Recovering deleted files
The goal in recovering data from any media is to reach the point where an engineer can read the files, copy them onto sound replacement media and verify that what came back is intact.
It is worth stressing that you should shut the computer down as soon as it becomes clear that a recovery is going to be needed. Every further use of the machine reduces the chances. Above all avoid installing software — downloading and installing anything writes to the disk and may overwrite exactly the files you are trying to get back — and avoid copying new files onto the machine.
Recovery depends on the file system
The approach is matched to the file system on the media in question, and there are several in common use:
FAT32 / FAT16 / exFAT
This family is very widespread on Microsoft operating systems and appears mainly on memory cards, USB devices and older computers. Because these file systems have been in use for many years, they are well supported elsewhere too. Recovering from them requires a thorough understanding of their internal structures, so the source of the fault can be located and the right tools chosen to bring back the largest number of files intact. Where damage is particularly extensive, recovery may be partial and file names may be scrambled.
NTFS
The standard on modern Windows systems. It keeps far richer metadata than FAT, which often makes a fuller reconstruction possible — including original file names and folder structure — provided the master file table has not been overwritten.
HFS+ and APFS
These are the file systems used on Apple computers, and they behave differently enough that they need their own tooling and experience.
Ext4, XFS, Btrfs and others
These are used on Linux and other UNIX systems, and are frequently what you find inside a NAS. Recovering deleted files from them usually calls for considerable experience with UNIX file systems and recovery tools suited to the specific system. In some cases purpose-built tools have to be written to assist the process.
Verification
After the recovery we check the integrity and completeness of what was retrieved. Alongside sampling images and documents, we run integrity checks on mail files and on database files such as those from MS SQL, Oracle and others — because a database that opens but is internally inconsistent is not really recovered.