150 GB of data gone. Can I at least find out what/when?

Lost Data Incident: Is There a Way to Trace Deleted Files on Windows SSDs?

Data loss can be a frustrating experience, especially when it involves a significant amount of information. If you’ve recently discovered that approximately 150 GB of your valuable files have vanished from your Windows-based SSD, you’re not alone. While restoring the data may not always be possible, understanding how and when files were deleted can provide some valuable insights.

Understanding the Situation

In this scenario, the user transferred around 150 GB of personal files from previous laptops onto a new Windows machine. Over time, these files are suddenly missing, and the last access was a couple of months ago. The user is uncertain about the exact timeline or the cause of deletion and is seeking methods to trace the whereabouts of the files.

Key Challenges

• The files were stored on an SSD (Solid State Drive), which affects data recovery options.
• The deletion may have occurred due to accidental removal, system cleanup, or other reasons.
• No recent backups are mentioned, complicating recovery efforts.

Is Data Recovery Possible?

While full restoration might not be guaranteed without backups, certain methods can help determine whether traces of the deleted data still exist and glean some information about the deletion event:

1. Check the Recycle Bin:
   The simplest step is to verify whether the files are still in the Recycle Bin. However, files deleted using Shift + Delete or emptied from the Bin won’t be recoverable this way.

2. Use File History or Backup Systems:
   If Windows File History, System Restore points, or third-party backup solutions are enabled, they might contain previous versions of the folders or files.

3. Examine the Event Log:
   Windows logs various system events, including file deletions, which can sometimes be traced through Event Viewer.

4. Open Event Viewer (eventvwr.msc).

5. Look under Windows Logs -> Security for audit events related to file deletion, if auditing was enabled.

6. Employ Data Recovery Software:
   Specialized tools such as Recuva, EaseUS Data Recovery Wizard, or Stellar Data Recovery can scan SSDs for remnants of deleted files.

7. These tools may reveal file metadata such as deletion timestamps, which can help establish when the files were removed.

8. Review System and Drive Logs:
   Some SSD manufacturers or system monitoring tools log drive activity. Check if any logs are available that record file