaccessible, depending on the severity of the corruption.

Fragmented file recovery

File fragmentation can occur when a file is stored across non-contiguous hard drive sectors. Such a scenario may cause the file to take longer to open and decrease the overall system performance. Fragmentation may be due to insufficient hard drive space or the file being saved, deleted, and re-saved over a specific period. Typically, larger files - high-res photos, videos, audio files - are more prone to fragmentation than smaller files.

File fragmentation can cause numerous issues for users - slow read/write speeds, sub-optimal storage capacity, system crashes, and more.

Recovering fragmented files may vary in difficulty, depending on the scenario. The file system - FAT or NTFS - carries information about the exact sectors on the hard disk containing a specific file. If there are available records regarding the file in the file system, then the data can be restored regardless of it being fragmented. However, suppose your hard disk is low in free space. In that case, there's a high chance that parts of the fragmented file are already overwritten with other data, making restoration via recovery software extremely challenging.

Moreover, if the file system contains no records regarding the fragmented file (or if the file system is unavailable), many robust tools will attempt a signature-based search to read all sectors on the hard disk and try to detect known file types. Such algorithms rely on the presence of a file header having a specific structure (and potentially a fixed signature). They analyze the file header to pinpoint the beginning of the file and calculate its length. However, such an approach assumes the file is stored in a single, continuous chunk. As fragmented files aren't stored contiguously, even the most advanced signature-based search algorithm may fail to restore them correctly (unless it locates a corresponding record in the file system).


Sometimes, while browsing files on your computer, you can missclick and accidentally delete one. In such a case, you quickly open the Recycle Bin and restore the file to its original location. However, what if you haven't noticed that you've deleted an important file? Or if a file is deleted due to a system crash or malicious activity within your network? Or if a file is corrupted or fragmented due to hardware failure or a ransomware attack? How to restore a deleted file in such a case?

Well, the short answer is "you have two options" - dedicated file recovery software or reliable backup.

The first approach can rely on high-end data recovery software to scour your hard drive and piece the deleted file back together. In most cases, it will succeed in recovering lost data. Sometimes, however, it won't be able to restore all files due to severe file corruption, data fragmentation, or malicious interference.

The second approach - regular, continuous backup - can ensure you always have a readily available data copy to recover deleted files. Robust solutions, such as Acronis True Image, can automate sensible backups to ensure all newly created data is saved to both local and cloud storage. Whenever a data loss event occurs, you can quickly and efficiently restore individual files or your entire system to the same or dissimilar hardware in just a few clicks.

Acronis True Image
For Home Office

Protect, Backup, and Recover - Trust Our Solutions!

About Acronis

A Swiss company founded in Singapore in 2003, Acronis has 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect Cloud is available in 26 languages in 150 countries and is used by over 20,000 service providers to protect over 750,000 businesses.