Immediate recommendation: enable Airplane mode and stop adding new media or documents to the device to minimize overwrite risk; if possible, power the device down and remove any external SD card before any further action.

Cloud check first: inspect Google Photos Trash (items retained for 60 days), Google Drive Trash (30 days), your OEM cloud (Samsung Cloud, OnePlus backup) and any third‑party sync (Dropbox, OneDrive). Restoring from cloud copies is fastest and avoids any scans that write to internal storage.

If no cloud copy exists, extract the removable card and attach it to a PC via a card reader; run a sector‑level imaging tool (dd, Win32 Disk Imager) to create a raw image, then run PhotoRec or DMDE on the image rather than the original card. For internal flash, enable Developer Options → USB debugging and use adb to pull user folders (/sdcard/DCIM, /sdcard/Pictures) to a local drive before attempting deeper scans.

Choose recovery software based on access level: non‑root tools (DiskDigger, PhotoRec) can restore many media types without elevated privileges; root‑level utilities (Undeleter, Tenorshare UltData, Dr.Fone with root) allow raw partition access and higher success rates but may void warranty or trigger security wipes. Prefer PC utilities that scan an image file rather than installing apps on the subject device.

Order of operations: 1) cloud restore, 2) card imaging + PC scan, 3) image-based scan of internal storage, 4) vendor restore tools, 5) professional lab if data value is high. Keep records of each attempt, avoid firmware updates or factory resets, and if data integrity is critical, stop and consult a specialist rather than performing risky procedures yourself.

Initial assessment and quick precautions

Stop all write activity now: turn on Airplane mode, disable Wi‑Fi and mobile data, stop camera and syncing apps, and avoid creating new photos, messages or downloads.

Remove external storage: eject any microSD card and keep it aside in an anti‑static sleeve. Use a USB card reader to access the card from a PC for imaging rather than using the phone.

Check cloud trash and backups immediately: open Google Photos Trash at https://photos.google.com/trash (items remain up to 60 days for media), and Google Drive Trash at https://drive.google.com/drive/trash (items auto‑deleted after 30 days). Inspect OneDrive, iCloud (if applicable) and any OEM cloud accounts for recent snapshots.

Record device metadata: note model, build number and Android version from Settings > About phone. Capture the timestamp of the last automatic backup: Settings > Google > Backup (or Settings > Accounts and backup on some OEMs). Save screenshots or photos of these screens on a separate device.

Do not install recovery apps on the handset: installing helpers or utilities to internal storage causes writes that lower the chance of restoring lost data. If you must run a utility, do it from a PC and access the phone in read mode.

If USB debugging is already enabled: attach the phone to a trusted PC and run adb pull /sdcard/ ~/phone_backup to copy user storage. Do not enable USB debugging if it was off: that changes system state and can overwrite data.

Image removable storage before any attempts at restoration: on Linux, use dd if=/dev/sdX of=~/sdcard.img bs=4M conv=sync,noerror (replace /dev/sdX with the reader device). Verify image integrity with sha256sum of both source and image.

Avoid rooting or factory resets: rooting may trigger background writes; a factory reset will wipe partitions and remove any chance of later retrieval. If internal storage imaging is required, prefer a specialist lab unless you have forensic tools and experience.

Check app‑specific backups next: WhatsApp: Settings > Chats > Chat backup (note backup date and whether Google Drive backup exists); Telegram: confirm cloud messages via desktop client; camera apps or third‑party galleries may maintain their own trash folders–inspect each app’s settings and "recent" or "trash" sections.

Document every action: keep a timestamped log of steps taken, connections made and tools used. That log helps avoid repeated writes and supports professional help if escalation is needed.

Identify exact file types and locations deleted

Create an inventory of MIME types and absolute paths before performing any write operations on the storage.

Common extensions to list and search for: images – .jpg, .jpeg, .heic, .png; video – .mp4, .mov, .3gp; audio – .mp3, .m4a, .wav; documents – .pdf, .docx, .xlsx, .pptx; archives and packages – .zip, .rar, .tar, .apk; databases and app stores – .db, .sqlite; thumbnails – .thumb, .thm. Also include hidden names starting with a dot (.). Record expected MIME types (image/jpeg, video/mp4, application/pdf, etc.).

Typical user-accessible paths to check (use exact spelling when querying): /storage/emulated/0/DCIM/Camera; /storage/emulated/0/Pictures; /storage/emulated/0/Movies; /storage/emulated/0/Music; /storage/emulated/0/Download; /storage/emulated/0/DCIM/.thumbnails; /storage/XXXX-XXXX/ for SD card mounts. App-specific locations: /storage/emulated/0/WhatsApp/Media/WhatsApp Images and /WhatsApp/Databases; /storage/emulated/0/Telegram/; /storage/emulated/0/Android/media//; /storage/emulated/0/Android/data// (app cache and data). System-only area: /data/data//databases (root required).

Use exact-match strategies rather than broad scans: search by extension plus size and timestamp ranges. Example quick queries via adb (device must allow debugging): adb shell ls -R /storage/emulated/0 | grep -Ei '\.(jpg|jpeg|heic|png|mp4|mov|mp3|pdf)$' and adb shell find /storage/emulated/0 -type f -iname '*.jpg' -printf '%p %s %TY-%Tm-%Td %TH:%TM:%TS

'.

Verify type by magic bytes and metadata, not only by extension: pull a sample with adb pull and run file --mime-type sample on your workstation, or run exiftool -j sample to read EXIF dates and camera model. For databases, use sqlite3 to inspect schema and tables (sqlite3 sample.db '.tables').

Query the media index to map original locations and timestamps (root may be required for direct DB access). Example: adb shell cmd content query --uri content://media/external/file --projection _data,mime_type,_size,date_added --where "mime_type='image/jpeg'". For direct DB: sqlite3 /data/data/com.android.providers.media/databases/external.db "SELECT _data,mime_type,_size,date_added FROM files WHERE _data LIKE '%DCIM%';"

Correlate metadata fields to pinpoint exact target: match date_added/date_modified and _size from MediaStore to a candidate item on storage; compare checksum (md5sum) of any thumbnail in /DCIM/.thumbnails with a retrieved blob to confirm identity before further actions.

Check cloud and app backups next: Google Drive/Photos, OneDrive, Dropbox, and service-specific backup files (example: WhatsApp local backups under /WhatsApp/Databases/msgstore*.crypt12 and corresponding cloud backups). Export app export or backup lists where available and compare timestamps and sizes to local inventory.

Export a snapshot of the current media index to CSV to prioritize targets: adb shell sqlite3 /data/data/com.android.providers.media/databases/external.db "SELECT _id,_data,mime_type,_size,date_added FROM files;" > media_index.csv, then filter by directory, extension, size and date to produce a precise retrieval plan.