Windows File Recovery is the official Microsoft tool to recover deleted files
the Windows team quietly deployed a file recovery tool in the Microsoft Store, which can be used to recover deleted files from your Windows 10 computer. According to the description, the tool can not only recover deleted files, but also clean up hard drives, SD cards and corrupted storage. It can recover photos, documents, videos, etc. In this article we will talk about the Windows file recovery tool and check its performance.
Windows file recovery tool recovers deleted files
What is surprising here is that Windows File Recovery is a command line tool, that is to say without a user interface. As soon as you launch it, it will display a list of options provided with the tool. It extends beyond NTFS recovery and works with SSD (limited by TRIM) and other storage devices. Here is the full list of options available with it. Here is the list of things we will discuss in this post:
- Use of commands
- Types of recovery mode
- How to use Windows file recovery in Windows 10?
- What recovery model should you use and when?
- What types of files are supported in the Signature model?
- Recovery logic used by Windows file recovery
1]Use of commands
winfr source-drive: destination-folder [/switches]
- / r – Segment mode (NTFS only, recovery using file saving segments)
- / not
– Filter the search (default or segmented mode, wildcards allowed, tracking for the folder) - / x – Signature mode (retrieval using file headers)
- / y:
- / # – Displays extension groups and file types in signature mode
- /? – Help text
- /! – Show advanced features
Recovering files from non-NTFS file systems is only supported in signature mode.
2]Types of recovery mode
Some modes use the MFT file, while others require segments, and the latter mode only works on large files.
- Default mode: It uses the master file table (MFT) to locate lost files. This works well when both MFT and file segments are present.
- Segment mode: It uses segments, which contain summaries of the file information that NTFS stores in the MFT, such as the name, date, size, type, and index of the cluster / allocation unit.
- Signature mode: This mode only requires the presence of data and searches for specific file types. You can use this mode to recover files from external devices such as USB, memory card, etc.
3]How to use Windows file recovery in Windows 10?
Open the file recovery program from the Start menu. It will instantly launch the command prompt and the UAC will request authorization. Once authorized, you should see all of the options. Note that you cannot recover to the same partition. It should be a different partition or even better if you recover it from the disk. Here are some examples.
Default mode: Recover a specific file
winfr C: D:RecoveryDestination /n UsersDownloads winfr C: E: /n Users Pictures*.JPEG /n Users Pictures*.PNG
Segment mode (/ r): Recover file types
winfr C: D:RecoveryDestination /x /y:PDF,JPEG winfr C: E: /r /n *invoice*
Examples of signature mode (/ x): When using signature mode, it is useful to first see the supported extension groups and the corresponding file types.
winfr C: D:RecoveryDestination /r /n *.pdf /n *.jpg
During the recovery process, you will be asked if you want to replace, keep a duplicate, and what options to use for the future. You can choose to replace everything, but I would recommend that you have enough storage at the destination and keep all copies. You never know which file is corrupt.
4]What recovery model should you use and when?
| File system | Conditions | Recommended mode | |
| NTFS | Recently deleted | Default | |
| Deleted a while ago | First, try Segment, then Signature. | ||
| After formatting a disc | |||
| A corrupted disc | |||
| FAT, exFAT, ReFS | The recovery file type is supported (see the following table) | Signature |
5]What types of files are supported in the Signature model?
| Extension group | File type |
| ASF | wma, WMV, asf |
| JPEG | jpg, jpeg, jpe, jif, jfif, jfi |
| MP3 | mp3 |
| MPEG | mpeg, mp4, mpg, m4a, m4v, m4b, m4r, mov, 3gp, qt |
| PNG | png |
| ZIP *: FRENCH | zip, docx, xlsx, pptx, odt, ods, odp, odg, odi, odf, odc, odm, ott, otg, otp, ots, otc, oti, otf, both |
The tool has a list of default filters for extensions such as adm, admx, appx, appx, ascx, asm, aspx, aux, ax, bin, browser. You can activate them using the / e switch.
6]Recovery logic used by Windows file recovery
The recovery logic used here is the same as that used by other recovery programs. The mode uses the Master File Tabel to find records of files deleted with File Record Segment. There is an additional copy of MFT which is useful for finding the exact physical location of deleted files.
Here is the result of a recovery performed via Windows file recovery tool.
Not all files were useful, but many were. This is not surprising since it very much depends on the amount of storage space that has been physically overwritten.
Although the tool is promising, it still needs a user interface and has its limits. You can download it from Microsoft Store.
