03 · Workflow
Three moves that protect recoverability
Deletion drops pointers first; data may linger until overwritten. What you do next matters more than any single click.
Stop writes on the sick disk
Pause downloads, installers, sync, and games that patch often. Every new write competes with the clusters you hope are still intact.
- Close cloud folders that watch Desktop or Documents if those paths live on the affected volume.
- Run the tool from another volume or a portable copy so the app itself is not writing to the patient disk.
Match scan depth to reality
Standard pass for speed when deletes are recent and the volume still behaves; deep scan when files vanished, the card was “empty,” or the filesystem took damage.
- If quick mode finds nothing, one deep pass is reasonable before you assume the data is gone.
- Let long scans finish on wall power; sleep or USB power-save can stall removable media mid-run.
Save elsewhere. Always.
Never recover onto the partition you are scanning. Use external or secondary storage with enough free space for the largest files you care about.
- Recover into a dated folder so you do not mix runs or overwrite a half-good copy.
- פתחו a few recovered files in their real apps before you declare victory and reuse the source drive.
After you recover
Back up what mattered, document what failed (TRIM, full format, encryption), and retire flaky media. If the drive clicked or SMART looks ugly, clone or image before another heavy scan—software cannot fix mechanical failure.
First hour vs first day
The highest-risk window is immediate: installs, updates, and sync that reuse freed space. In the first hour, prioritize stopping writes and choosing the shallowest scan that still sees your paths.
Over the next day, you can afford a deep pass, swap cables, or image a flaky disk—but delay increases the odds of background churn. If the machine is a daily driver, schedule recovery when you can leave it on wall power uninterrupted.
Habits that quietly hurt recovery
- Recovering large batches straight back onto the scanned volume.
- Running disk cleaners or “optimizer” tools while a scan is mid-way.
- Assuming an external drive is healthy because the light blinks—bad bridges hide errors until mid-scan.
Snapshots, VMs, and shared PCs
Hyper-V checkpoints, VMware snapshots, and “undo disks” change what “deleted” means—sometimes the file still lives inside an older differencing layer. Check the hypervisor or backup product before you treat the guest OS as the only source of truth.
On shared or family machines, another profile’s installers or game patches may be writing to the same volume while you scan. A quick sign-out of other sessions (when policy allows) reduces surprise overwrites.
Mini checklist
- Wall power for long deep scans on laptops.
- Destination disk has more free space than your largest expected file.
- One recovery folder per run, dated in the name.