File recovery: getting back something somebody deleted

File recovery is a problem you solve in advance or not at all. At the moment somebody says "I think I overwrote it", the available options were fixed weeks earlier by settings nobody reviewed: how long deleted items are retained, whether versions are kept, and whether the backup anybody is relying on has ever been restored from. The useful work happens before the phone call.

The four things that make file recovery possible

• Version history on documents, so an overwrite is a rollback rather than a loss — the most common incident by a wide margin.
• A retention period for deleted items, known in days rather than assumed.
• A backup that is separate from the live system, because a deletion that syncs everywhere is not protected by a copy that also syncs.
• A restore that somebody has actually performed, at least once, deliberately.

Overwrite, delete and sync are different losses

An overwrite is recovered from version history and is usually a two-minute job. A deletion is recovered from the retention window, and the only question is whether you are inside it. A sync loss is the nasty one: the file was removed on one device and the removal propagated, so every copy agrees it is gone — which is precisely the case a mirrored copy does not help with. Knowing which of the three you are dealing with determines where to look first, and asking the person what they actually did is faster than guessing.

An untested restore is a plan, not a capability. Restore one real file from your actual backup, this quarter, and time it. The number you get is your real recovery time, and it is routinely several times longer than people assume.

What to check this week

1. Find out the retention period for deleted items and write it down where support questions get answered.
2. Confirm version history is enabled where documents are edited, and how far back it goes.
3. Identify what is held outside the sync boundary, and what is not — most teams discover something important is not.
4. Perform one restore end to end and record how long it took and who did it.
5. Note who is allowed to restore, because in an incident the bottleneck is often permission rather than technology.

After a recovery

Record what was lost, how it was recovered and what would have made it impossible. Most repeat losses come from the same two causes: a shared folder where somebody reorganises without asking, and a single authoritative copy nobody realised was single. Both are fixable in minutes once named, and neither gets named if the recovery is treated purely as a favour rather than as an incident.

Ettex Storage keeps version history on documents and a deleted-items window rather than immediate removal, with an access log showing who moved or removed what. Pairing recovery with a deliberate archive means the material you are keeping on purpose is not mixed with the material you are keeping because deleting felt risky.