When files disappear, the first hour matters. The wrong recovery app, a forced restart loop, a full cloud sync, or copying new files onto the same drive can reduce the chance of getting data back.
For Sydney homes and small businesses, the right response depends on what happened: accidental deletion, failed storage, cloud sync confusion, ransomware, a damaged laptop, or a backup that has not been checked for months. Treat data recovery as triage, not guesswork.
| Situation | First action | Avoid |
|---|---|---|
| Deleted files on a working Windows or Mac computer | Stop saving new files and check recycle bin, cloud recycle bins, and backups | Installing recovery tools onto the same drive |
| External drive not recognised | Disconnect it and note sounds, lights, cable, and recent drops | Repeated plugging, formatting, or running repair prompts |
| Clicking or grinding drive | Power it off and get advice before another attempt | Free recovery scans that stress failing hardware |
| OneDrive, SharePoint, iCloud, or Google sync mistake | Pause sync where possible and check online recycle/version history | Deleting local files to "clean up" before understanding sync state |
| Ransomware or suspicious encryption | Disconnect affected devices and preserve evidence | Restoring backups before the infection is understood |
| Business files missing from a shared location | Record who noticed it, when, and what changed | Letting multiple staff try fixes at the same time |
Step 1: Stop writing to the affected storage
Deleted files are often not erased immediately. The computer may simply mark that space as available. New downloads, app updates, browser caches, photos, mail sync, and recovery software can reuse that space and overwrite what you are trying to save.
If the missing data is important, stop normal use. For a laptop or desktop, shut down if you can do so normally. For an external hard drive or USB stick, eject it if possible and unplug it. For a business shared folder, pause and coordinate before several people make changes.
Step 2: Work out what type of loss it is
Good recovery starts with diagnosis. Ask:
- Was the file deleted, moved, renamed, overwritten, or synced somewhere else?
- Is the computer or drive physically failing?
- Is this a cloud storage issue or a local disk issue?
- Is there a known backup, and when was it last tested?
- Are there ransomware warnings, strange extensions, or ransom notes?
- Is the data unique, sensitive, or business-critical?
This decides whether you should check ordinary restore options first or stop immediately for a safer assessment.
Step 3: Check recycle bins and cloud restore options
Start with low-risk recovery paths. Windows and macOS have local trash/recycle locations. OneDrive, SharePoint, Google Drive, Dropbox, and iCloud can also have their own online deleted-items and version-history areas.
Microsoft's OneDrive restore guidance is useful when many files were deleted, overwritten, corrupted, or affected by ransomware-like changes. Microsoft also documents SharePoint site recycle bin recovery, which matters for Microsoft 365 business users because a synced deletion on one PC may affect shared cloud files.
For Mac users, Apple Time Machine can restore individual files, folders, or older versions when a valid backup exists. Check the backup before wiping, reinstalling, or replacing the Mac.
Step 4: Do not repair a failing drive before copying the data
When Windows, macOS, or a disk utility offers to repair, initialise, erase, format, or rebuild a drive, stop and read carefully. Those actions can be useful after data is safe, but they may change the disk before the important files are copied.
Warning signs that need caution include:
- Clicking, beeping, grinding, or repeated spin-up sounds
- Drive appears and disappears
- Computer freezes when the drive is connected
- Very slow copying or repeated read errors
- Water damage, drop damage, or overheating
- Messages asking to initialise, erase, or format the disk
In these cases, recovery should usually happen to another drive, not back onto the failing one.
Step 5: Treat ransomware differently
Ransomware is not ordinary file loss. If files have strange extensions, ransom notes appear, or several devices are affected, disconnect from the network and avoid restoring backups until the incident is understood.
The Australian Cyber Security Centre says backups are one of the best recovery methods for ransomware, but the backup must be unaffected. Restoring too early can reconnect clean backups to an infected device or restore files into an unsafe environment.
For a small business, preserve times, screenshots, affected users, ransom notes, email clues, and security alerts. That record helps with support, cyber insurance, legal reporting decisions, and vendor escalation.
Step 6: Decide whether DIY recovery is worth the risk
DIY recovery can be reasonable for low-risk cases, such as one accidentally deleted personal file on a healthy computer with no clicking drive and no ransomware signs. Even then, recover to a separate disk and avoid installing tools onto the same storage you are recovering from.
Get help first when:
- The drive makes unusual noises
- The missing files are the only copy
- A business depends on the data
- There is possible ransomware or malware
- A laptop was dropped, wet, or will not power on
- BitLocker, FileVault, or password access is unclear
- Several staff or devices are involved
Sydney businesses should also consider downtime. Spending a day on risky recovery attempts can cost more than a controlled triage and restore plan.
Step 7: Restore to a clean destination
Recovered files should go to a separate destination: another external drive, a verified cloud location, or a replacement computer. Do not restore important data back onto the same failing drive and keep the original device untouched until the recovered files have been checked.
For business data, test a sample before declaring success:
- Open key documents, spreadsheets, PDFs, and databases.
- Check folder structure and file dates.
- Confirm accounting, practice, quoting, or design software can open its data.
- Verify permissions for shared folders.
- Confirm the backup or restored copy is included in the next backup cycle.
Sydney examples
A family in an apartment may have an old external drive with photos, a Mac using Time Machine, and iCloud Photos syncing across phones. The safest sequence is not to click every prompt. Check iCloud and Time Machine first, then assess the external drive separately if it shows failure signs.
A small clinic, retail shop, trades office, or professional services firm may have Microsoft 365 files synced to several laptops. One staff member deleting a folder locally can remove it from SharePoint or OneDrive for everyone. In that case, stop the sync churn, check Microsoft 365 restore options, and make sure nobody is "cleaning up" the same folder at the same time.
A home office laptop that will not boot may still have a healthy SSD inside, but forcing repairs, resets, or reinstallations before copying files can create avoidable risk. Recover the data first, then repair or replace the device.
Prevention after recovery
Once the immediate problem is handled, set up a backup plan that is boring enough to keep working:
- Cloud backup or sync for current documents and photos
- External drive backup for larger local data
- Time Machine for Mac where suitable
- Microsoft 365 restore and retention settings reviewed for business users
- At least one copy not constantly writable by the same everyday account
- A calendar reminder to test restore, not just check that backups "ran"
The ACSC's Essential Eight assessment material includes checks around backup access, restoration, and whether ordinary users can access other users' backups. That principle scales down well: backups should be protected from the same mistake, malware, or compromised account that damaged the original files.
When to book data recovery support
Book support before repeated DIY attempts if the data matters more than the device. Everyday Computing can help Sydney homes and small businesses assess deleted files, cloud restore options, failed drives, Mac Time Machine, OneDrive or SharePoint recovery, backup setup, and repair-versus-replace decisions. Physical drive recovery is never guaranteed, and specialist lab recovery may be needed for severe hardware failure, but careful first steps give you the best chance.