A Shift+Deleted accounts folder, two days before payroll
An entire year's bookkeeping removed with one confident keystroke on an office desktop. The drive was imaged that afternoon, the file table rebuilt, and the folder came back with every filename and date intact.