How to Recover Deleted Files with Windows File Recovery in Windows 10  

Page 1 of 2 12 LastLast
    How to Recover Deleted Files with Windows File Recovery in Windows 10

    How to Recover Deleted Files with Windows File Recovery in Windows 10

    Published by Category: Apps & Features
    07 Jan 2021
    Designer Media Ltd

    How to Recover Deleted Files with Windows File Recovery app in Windows 10


    If you can’t locate a lost file from your backup, then you can use Windows File Recovery, which is a command line app created by Microsoft available from the Microsoft Store. Use this app to try to recover lost files that have been deleted from your local storage device (including internal drives, external drives, and USB devices) and can’t be restored from the Recycle Bin. Recovery on cloud storage and network file shares is not supported.

    Accidentally deleted an important file? Wiped clean your hard drive? Unsure of what to do with corrupted data? Windows File Recovery can help recover your personal data.

    For photos, documents, videos and more, Windows File Recovery supports many file types to help ensure that your data is not permanently lost.

    Recovering from a camera or SD card? Try Signature mode, which expands beyond NTFS recovery and caters to your storage device needs. Let this app be your first choice for helping to find what you need from your hard drive, SSD (*limited by TRIM), USB drive, or memory cards.

    See also: Recover lost files on Windows 10 | Microsoft Support

    Since the initial release of Windows File Recovery, the team has received tons of feedback and inquiries about the app. This update includes performance improvements, bug fixes, and the introduction of 2 simplified recovery modes! Regular mode is a fast recovery option for NTFS file systems and extensive mode is a thorough search that applies to most file systems. The update is available to Windows Insiders and will be released to the general public (Windows 10 May 2020 Update and higher) in early 2021.

    This tutorial will show you how to use the Windows File Recovery command line app to try and recover deleted files in Windows 10.

    The Windows File Recovery app requires Windows 10 build 19041 or higher.

    You must be signed in as an administrator to run the Windows File Recovery app.


    If you want to increase your chances of recovering a file, minimize or avoid using your computer. In the Windows file system, the space used by a deleted file is marked as free space, which means the file data can still exist and be recovered. But any use of your computer can create files, which may over-write this free space at any time.




    Here's How:

    1 If you haven't already, you will need to download and install the Windows File Recovery command line app from the Microsoft Store. (see screenshot below)
    2 Open the Windows File Recovery app from your Start menu to run it.

    3 If prompted by UAC, click/tap on Yes to approve running as administrator.

    4 Windows File Recovery will now open a maximized elevated command prompt window for you to use the winfr command in the following format to try and recovery deleted files. (see screenshot and tables below)

    USAGE: winfr source-drive: destination-folder [/switches]

    See also: Recover lost files on Windows 10 | Microsoft Support

    The source and destination drives must be different. When recovering from the operating system drive (often C: ), use the /n <filter> and /y:<type<(s)> switches to specify the user files or folder.

    Microsoft automatically creates a recovery folder for you called, Recovery_<date and time> on the destination drive.

    How to Recover Deleted Files with Windows File Recovery in Windows 10-windows_file_recovery-1.png

    Command Usage:

    See also: Recover lost files on Windows 10 | Microsoft Support

    There are three modes you can use to recover files: Default, Segment, and Signature.

    The three modes work in the following way:

    • Default mode = This mode uses the Master File Table (MFT) to locate lost files. Default mode works well when the MFT and file segments, also called File Record Segments (FRS), are present.
    • Segment mode = This mode does not require the MFT but does require segments. Segments are summaries of file information that NTFS stores in the MFT such as name, date, size, type and the cluster/allocation unit index.
    • Signature mode = This mode only requires that the data is present and searches for specific file types. It doesn't work for small files. To recover a file on an external storage device, such as a USB drive, you can only use Signature mode.


    Default mode examples

    Recover a specific file from your C: drive to the recovery folder on an E: drive.

    winfr C: E: /n \Users\<username>\Documents\QuarterlyStatement.docx

    Recover jpeg and png photos from your Pictures folder to the recovery folder on an E: drive.

    winfr C: E: /n \Users\<username>\Pictures\*.JPEG /n \Users\<username>\Pictures\*.PNG

    Recover your Documents folder from your C: drive to the recovery folder on an E: drive.

    winfr C: E: /n \Users\<username>\Documents\

    Don’t forget the backslash (\) at the end of the folder.

    Segment mode examples (/r)

    Recover PDF and Word files from your C: drive to the recovery folder on an E: drive.

    winfr C: E: /r /n *.pdf /n *.docx

    Recover any file with the string "invoice" in the filename by using wildcard characters.

    winfr C: E: /r /n *invoice*

    Signature mode examples (/x)

    When using signature mode, it's helpful to first see the supported extension groups and corresponding file types.

    winfr /#

    Recover JPEG (jpg, jpeg, jpe, jif, jfif, jfi) and PNG photos from your C: drive to the recovery folder on an E: drive.

    winfr C: E: /x /y:JPEG,PNG

    Recover ZIP files (zip, docx, xlsx, ptpx, and so on) from your C: drive to the recovery folder on an E: drive.

    winfr C: E:\RecoveryTest /x /y:ZIP

    Use the following table to help you decide which mode to use. If you're not sure, start with the default mode.

    File System Circumstances Recommended mode
    NTFS Deleted recently Default
    Deleted a while ago First try Segment, then Signature
    After formatting a disk First try Segment, then Signature
    A corrupted disk First try Segment, then Signature
    FAT, exFAT, ReFS Recovery file type is supported (See following table) Signature

    The following table summarizes what each basic command line parameter and switch is used for.

    Parameter or switch Description Supported modes
    Source-drive: Specifies the storage device where the files were lost. Must be different from the destination-drive. All
    Destination-drive: Specifies the storage device and folder on which to put the recovered files. Must be different from the source-drive. All
    /r Uses segment mode, which examines File Record Segments (FRS). Segment
    /n <filter> Scans for a specific file by using a file name, file path, or wildcards. For example:

    • File name: /n myfile.docx
    • File path: /n /users/<username>/Documents/
    • Wildcard: /n myfile.*
      /n *.docx
      /n *<string>*
    Default
    Segment
    /x Uses signature mode, which examines file types and works on all file systems. Signature
    /y:<type(s)> Scans for files with specific file types. Separate multiple entries by using commas. For a list of extension groups and corresponding file types, see the table, "Signature mode extension groups and file types" in the section, "About modes and file systems". Signature
    /# Shows signature mode extension groups and corresponding file types in each group. All
    /? Shows a quick summary of syntax and switches for general users. All
    /! Shows a quick summary of syntax and switches for advanced users. All

    The following table summarizes what each advanced switch is used for.

    Switch Description Supported modes
    /p:<folder> Saves a log file of the recovery operation in a different location than the default location on the recovery drive (for example, D:\logfile). All
    /a Overrides user prompts, which is useful in a script file. All
    /u Recovers undeleted files, for example, from the Recycle Bin. Default
    Segment
    /k Recovers system files. Default
    Segment​​​​​
    /o:<a|n|b> Specifies whether to always (a), never (n), orkeep both always(b) when choosing whether to overwrite a file. The default action is to prompt to overwrite. Default
    Segment​​​​​
    /g Recovers files without primary data streams. Default
    Segment
    /e To keep your results manageable and focus on user files, some file types are filtered by default, but this switch removes that filter. For a complete list of these file types, see the information after this table. Default
    Segment
    /e:<extension> Specifies which file types are filtered. For a complete list of these file types, see the information after this table. Default
    Segment
    /s:<sectors> Specifies the number of sectors on the source device. To find sector information, use fsutil. Segment
    Signature
    /b:<bytes> Specifies the cluster size (allocation unit) on the source device. Segment
    Signature
    /f:<sector> Specifies the first sector on the source device to start the scan operation, for example, to bypass unusable sectors. To find sector information, use fsutil. Segment
    Signature

    5 When you are prompted for confirmation to continue, enter Y to start the recovery operation.

    Depending on the size of your source drive, this may take a while.

    To stop the recovery process, press the Ctrl + C keys.




    That's it,
    Shawn



  1. Posts : 31,471
    10 Home x64 (22H2) (10 Pro on 2nd pc)
       #1

    Thanks, that looks to be a useful new tool for 2004.
    Last edited by Brink; 28 Jun 2020 at 10:31. Reason: moved to tutorial
      My Computers


  2. Posts : 231
    W10
       #2

    I don't see how this would work on an SSD drive. It defies all logic.
      My Computer


  3. TV2
    Posts : 2,221
    W10 Pro 22H2
       #3

    Data is still written to SSDs in Blocks and Sectors.
    It's the same thing done a different way.
      My Computers


  4. Posts : 15,441
    Windows10
       #4

    TV2 said:
    Data is still written to SSDs in Blocks and Sectors.
    It's the same thing done a different way.
    Well, I tried it with an ssd and it just does not work. I am trying it with an HDD now.

    EDIT: Nada, zilch!
      My Computer


  5. Posts : 231
    W10
       #5

    TV2 said:
    Data is still written to SSDs in Blocks and Sectors.
    It's the same thing done a different way.
    Don't forget the trim command and the SSD's garbage collection.
      My Computer


  6. Posts : 11,247
    Windows / Linux : Arch Linux
       #6

    Hi folks
    the whole concept of "undelete" means that one has to "re-create" the directory entry which is essentially an index of where the data bits of the file are physically located on HDD / SSD.

    When a file is deleted the directory entry is marked as deleted but not necessarily the file data itself (unless using something like secure erase etc). Even here the directory entry itself is marked as deleted -- i.e space is available for the directory entry to be overwritten but until that space on the HDD / SSD is needed the entry still exists which is why in a lot of cases (provided not too many WRITES have been made to the device in question) it's possible to recover fthe data fairly easily.

    If the directory structure / entry for the file has been removed / deleted / overwritten by new data then the only way one can recover the data (assuming this itself hasn't been over-written) is to physically read all the sectors on the disk and then try and manually "glue together" all the likely data bits of the file. - This is an extremely time consuming business that require resources such as the US F.B.I have -- you won't get this sort of solution on a basic consumer grade package -- which usually works on attempting to recover the old directory entry for the file.

    I wouldn't expect Windows recovery / undelete to be able to handle very much - unless the relevant HDD / SSD has not been used for WRITE since the data was deleted.

    The safest way (often on these forums repeated "Ad Nauseam" is for users to back up everything regularlu -- not only the OS but also their data files -- many solutions / strategies for doing that -- I'm afraid way beyond the scope of this post -- but the message is - however you do it -- just DO IT. !!!

    Imagine losing data files for say 3,000 ripped and tagged old Audio CD's -- I'd hate to re-create all that stuff again - even if it were possible.

    Cheers
    jimbo
      My Computer


  7. Posts : 31,471
    10 Home x64 (22H2) (10 Pro on 2nd pc)
       #7

    jimbo45 said:
    If the directory structure / entry for the file has been removed / deleted / overwritten by new data then the only way one can recover the data (assuming this itself hasn't been over-written) is to physically read all the sectors on the disk and then try and manually "glue together" all the likely data bits...
    Actually, the winfr /x option (or Signature mode) seems to do something like that.

    /x - Signature mode (recovery using file headers)

    Signature mode This mode only requires that the data is present and searches for specific file types. It doesn't work for small files. To recover a file on an external storage device, such as a USB drive, you can only use Signature mode.
    https://support.microsoft.com/en-us/...ore-lost-files
      My Computers


  8. Posts : 15,441
    Windows10
       #8

    I have not managed to get this to work. Have you tried it?
      My Computer


  9. Posts : 14,046
    Windows 11 Pro X64 22H2 22621.1848
       #9

    I just tried it on a file I deleted last night at 11:32PM. It was still in the recycle bin. winfr found nothing.

    How to Recover Deleted Files with Windows File Recovery in Windows 10-winfr_complete.jpg
      My Computers


 

Tutorial Categories

How to Recover Deleted Files with Windows File Recovery in Windows 10 Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Mixed Reality Phone


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 01:58.
Find Us




Windows 10 Forums