Why Can Deleted Photos Be Recovered? The Physics of Data Recovery

Why can deleted photos be recovered? Because deleting a file never touches the file itself. A camera’s Delete command clears the entry that names the file and marks its storage space as available again. The image data stays where the camera put it — until something writes over it. That is the entire mechanism recovery software exploits.

The corollary matters just as much. Recoverability is not a property of the software you install; it is a property of the card’s history since the deletion. If the card has been in use since, or if the storage controller has quietly reclaimed the space on its own, no tool can bring the file back. Knowing which of those two situations you are in is worth more than any scan you can run afterward.

Delete Clears the Name, Not the Picture

When you delete a photo, the camera edits that record:

• FAT32. The 32-byte directory entry stays in place, but the first byte of the file name is overwritten with 0xE5, the marker for “this entry is deleted.” In the File Allocation Table, the file’s cluster chain is rewritten as 0x00000000, meaning free.
• exFAT. The directory entry’s type byte falls from 0x85 (in use) to 0x05 (deleted). The allocation bitmap is updated to show those clusters as available.

Nothing in either operation writes to the data region. The camera changes a 32-byte record and a handful of allocation entries. On a 128 GB card, the bytes it actually rewrites amount to roughly one ten-thousandth of a percent of the card’s contents. That is why deletion feels instant and why the card’s “free space” figure jumps immediately.

Here is the part people get backwards: this clears the way for the file to be destroyed. The moment the entry is gone, the allocator regards those clusters as empty and will hand them to the next photo the camera takes. Deletion does not make a file less recoverable — it makes it more exposed.

What a Format Actually Rewrites

Formatting looks more drastic than deleting, and in the file system’s own terms it is: the camera discards the entire map. But the map is not the territory.

An in-camera format is a quick format. The camera writes a fresh volume boot record, rebuilds the File Allocation Table (or a clean exFAT allocation bitmap), and empties the root directory. What it destroys is the linking — which clusters belong to which file, what the file was named, and when it was written. What it leaves alone is every sector of image data, still sitting in the data region in the order the files were shot.

The duration tells you what happened. A 256 GB card formats in a second or two inside a camera, because only a few megabytes of metadata are being rewritten. A true full wipe at a realistic 40 MB/s would need well over an hour. If the format finished before you could take your finger off the button, the card’s content was never erased. The deeper mechanics are covered in what an in-camera format changes versus a computer format, and the structure it rebuilds is described in how cameras lay out a memory card.

The One Mechanism That Does Destroy Deleted Data

Modern hosts do not simply forget deleted data; some of them tell the storage device to throw it away. The command is called TRIM on SATA and Deallocate on NVMe, and its purpose is housekeeping: it lets the device know which logical addresses no longer hold live data so that the flash can be erased ahead of time. Once the media honors that instruction, the physical cells can be recycled at any later moment, without the host being involved and without any warning.

Whether your card does this depends on its interface:

• CFexpress Type A and Type B, and SD Express are NVMe-based. They implement Deallocate. A computer or reader that issues the command can put deleted footage in genuine danger within minutes of idle time.
• Standard SD, SDHC, SDXC (UHS-I and UHS-II) have no TRIM command in their command set at all. There is no standard way for a host to tell an ordinary SD card that a file is gone. This single omission is the largest reason memory card recovery works as often as it does — the same reason an SSD gives up deleted data that a card would have kept.

The absence of TRIM is not the same as absolute safety, for two reasons. First, the SD specification does define an ERASE command (CMD38), and some hosts use it: Android’s adoptable storage issues discard operations on deletion, and a few devices offer a “free up space” or secure-erase routine that walks the card. Second, and more common, is write amplification. A card that is nearly full and still being written to must periodically relocate still-valid pages to free an erase block for reuse. Those relocations land on physical blocks chosen by the controller’s wear-leveling logic, which has no idea which files you deleted — it can only see which blocks are still valid to itself. Heavy use after a deletion, on a crowded card, is what turns “deleted” into “erased.” A card left on a shelf is a time capsule; the same card after another 4,000 shots is a shredder, and how NAND wear works inside a card explains why.

How Software Finds Files the File System Forgot

With the directory entry gone, an undelete utility has nothing to read. That is why a simple undelete scan reports “no files found” on a formatted card while a deep scan reports thousands. Deep scanning abandons the file system and reads the data region directly, matching known byte patterns to identify file types.

File type	Signature bytes at the start	Where the pattern sits
JPEG	FF D8 FF	Byte 0; ends with FF D9
TIFF-based RAW (NEF, ARW, CR2, PEF)	49 49 2A 00 or 4D 4D 00 2A	Byte 0
MP4 / MOV	the ASCII box name ftyp	Bytes 4 to 7
HEIC / HEIF	ftyp followed by brand heic or mif1	Bytes 4 to 7
CR3	crx box after a TIFF header	Around byte 8

Signature matching has consequences worth knowing. Carved files return without file names, without the camera’s folder structure, and without reliable timestamps, because that metadata lived in the directory entries the format destroyed. Photos carve relatively cleanly because JPEG carries an end marker. Video does not: an MP4 or MOV file’s length and frame index live in a separate metadata box near the start or end of the file, so a clip whose index is missing may be recovered in full but refuse to open in a player until the container is rebuilt — the subject of repairing video files with a missing index.

A Table: What Survives Which Operation

The practical answer to “is it still there?” is not a single yes or no. It depends on the operation and on what happened afterward.

What happened	What it changes	What happens to image data	Still recoverable
Photo deleted in camera	One directory entry plus its allocation chain	Untouched	Yes, until those clusters are reused
“Delete all” in camera	Every directory entry; data region untouched	Untouched	Yes, same conditions
Format performed inside the camera	Fresh boot record, new allocation table, empty root directory	Untouched	Yes, if no full wipe was invoked
Quick format on Windows or macOS	File system rebuilt, data region untouched	Untouched	Yes
Full format, low-level format, or secure erase	Every sector written over	Physically overwritten	No
Card reused after deletion or format	New files claim the freed clusters	Partially or wholly overwritten	Partially at best
Deallocate or discard issued on CFexpress or SD Express	Device told to reclaim the addresses	Recycled in the background	Often no
Card heavily written while nearly full	Copy-back garbage collection relocates valid pages	Some blocks recycled	Unpredictable

How Long Do Deleted Photos Stay Recoverable?

There is no clock, only a write counter. Two cards that were formatted an hour apart can have completely different outcomes a year later, because the variable that decides the result is how much data has been written to the card since — not how much time has passed.

This produces a genuinely counterintuitive pattern. People run a scan and find photographs from a holiday three years ago, still intact, while the images deleted yesterday do not appear at all. The reason is allocation order. FAT and exFAT hand out free clusters in a roughly predictable sequence, and the clusters freed by the most recent deletion are usually the next ones the camera reaches. Recent deletions sit at the front of the queue for destruction; older files, whose clusters are buried further along, can survive for years.

The same logic explains scattered results after a long period of use. If files were copied off and deleted individually across many sessions, the survivors are distributed unevenly across the card, and a scan will return a patchwork rather than a clean shoot. It also explains why a heavily used card in a phone — where the operating system issues discard operations on deletion — can return nothing while an identical card out of a camera returns everything. If the space has already been reclaimed, the data is genuinely unrecoverable, and no amount of scanning changes that.

What to Do in the Next Ten Minutes

The physics above translate into a short list of actions. Every one of them is about avoiding writes to the card.

1. Stop using the camera immediately. No test frames, no menu browsing that might write a settings file, no reformatting “to see if it helps.”
2. Remove the card and put it in a card reader, not back in the camera over USB. Tethering a camera lets its firmware keep writing while connected.
3. Image the card before scanning it if the contents are irreplaceable. Creating a byte-for-byte copy with a tool such as ddrescue means all later work happens on the copy, so a failed scan cannot cost you anything — the procedure is set out in imaging a card before recovery.
4. Scan the card or the image in deep mode, and save the recovered files to a different drive. Never write results back to the card.
5. Verify what comes back before deleting anything else, using a structured check of the recovered files.

If you are on Windows and the card is still detected by a computer, a purpose-built recovery tool such as XRecovery (xappset.com) can scan SD, microSD, and other memory cards for deleted or formatted photos and videos. As with any recovery tool, stop writing to the card first and always save recovered files to a different drive. When the deletion was recent and the card has been idle since, a targeted scan is often all that is needed; when the card has been in continuous use, the same scan may return only fragments. The full decision path from that point is in the step-by-step recovery playbooks.

Frequently Asked Questions

Why can deleted photos be recovered after the card was formatted?

Because a camera format is a quick format. It rebuilds the file system’s index — boot record, allocation table, empty root directory — while leaving every sector of image data in place. Unless a full format or secure erase was run, files remain on the card until new data overwrites them.

Does deleting a photo actually erase it from the card?

No. Deletion clears the directory entry that names the file and marks its clusters as free, so nothing is destroyed. It does make the file vulnerable: the freed clusters become the next space the camera will write to, which is why the card should come out of the camera straight away.

Why did my scan find old photos but not the ones I deleted yesterday?

Allocation order. FAT and exFAT assign free clusters in a broadly sequential pattern, so the space released by the most recent deletion is typically the first to be reused. Older files sit further along the card and often survive, while recent deletions are the most exposed.

How long do deleted photos stay on an SD card?

Until the space is reused or reclaimed, which has nothing to do with elapsed time. A card left in a drawer can hold recoverable data for years. The same card after another few thousand shots may have lost those files permanently. Stop writing to the card and scan it as soon as possible.