Did you accidentally delete an important file? Have you wiped clean your hard drive? Unsure of what to do with corrupted data? Windows File Recovery can help recover your personal data.
Windows File Recovery (WFR) is a command-line app from Microsoft. It can help you recover lost files deleted from your local storage device (including internal drives, external drives, and USB devices) that cannot be restored from the Recycle Bin.
For photos, documents, videos, and more, Windows File Recovery supports many file types to help ensure that your data is not permanently lost. However, WFR can’t recover files in your network file shares.
WFR can recover data from your hard drive, SSD (*limited by TRIM), USB drive, or memory cards.
Recover Deleted Files Using Windows File Recovery (WFR)
Download and install Windows File Recovery (WFR) from the Microsoft store.
There are two basic modes to recover files: Regular and Extensive.
- Regular mode is the standard recovery option for non-corrupted NTFS drives.
- Extensive mode is a thorough recovery option suitable for all file systems.
Regular mode examples
Example 1: Recover a specific file from your D: drive (e.g., “D:\Media” folder) to the recovery folder on the C: drive.
From an elevated or admin Command Prompt, run:
winfr D: C: /regular /n "\Media\Samsung Galaxy Chromebook Unboxing.mp4"
Note: If the file name or path contains space(s), enclose it within double quotes as in the above example. The source and destination drives must be different. When recovering from the operating system drive (often C: ), use the /n <filter> switches to specify the user files or folder.
If the file was sent to the Recycle Bin earlier and then you emptied the bin, the above path filter won’t work. This is because when you send a file to the Recycle Bin, it is stored in a different name—e.g., $I7U9HMH.mp4 instead of “Samsung Galaxy Chromebook Unboxing.mp4.”
Also, if the file was sent to the Recycle Bin and then the bin was emptied, the deleted file’s path will be something like “$RECYCLE.BIN\S-1-5-21-2548784221-372374091-3270274566-1001\$I7U9HMH.mp4”.
So, the above filter /n "\Media\Samsung Galaxy Chromebook Unboxing.mp4
” will not work.
In that case, it’s better to use the file extension filter, such as
winfr D: C: /regular /n .mp4
When using the /n
filter, please note this important point.
You’ll see the following prompt. Press “y
“to continue.
Windows File Recovery Copyright (c) Microsoft Corporation. All rights reserved Version: 0.1.20151.0 ---------------------------------------------------------- Source drive: D: Destination folder: C:\Recovery_20211221_124818 Filter: MEDIA\SAMSUNG GALAXY CHROMEBOOK UNBOXING.MP4 Extension filter: * Sector count: 0x0000000021ce47ff Cluster size: 0x00001000 Sector size: 0x00000200 Overwrite: Prompt Mode: Regular Continue? (y/n)
Pass 1: Scanning and processing disk Scanning disk: 100% Pass 2: Recovering files Files recovered: 1, total files: 1, current filename: C:\Recovery_20211221_124818\Media\Samsung Galaxy Chromebook Unboxing.mp4 Progress: 100% View recovered files? (y/n)
This tool automatically creates a recovery folder called Recovery_<date and time> on the destination drive.
Clicking “y” opens the “Recovery” folder where the file has been restored.
The recovery logfile”RecoveryLog.txt
“would contain the list of recovered, damaged, and irrecoverable files about the last undelete operation.
Windows File Recovery Copyright (c) Microsoft Corporation. All rights reserved Version: 0.1.20151.0 ---------------------------------------------------------- Recovered files C:\Recovery_20211221_124818\Media\Samsung Galaxy Chromebook Unboxing.mp4 Total damaged files: 0 Total recovered files: 1 Total irrecoverable files: 0
The recovered video file was available in a subfolder folder named”Media
“(the same folder name you gave in the command line).
For more WFR command-line information, run one of these two commands:
- “
winfr /?
“– Shows a quick summary of syntax and switches for general users. - “
winfr /!
“– Shows a quick summary of syntax and switches for advanced users.
Example 2: Recover your Documents
folder from your C: drive to the recovery folder on an E: drive. Don’t forget the backslash (\
) at the end of the folder.
Winfr C: E: /regular /n \Users\<username>\Documents\
Example 3: Recover PDF and Word files from your C:
drive to the recovery folder on an E: drive.
Winfr C: E: /regular /n *.pdf /n *.docx
Sometimes, you may get the following message when attempting to undelete/recover a file:
No recoverable files were found with this mode. Please check /? for more recovery options
In that case, you may try the extensive mode (previously known as the “Segment mode” and “Signature mode”) for a thorough scan.
Extensive mode examples
Example 1: Recover any file with the string “invoice” in the filename using wildcard characters.
Winfr E: C: /extensive /n *invoice*
Example 2: Recover JPEG and PNG photos from your Pictures folder to the recovery folder on your E: drive.
Winfr C: E: /extensive /n \Users\<username>\Pictures\*.JPEG /n \Users\<username>\Pictures\*.PNG
Example 3: Recover file types having a specific extension
Let’s say you want to recover deleted files that have the extension “.LLC” (e.g. sample-proj.llc
). Assuming that the deleted file(s) was present on the D: drive and you want to restore it to a folder on the C: drive.
Run this command:
winfr D: C: /extensive /n *.llc (or) winfr D: C: /extensive /n \media\*.llc (if you remember the directory path of the deleted file)
The source and destination drives must be different.
Microsoft automatically creates a recovery folder called Recovery_<date and time> on the destination drive.
Press “y” when you see the following prompt:
Windows File Recovery Copyright (c) Microsoft Corporation. All rights reserved Version: 0.1.20151.0 ---------------------------------------------------------- Source drive: D: Destination folder: C:\Recovery_20211221_173440 Filter: **.LLC Extension filter: * Sector count: 0x0000000021ce47ff Cluster size: 0x00001000 Sector size: 0x00000200 Overwrite: Prompt Mode: Extensive Continue? (y/n)
Press”y
“to open the folder containing the recovered file(s).
Extensive mode and Disk Usage
When you use the Extensive mode, disk usage shoots up to 100% and remains at the peak throughout the operation. This is something the WFR development team must take note of and fix in the upcoming build.
Depending on the size of your source drive, the extensive mode may take a while. To stop the recovery process, press Ctrl + C.
One of the hard disks was fully busy (100% disk usage) when Winfr.exe ran in “Extensive mode.”
Deciding which mode to use
Here are the file systems supported by WFR:
- FAT and exFAT are used by SD cards, flash, or USB drives (< 4GB).
- ReFS is used by Windows Server and Windows Pro for Workstations.
- NTFS is used in computers (HDD, SSD), external hard drives, flash or USB drives (> 4GB)
To recover files from non-NTFS drives, you’ll need to use the Extensive mode. Alternately, you can use the Signature mode specifically (advanced command-line switch.)
Use the following table to help you decide which mode to use. If you’re not sure, start with the default mode.
File system | Circumstances | Recommended mode |
NTFS | Deleted recently | Regular |
NTFS | Deleted it a while ago | Extensive |
NTFS | After formatting a disk | Extensive |
NTFS | A corrupted disk | Extensive |
FAT, exFAT | Any | Extensive |
Command-line Switches
Here are the general/basic command-line switches for WFR.
Parameter / switch | Description | Supported mode(s) |
---|---|---|
Source-drive: | Specifies the storage device where the files were lost. Must be different from the destination drive. | All |
Destination-drive: | Specifies the storage device and folder on which to put the recovered files. Must be different from the source drive. | All |
/regular | Regular mode, the standard recovery option for non-corrupted NTFS drives | Regular |
/extensive | Extensive mode, a thorough recovery option suitable for all file systems | Extensive |
/n<filter> | Scans for a specific file by using a file name, file path, file type, or wildcards. For example:
|
All |
/? | Summary of syntax and switches for general users. | All |
/! | Summary of syntax and switches for advanced users. | All |
winfr /!
to see the advanced command-line parameters .supported by WFR. However, for most users, the /regular
and /extensive
operators would be sufficient.The following is the list of advanced command-line switches supported by WFR:
USAGE: winfr source-drive: destination-folder [/mode] [/switches] USAGE: winfr source-drive: destination-folder [/mode] [/switches]
Advanced modes and filters
/ntfs | NTFS mode (Fast recovery option for healthy NTFS drives using the master file table) |
/segment | Segment mode (Recovery option for NTFS drives using file record segments) |
/signature | Signature mode (Recovery option for all file system types using file headers) |
/n <filter> | Filter search (NTFS/Segment mode only, wildcards allowed, trailing \ for folder) |
/y:<type(s)> | Recover specific extension groups (Signature mode only, comma separated) |
/# | Displays signature mode extension groups and file types |
Example usage winfr C: D:\RecoveryDestination /ntfs /n Users\\Downloads\ winfr C: D:\RecoveryDestination /segment /n *.pdf /n *.jpg winfr C: D:\RecoveryDestination /signature /y:PDF,JPEG
Advanced switches
/p:<folder> | Specify recovery log destination (default: destination folder) |
/a | Accepts all user prompts |
/u | Recover non-deleted files (NTFS/Segment mode only) |
/k | Recover system files (NTFS/Segment mode only) |
/o:<a|n|b> | Overwrite (a)lways, (n)ever or keep (b)oth always (NTFS/Segment mode only) |
/g | Recover files without primary data stream (default: false, NTFS/Segment mode only) |
/e | Disable extension exclusion list (NTFS/Segment mode only) |
/e:<extension> | Disable specific extension(s) (default extension list no longer applies) (NTFS/Segment mode only) |
/s:<sectors> | Number of sectors in volume (Segment/Signature mode only) |
/b:<bytes> | Number of bytes in cluster (Segment/Signature mode only) |
/f:<sector> | First sector to scan (Segment/Signature mode only) |
See also Recover lost files on Windows 10 – Microsoft Support for more command-line help.
The Windows File Recovery app requires Windows 10 build 19041 (v2004) or later. See which version of Windows 10 you have. Visit https://aka.ms/winfrhelp
for the user guide.
(This post was revised on 30-April-2024.)
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
I deleted my photos from 20220926 through 20220929 on a Samsung Ultra 22. As you can see, this is quite recent. It happened when transferring them from the smartphone. I saw that I was deleting the DCIM folder. The photos appear as corrupt on the phone. From a folder containing the word “android” and “trash” I was able to find about 10 of about 100. The names are all about 12 digit numeric. The property info still shows when taken.
I can’t find a way to “decorrupt” them from the phone. Also, because the names have no .jpg extension, the winfre recovery commands I have been trying are not working. No recovery folder is created, either.
I appreciate your information above; it helps an inexperienced user and calms the feeling of helplessness.
So that’s my comment, with a long prelude asking you for more. I guess there is a blog community, but those are hard to wade through, and sometimes the solutions are deleted.