How to Recover Deleted Data from Excel Files
Deleted data in Excel files is rarely gone for good. The XLSX file format, revision history, and operating system backups create multiple recovery paths that forensic investigators—and anyone with the right knowledge—can exploit.
Why Deleted Excel Data Often Survives
When someone deletes data from an Excel spreadsheet—whether by clearing cells, removing rows, deleting entire sheets, or overwriting formulas with static values—they typically assume the data is gone. In most cases, they are wrong. Excel's file format, its built-in recovery mechanisms, and the way operating systems handle file storage all conspire to preserve data long after a user believes it has been destroyed.
This reality matters enormously in forensic investigations, legal disputes, compliance audits, and data recovery scenarios. Whether you are trying to recover accidentally deleted financial records, investigating potential document tampering, or conducting an audit trail analysis, understanding how to find deleted data in Excel files is an essential skill.
Where Deleted Data Can Survive
- • XLSX XML structure: Orphaned references, shared strings, and style definitions that outlive the cells they served
- • Undo history: Excel's in-session undo buffer retains every change since the file was opened
- • AutoRecover files: Temporary snapshots saved at regular intervals by Excel
- • Previous versions: Operating system file versioning and cloud sync history
- • Shared workbook logs: Change tracking data embedded in collaborative workbooks
- • Temporary files: Excel's working copies that may persist after a crash or improper closure
- • File system remnants: Disk sectors that retain overwritten file data until physically overwritten
Understanding the XLSX File Structure
Before diving into recovery techniques, it is essential to understand how Excel stores data. An XLSX file is actually a ZIP archive containing a collection of XML files organized in a specific directory structure. This architecture is the foundation of most recovery methods.
Inside an XLSX File
Rename any .xlsx file to .zip and extract it. You will find a directory structure that separates content, styles, relationships, and metadata into individual XML files.
MyWorkbook.xlsx (renamed to .zip)
├── [Content_Types].xml
├── _rels/
│ └── .rels
├── xl/
│ ├── workbook.xml
│ ├── sharedStrings.xml ← all text values
│ ├── styles.xml ← formatting definitions
│ ├── worksheets/
│ │ ├── sheet1.xml ← cell data and formulas
│ │ └── sheet2.xml
│ ├── charts/
│ ├── drawings/
│ └── printerSettings/
└── docProps/
├── app.xml ← application metadata
└── core.xml ← author, dates, title
The key insight is that when cells are deleted in the Excel interface, the corresponding entries are removed from the worksheet XML. However, related entries in sharedStrings.xml and styles.xml often remain intact, creating forensic artifacts that reveal what was once there.
The Shared Strings Table: A Forensic Goldmine
Excel stores all text values in a centralized table called sharedStrings.xml. When a cell containing text is deleted, Excel removes the cell reference from the worksheet XML but does not always clean up the corresponding entry in the shared strings table. This is because rebuilding the string indices for all remaining cells is computationally expensive, so Excel often defers this cleanup.
What You Might Find
- • Names of deleted employees or clients
- • Product names removed from a catalog
- • Category labels from deleted columns
- • Notes or comments that were cleared
- • Address or contact information
Limitation
Orphaned shared strings tell you that certain text once existed in the workbook, but they do not tell you which cell or sheet contained it. You know the data was there; you do not know exactly where. Cross-referencing with style orphans and worksheet structure can sometimes narrow it down.
Recovery Method 1: Direct XML Examination
The most direct method of finding deleted data is to examine the raw XML contents of the XLSX file. This technique requires no special software—just a file archiver and a text editor.
Extract the XLSX Contents
Make a copy of the XLSX file first—never work on the original. Rename the copy from .xlsx to .zip and extract it using any archive utility (7-Zip, WinRAR, or the built-in OS archive tool).
# Make a working copy
cp suspicious_file.xlsx analysis_copy.xlsx
# Rename and extract
mv analysis_copy.xlsx analysis_copy.zip
unzip analysis_copy.zip -d analysis_contents/
Important: Always work on a copy. Modifying the original file could destroy evidence and compromise the chain of custody in a forensic investigation.
Analyze the Shared Strings Table
Open xl/sharedStrings.xml in a text editor. Each <si>element represents a unique text string used somewhere in the workbook. Count the total strings and compare against the strings actually referenced in the worksheet XML files.
<sst count="247" uniqueCount="189">
<si><t>Employee Name</t></si>
<si><t>John Smith</t></si>
<si><t>Jane Doe</t></si> ← referenced in sheet
<si><t>Mark Johnson</t></si> ← orphaned (deleted?)
<si><t>TERMINATED</t></si> ← orphaned (deleted?)
...
</sst>
Any string present in the shared strings table but not referenced by any cell in any worksheet is a potential recovery artifact. It may represent data that was deleted from the visible spreadsheet.
Check for Orphaned Styles and Formatting
The xl/styles.xml file defines number formats, fonts, fills, and borders. When cells are deleted, their style definitions often remain. A style defined as a currency format with two decimal places suggests financial data was once present, even if the cells are now empty.
Revealing Style Artifacts
- • Custom number formats (e.g.,
#,##0.00;[Red]-#,##0.00) - • Named cell styles referencing deleted ranges
- • Conditional formatting rules for cells that no longer exist
- • Data validation rules with orphaned references
What This Tells You
If you find 15 currency-formatted style definitions but only 8 cells in the workbook use currency formatting, the remaining 7 styles likely belonged to deleted financial data. Combined with orphaned shared strings, this builds a picture of what was removed.
Examine Worksheet Dimensions and Gaps
Each worksheet XML file contains a <dimension> element that records the used range of the sheet. If data was deleted but the dimension was not recalculated, the range will be larger than the actual data, indicating deleted content.
<!-- Dimension says data extends to column J, row 500 -->
<dimension ref="A1:J500"/>
<!-- But actual cell data only goes to column F, row 200 -->
<!-- Rows 201-500 and columns G-J likely contained deleted data -->
Also look for gaps in row numbers. If the XML jumps from row 45 to row 52, rows 46 through 51 were deleted. The gap pattern reveals the structure of the removed data.
Recovery Method 2: AutoRecover and Temporary Files
Excel automatically saves recovery copies of open workbooks at regular intervals (every 10 minutes by default). These AutoRecover files can contain versions of the data from before it was deleted.
AutoRecover File Locations
Windows
C:\Users\[Username]\AppData\Roaming\Microsoft\Excel\
C:\Users\[Username]\AppData\Local\Microsoft\Office\UnsavedFiles\
C:\Users\[Username]\AppData\Local\Temp\
macOS
/Users/[Username]/Library/Containers/com.microsoft.Excel/
Data/Library/Application Support/Microsoft/Office/
Office AutoRecovery/
AutoRecover files use the .xlsb or .xar extension and follow the naming pattern of the original file. Look for files with timestamps that predate the deletion event.
Temporary File Recovery
When Excel opens a workbook, it creates temporary working files in the same directory as the original file. These temporary files (prefixed with ~$or ~DF) are normally deleted when Excel closes properly. However, if Excel crashes or the system shuts down unexpectedly, these files persist.
Temp File Patterns
- •
~$filename.xlsx— lock file with user info - •
~DFxxxx.tmp— working copy of the file - •
filename.tmp— backup during save - •
~WRxxxxx.tmp— Word temp (similar pattern)
Recovery Approach
Rename the .tmp file to .xlsx and attempt to open it in Excel. If the file is corrupted, try Excel's "Open and Repair" feature (File > Open > select file > click dropdown arrow on Open button > Open and Repair).
Recovery Method 3: Version History and Backups
Modern operating systems and cloud platforms maintain file version histories that can provide complete snapshots of the file before data was deleted.
Operating System Version History
Windows: Previous Versions
- • Right-click the file > Properties > Previous Versions tab
- • Windows File History creates hourly backups if enabled
- • Shadow copies from system restore points
- • Use
vssadmin list shadowsto find Volume Shadow Copies
macOS: Time Machine
- • Enter Time Machine and navigate to the file's location
- • Browse through hourly, daily, and weekly snapshots
- • APFS snapshots may exist even without Time Machine configured
- • Use
tmutil listlocalsnapshots /to find local snapshots
Cloud Platform Version History
If the file is stored on a cloud platform, version history is one of the most reliable recovery methods. Most platforms retain versions for extended periods.
OneDrive / SharePoint
Right-click > Version History. OneDrive retains versions for up to 30 days for personal accounts and longer for Microsoft 365 business accounts. SharePoint can be configured to retain up to 50,000 major versions.
Google Drive
Right-click > Manage Versions (for uploaded files) or File > Version History (for Google Sheets). Google retains versions for 30 days or 100 versions, whichever comes first. Workspace accounts may retain versions indefinitely.
Dropbox
Right-click > Version History. Dropbox Basic retains 30 days of history. Dropbox Business retains 180 days. Extended Version History add-on provides up to 10 years of retention.
Recovery Method 4: Track Changes and Change Logs
If Track Changes was enabled at any point, or if the workbook was configured for shared editing, Excel maintains a detailed log of every modification—including deletions. This log can reconstruct deleted data with precise timestamps and user attribution.
What Track Changes Records
Recorded Change Details
- • The exact cell reference modified
- • The old value (before the change)
- • The new value (after the change)
- • Who made the change (username)
- • When the change was made (timestamp)
- • The type of change (insert, delete, modify)
Accessing Track Changes Data
- • Review > Track Changes > Accept/Reject Changes
- • Filter by date range, user, or specific sheet
- • In the XML: look for
xl/revisions/directory - • Revision log files contain full change history
Key insight: Even if Track Changes is currently turned off, check the XML structure for a revisions folder. If Track Changes was ever enabled and then disabled, the revision history may still be present in the file. The act of disabling Track Changes does not always purge the historical log.
Recovery Method 5: Forensic Disk Analysis
When in-file recovery methods are insufficient, forensic disk analysis can recover previous versions of the entire file from the storage medium. This is the most technically demanding method but also the most comprehensive.
How Disk-Level Recovery Works
When a file is saved, the operating system writes the new version to disk. On traditional hard drives (HDDs), the old version's disk sectors are marked as available but not physically overwritten until the space is needed for new data. On solid-state drives (SSDs), the situation is more complex due to TRIM commands, but recovery is sometimes still possible.
HDD Recovery
- • High probability of recovering previous file versions
- • Deleted data persists until sectors are overwritten
- • File carving can reconstruct XLSX files from fragments
- • Tools: Autopsy, FTK Imager, Recuva, PhotoRec
SSD Recovery
- • Lower probability due to TRIM and wear leveling
- • TRIM commands can zero out deleted sectors quickly
- • Recovery window is much shorter than HDD
- • Success depends on SSD firmware and TRIM timing
File Carving for XLSX Recovery
Since XLSX files are ZIP archives, forensic file carving tools can search raw disk data for ZIP file signatures (the magic bytes PK\x03\x04) and attempt to reconstruct complete XLSX files from disk sectors.
# Using PhotoRec for XLSX file carving
# (run on a forensic image, never on the live disk)
photorec /d recovered_files/ forensic_image.dd
# Select the partition, then choose "xlsx" file type
# Recovered files will appear in recovered_files/ directory
Critical: Never run recovery tools directly on the original disk. Create a forensic image (bit-for-bit copy) first using tools like dd, FTK Imager, or dcfldd. Running recovery on the live disk can overwrite the very data you are trying to recover.
Common Recovery Scenarios
Different deletion methods leave different forensic traces. Here is how to approach the most common scenarios.
Scenario 1: Cells Were Cleared or Rows Deleted
What Happened
A user selected cells or rows and pressed Delete, or used Clear Contents. The cell data is gone from the visible spreadsheet, but the file has been saved in this state.
Recovery Path
- • Check sharedStrings.xml for orphaned text
- • Look for dimension mismatches in worksheet XML
- • Check AutoRecover files for pre-deletion versions
- • Look at version history (cloud or OS-level)
- • Examine Track Changes logs if available
Scenario 2: A Sheet Was Deleted
What Happened
An entire worksheet tab was deleted from the workbook. This removes the sheet's XML file and its relationship entry, but leaves traces elsewhere.
Recovery Path
- • Check for orphaned entries in sharedStrings.xml
- • Look for named ranges referencing the deleted sheet name
- • Examine formulas in remaining sheets for
#REF!errors - • Check chart data sources for references to the deleted sheet
- • Look at workbook.xml for residual sheet definitions
Scenario 3: Formulas Were Replaced with Static Values
What Happened
Someone copied a range and pasted it back as values only to remove formulas. This is commonly done to hide calculation logic before sharing a file.
Recovery Path
- • Look for named ranges that reveal formula logic
- • Check for external link references in workbook.xml
- • Examine defined names for function-like patterns
- • Look at conditional formatting formulas (often overlooked)
- • Check data validation formulas for calculation clues
- • Version history is the most reliable recovery path
Scenario 4: File Was Saved Over (Overwritten)
What Happened
A completely different file was saved with the same name, or the file was saved after extensive data deletion. The current file on disk has been entirely replaced.
Recovery Path
- • Windows Previous Versions / File History
- • macOS Time Machine snapshots
- • Cloud sync version history
- • Recycle Bin / Trash (if old version was deleted)
- • Forensic disk analysis for previous file versions
- • Email attachments (if file was previously shared)
Preventing Data Recovery: When You Want Data Truly Gone
Understanding recovery also means understanding how to ensure sensitive data is genuinely deleted when it needs to be. If you are cleaning a file before sharing it externally, these steps ensure deleted data cannot be recovered.
Complete Data Elimination Checklist
In-File Measures
- • Create a new blank workbook instead of modifying the original
- • Copy only the data you intend to share, pasted as values
- • Run Document Inspector (File > Check for Issues)
- • Remove all items the Inspector identifies
- • Run Inspector a second time to catch residual items
- • Delete all named ranges (Ctrl+F3)
- • Remove data connections and external links
- • Clear document properties
External Measures
- • Do not share the file from a cloud folder with version history
- • Verify no AutoRecover files exist for this workbook
- • If the file was previously shared, the old version is beyond your control
- • Consider converting to PDF if the recipient does not need to edit
- • Use our metadata analyzer tool to verify the file is clean
Quick Reference: Recovery Method by Situation
Which Recovery Method to Use
| Situation | Best Method | Success Likelihood |
|---|---|---|
| Cells cleared, file saved | XML analysis + version history | High |
| Sheet deleted, file saved | Version history + orphan analysis | High |
| Formulas replaced with values | Version history + named range analysis | Medium |
| File not saved after deletion | Undo (Ctrl+Z) or AutoRecover | Very High |
| File overwritten entirely | OS version history + disk forensics | Medium |
| File deleted from disk | Recycle Bin + disk forensics | Medium |
| New file created from scratch | No recovery possible from file itself | None |
Conclusion
The deletion of data from an Excel file is rarely the end of the story. The XLSX format's XML-based architecture leaves orphaned strings and styles. AutoRecover creates periodic snapshots. Operating systems and cloud platforms maintain version histories. And the underlying storage medium retains previous file versions until the sectors are physically overwritten.
For forensic investigators, this is valuable: it means that document manipulation, data destruction, and evidence tampering can often be detected and reversed. For anyone sharing sensitive spreadsheets, this is a warning: simply deleting data from a file before sharing it is not enough to ensure it cannot be recovered.
Whether you are recovering accidentally lost data, investigating potential fraud, or ensuring a file is truly clean before sharing, the techniques in this guide provide a systematic approach. Start with the simplest methods—undo and version history—before moving to XML analysis and disk forensics. The right method depends on when the deletion occurred, how the file was saved, and what recovery tools are available.
Analyze Your Excel Files for Hidden Data
Use our metadata analyzer to discover hidden data, orphaned strings, deleted content traces, and forensic artifacts in your Excel files