How to Recover Deleted Files with Windows File Recovery app in Windows 10
If you can’t locate a lost file from your backup, then you can use Windows File Recovery, which is a command line app created by Microsoft available from the Microsoft Store. Use this app to try to recover lost files that have been deleted from your local storage device (including internal drives, external drives, and USB devices) and can’t be restored from the Recycle Bin. Recovery on cloud storage and network file shares is not supported.
Accidentally deleted an important file? Wiped clean your hard drive? Unsure of what to do with corrupted data? Windows File Recovery can help recover your personal data.
For photos, documents, videos and more, Windows File Recovery supports many file types to help ensure that your data is not permanently lost.
Recovering from a camera or SD card? Try Signature mode, which expands beyond NTFS recovery and caters to your storage device needs. Let this app be your first choice for helping to find what you need from your hard drive, SSD (*limited by TRIM), USB drive, or memory cards.
See also: Recover lost files on Windows 10 | Microsoft Support
Since the initial release of Windows File Recovery, the team has received tons of feedback and inquiries about the app. This update includes performance improvements, bug fixes, and the introduction of 2 simplified recovery modes! Regular mode is a fast recovery option for NTFS file systems and extensive mode is a thorough search that applies to most file systems. The update is available to Windows Insiders and will be released to the general public (Windows 10 May 2020 Update and higher) in early 2021.
This tutorial will show you how to use the Windows File Recovery command line app to try and recover deleted files in Windows 10.
The Windows File Recovery app requires Windows 10 build 19041 or higher.
You must be signed in as an administrator to run the Windows File Recovery app.
If you want to increase your chances of recovering a file, minimize or avoid using your computer. In the Windows file system, the space used by a deleted file is marked as free space, which means the file data can still exist and be recovered. But any use of your computer can create files, which may over-write this free space at any time.
Here's How:
1 If you haven't already, you will need to download and install the Windows File Recovery command line app from the Microsoft Store. (see screenshot below)
2 Open the Windows File Recovery app from your Start menu to run it.
3 If prompted by UAC, click/tap on Yes to approve running as administrator.
4 Windows File Recovery will now open a maximized elevated command prompt window for you to use the winfr command in the following format to try and recovery deleted files. (see screenshot and tables below)
USAGE:winfr source-drive: destination-folder [/switches]
See also: Recover lost files on Windows 10 | Microsoft Support
The source and destination drives must be different. When recovering from the operating system drive (often C: ), use the /n <filter> and /y:<type<(s)> switches to specify the user files or folder.
Microsoft automatically creates a recovery folder for you called, Recovery_<date and time> on the destination drive.
Command Usage:
See also: Recover lost files on Windows 10 | Microsoft Support
There are three modes you can use to recover files: Default, Segment, and Signature.
The three modes work in the following way:
- Default mode = This mode uses the Master File Table (MFT) to locate lost files. Default mode works well when the MFT and file segments, also called File Record Segments (FRS), are present.
- Segment mode = This mode does not require the MFT but does require segments. Segments are summaries of file information that NTFS stores in the MFT such as name, date, size, type and the cluster/allocation unit index.
- Signature mode = This mode only requires that the data is present and searches for specific file types. It doesn't work for small files. To recover a file on an external storage device, such as a USB drive, you can only use Signature mode.
Default mode examples
Recover a specific file from your C: drive to the recovery folder on an E: drive.
winfr C: E: /n \Users\<username>\Documents\QuarterlyStatement.docx
Recover jpeg and png photos from your Pictures folder to the recovery folder on an E: drive.
winfr C: E: /n \Users\<username>\Pictures\*.JPEG /n \Users\<username>\Pictures\*.PNG
Recover your Documents folder from your C: drive to the recovery folder on an E: drive.
winfr C: E: /n \Users\<username>\Documents\
Don’t forget the backslash (\) at the end of the folder.
Segment mode examples (/r)
Recover PDF and Word files from your C: drive to the recovery folder on an E: drive.
winfr C: E: /r /n *.pdf /n *.docx
Recover any file with the string "invoice" in the filename by using wildcard characters.
winfr C: E: /r /n *invoice*
Signature mode examples (/x)
When using signature mode, it's helpful to first see the supported extension groups and corresponding file types.
winfr /#
Recover JPEG (jpg, jpeg, jpe, jif, jfif, jfi) and PNG photos from your C: drive to the recovery folder on an E: drive.
winfr C: E: /x /y:JPEG,PNG
Recover ZIP files (zip, docx, xlsx, ptpx, and so on) from your C: drive to the recovery folder on an E: drive.
winfr C: E:\RecoveryTest /x /y:ZIP
Use the following table to help you decide which mode to use. If you're not sure, start with the default mode.
File System Circumstances Recommended mode NTFS Deleted recently Default Deleted a while ago First try Segment, then Signature After formatting a disk First try Segment, then Signature A corrupted disk First try Segment, then Signature FAT, exFAT, ReFS Recovery file type is supported (See following table) Signature
The following table summarizes what each basic command line parameter and switch is used for.
Parameter or switch Description Supported modes Source-drive: Specifies the storage device where the files were lost. Must be different from the destination-drive. All Destination-drive: Specifies the storage device and folder on which to put the recovered files. Must be different from the source-drive. All /r Uses segment mode, which examines File Record Segments (FRS). Segment /n <filter> Scans for a specific file by using a file name, file path, or wildcards. For example:
- File name: /n myfile.docx
- File path: /n /users/<username>/Documents/
- Wildcard: /n myfile.*
/n *.docx
/n *<string>*Default
Segment/x Uses signature mode, which examines file types and works on all file systems. Signature /y:<type(s)> Scans for files with specific file types. Separate multiple entries by using commas. For a list of extension groups and corresponding file types, see the table, "Signature mode extension groups and file types" in the section, "About modes and file systems". Signature /# Shows signature mode extension groups and corresponding file types in each group. All /? Shows a quick summary of syntax and switches for general users. All /! Shows a quick summary of syntax and switches for advanced users. All
The following table summarizes what each advanced switch is used for.
Switch Description Supported modes /p:<folder> Saves a log file of the recovery operation in a different location than the default location on the recovery drive (for example, D:\logfile). All /a Overrides user prompts, which is useful in a script file. All /u Recovers undeleted files, for example, from the Recycle Bin. Default
Segment/k Recovers system files. Default
Segment/o:<a|n|b> Specifies whether to always (a), never (n), orkeep both always(b) when choosing whether to overwrite a file. The default action is to prompt to overwrite. Default
Segment/g Recovers files without primary data streams. Default
Segment/e To keep your results manageable and focus on user files, some file types are filtered by default, but this switch removes that filter. For a complete list of these file types, see the information after this table. Default
Segment/e:<extension> Specifies which file types are filtered. For a complete list of these file types, see the information after this table. Default
Segment/s:<sectors> Specifies the number of sectors on the source device. To find sector information, use fsutil. Segment
Signature/b:<bytes> Specifies the cluster size (allocation unit) on the source device. Segment
Signature/f:<sector> Specifies the first sector on the source device to start the scan operation, for example, to bypass unusable sectors. To find sector information, use fsutil. Segment
Signature
5 When you are prompted for confirmation to continue, enter Y to start the recovery operation.
Depending on the size of your source drive, this may take a while.
To stop the recovery process, press the Ctrl + C keys.
That's it,
Shawn