The Windows Team has quietly rolled out a file recovery tool in the Microsoft Store, which can be used to recover deleted files from your Windows 10 computer. According to the description, the tool can not only recover deleted files but also wiped clean hard drives, SD cards, and from corrupted storage. It can recover photos, documents, videos, and more. In this post, we will talk about the Windows File Recovery Tool and check how it performs.
Windows File Recovery Tool recovers deleted files
What is surprising here is that Windows File Recovery is a command-line tool, i.e., no user interface. As soon as you launch it, it will display a list of options that come with the tool. It expands beyond NTFS recovery and works with SSD (limited by TRIM) and other storage devices. Here is the complete list of options available with it. Here is the list of things we will discuss in this post:
- Command Usage
- Types of Recovery Mode
- How to use Windows File Recovery in Windows 10?
- Which recovery model should you use and when?
- Which file types are supported in the Signature model?
- Recovery Logic used by Windows File Recovery
1] Command Usage
winfr source-drive: destination-folder [/switches]
- /r – Segment mode (NTFS only, recovery using file record segments)
- /n <filter> – Filter search (default or segment mode, wildcards allowed, trailing \ for folder)
- /x – Signature mode (recovery using file headers)
- /y:<type(s)> – Recover specific extension groups (signature mode only, comma separated)
- /# – Displays signature mode extension groups and file types
- /? – Help text
- /! – Display advanced features
Recovering files from non-NTFS file systems is only supported in signature mode.
2] Types of Recovery Mode
Some of the modes use the MFT file, while others require segments, and the last mode works only on large files.
- Default mode: It uses the Master File Table (MFT) to locate lost files. It works well when MFT and file segments are both present.
- Segment mode: It uses Segments, which carries summaries of file information that NTFS stores in the MFT such as name, date, size, type, and the cluster/allocation unit index.
- Signature mode: This mode only requires that the data is present and searches for specific file types. You can use this mode to recover files from external devices like USB, memory card, and so on.
3] How to use Windows File Recovery in Windows 10?
Open the File Recovery program from the Start menu. It will instantly launch the command prompt, and UAC will prompt for permission. Once allowed, you should see all the options. Do note that you cannot recover to the same partition. It should be a different partition or even better if you recover it to drive. Here are some examples.
Default Mode: Recover a specific file
winfr C: D:\RecoveryDestination /n Users\<username>\Downloads\ winfr C: E: /n \Users\<username>\Pictures\*.JPEG /n \Users\<username>\Pictures\*.PNG
Segment mode (/r): Recover types of file
winfr C: D:\RecoveryDestination /x /y:PDF,JPEG winfr C: E: /r /n *invoice*
Signature mode examples (/x): When using the signature mode, it’s helpful first to see the supported extension groups and corresponding file types.
winfr C: D:\RecoveryDestination /r /n *.pdf /n *.jpg
During the recovery process, you will be asked if you want to overwrite, keep a duplicate, and the options to be used for the future. You can choose to overwrite all, but I would recommend you to have enough storage at the destination and keep all copies. You never know which file is corrupt.
Read: How to recover Files lost during Cut and Paste in Windows
4] Which recovery model should you use and when?
| File System | Circumstances | Recommended mode | |
| NTFS | Deleted recently | Default | |
| Deleted a while ago | First, try Segment, then Signature. | ||
| After formatting a disk | |||
| A corrupted disk | |||
| FAT, exFAT, ReFS | The recovery file type is supported (See the following table) | Signature |
5] Which file types are supported in the Signature model?
| Extension group | File type |
| ASF | wma, WMV, asf |
| JPEG | jpg, jpeg, jpe, jif, jfif, jfi |
| MP3 | mp3 |
| MPEG | mpeg, mp4, mpg, m4a, m4v, m4b, m4r, mov, 3gp, qt |
| PNG | png |
| ZIP | zip, docx, xlsx, pptx, odt, ods, odp, odg, odi, odf, odc, odm, ott, otg, otp, ots, otc, oti, otf, both |
The tool has a default filter list of extensions such as adm, admx, appx, appx, ascx, asm, aspx, aux, ax, bin, browser. You can enable them by using the /e switch.
6] Recovery Logic used by Windows File Recovery
The recovery logic used here is the same as used by other recovery programs. The mode uses Master File Tabel to find records of the deleted files along with File Record Segment. There is an additional copy of MFT which comes in handy to find the exact physical location of the deleted files.
Here is the result of a recovery made through Windows File Recovery tool.
Not all the files were useful, but many were. It is not surprising as a lot depends on how much of the storage space was physically overwritten.
While the tool is promising, it still needs a user interface and has its limitations. You can download it from the Microsoft Store.
TIP: WinfrGUI is a free tool that adds a graphical user interface to Windows File Recovery. This makes it more accessible to folks who do not use the command prompt.
