![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/wfr-store-app-featured.png\")
<\/p>\n
There are two basic modes to recover files: Regular and Extensive.<\/p>\n
- \n
- Regular mode is the standard recovery option for non-corrupted NTFS drives.<\/li>\n
- Extensive mode is a thorough recovery option suitable for all file systems.<\/li>\n<\/ul>\n
Regular mode examples<\/h3>\n
Example 1:<\/strong> Recover a specific file from your D: drive (e.g., “D:\\Media” folder) to the recovery folder on the C: drive.<\/p>\n
From an elevated or admin Command Prompt<\/a>, run:<\/p>\n
winfr D: C: \/regular \/n \"\\Media\\Samsung Galaxy Chromebook Unboxing.mp4\"<\/pre>\n
Note:<\/strong> If the file name or path contains space(s), enclose it within double quotes as in the above example. The source and destination drives must be different. <\/em>When recovering from the operating system drive (often C: ), use the \/n <filter> switches to specify the user files or folder.<\/em><\/p>\n
\nImportant:<\/strong><\/p>\nIf the file was sent to the Recycle Bin earlier and then you emptied the bin, the above path filter won’t work. This is because when you send a file to the Recycle Bin, it is stored in a different name\u2014e.g., $I7U9HMH.mp4 instead of “Samsung Galaxy Chromebook Unboxing.mp4.”<\/p>\n
Also, if the file was sent to the Recycle Bin and then the bin was emptied, the deleted file’s path will be something like “$RECYCLE.BIN\\S-1-5-21-2548784221-372374091-3270274566-1001\\$I7U9HMH.mp4”.<\/p>\n
So, the above filter
\/n \"\\Media\\Samsung Galaxy Chromebook Unboxing.mp4<\/code>” will not work<\/strong>.<\/p>\nIn that case, it’s better to use the file extension<\/strong> filter, such as<\/p>\n
winfr D: C: \/regular \/n .mp4<\/pre>\n
When using the
\/n<\/code><\/strong> filter, please note this important point.\n<\/div>\nYou’ll see the following prompt. Press “
y<\/code>“to continue.<\/p>\nWindows File Recovery\nCopyright (c) Microsoft Corporation. All rights reserved\nVersion: 0.1.20151.0\n----------------------------------------------------------\n\nSource drive: D:\nDestination folder: C:\\Recovery_20211221_124818\nFilter: MEDIA\\SAMSUNG GALAXY CHROMEBOOK UNBOXING.MP4\nExtension filter: *\n\nSector count: 0x0000000021ce47ff\nCluster size: 0x00001000\nSector size: 0x00000200\nOverwrite: Prompt\nMode: Regular\n\n\nContinue? (y\/n)<\/pre>\n
Pass 1: Scanning and processing disk\nScanning disk: 100%\n\nPass 2: Recovering files\nFiles recovered: 1, total files: 1, current filename: C:\\Recovery_20211221_124818\\Media\\Samsung Galaxy Chromebook Unboxing.mp4\nProgress: 100%\n\nView recovered files? (y\/n)<\/pre>\n
This tool automatically creates a recovery folder called Recovery_<date and time> on the destination drive.<\/em><\/p>\n
Clicking “y” opens the “Recovery” folder where the file has been restored.<\/p>\n
![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/wfr-recovered-folder.png\")
<\/p>\nThe recovery logfile”
RecoveryLog.txt<\/code>“would contain the list of recovered, damaged, and irrecoverable files about the last undelete operation.<\/p>\nWindows File Recovery\nCopyright (c) Microsoft Corporation. All rights reserved\nVersion: 0.1.20151.0\n----------------------------------------------------------\n\n\nRecovered files\n\nC:\\Recovery_20211221_124818\\Media\\Samsung Galaxy Chromebook Unboxing.mp4\n\nTotal damaged files:\n0\nTotal recovered files:\n1\nTotal irrecoverable files:\n0<\/pre>\n
The recovered video file was available in a subfolder folder named”
Media<\/code>“(the same folder name you gave in the command line).<\/p>\n![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/wfr-recovered-folder-2.png\")
<\/p>\n\nFor more WFR command-line information, run one of these two commands:<\/p>\n
- \n
- “
winfr \/?<\/strong><\/code>“– Shows a quick summary of syntax and switches for general users.<\/li>\n- “
winfr \/!<\/strong><\/code>“– Shows a quick summary of syntax and switches for advanced users.<\/li>\n<\/ul>\n<\/div>\nExample 2:<\/strong> Recover your
Documents<\/strong><\/code> folder from your C: drive to the recovery folder on an E: drive. Don’t forget the backslash (\\<\/strong><\/code>) at the end of the folder.<\/p>\nWinfr C: E: \/regular \/n \\Users\\<username>\\Documents\\<\/pre>\n
Example 3:<\/strong> Recover PDF and Word files from your
C:<\/code> drive to the recovery folder on an E: drive.<\/p>\nWinfr C: E: \/regular \/n *.pdf \/n *.docx<\/pre>\n
Sometimes, you may get the following message when attempting to undelete\/recover a file:<\/p>\n
No recoverable files were found with this mode. Please check \/? for more recovery options<\/pre>\n
In that case, you may try the extensive mode (previously known as the “Segment mode” and “Signature mode”) for a thorough scan.<\/p>\n
\nExtensive mode examples<\/h3>\n
Example 1:<\/strong> Recover any file with the string “invoice” in the filename using wildcard characters.<\/p>\n
Winfr E: C: \/extensive \/n *invoice*<\/pre>\n
Example 2: <\/strong>Recover JPEG and PNG\u202fphotos from your Pictures folder to the recovery folder on your E: drive.<\/p>\n
Winfr C: E: \/extensive \/n \\Users\\<username>\\Pictures\\*.JPEG \/n \\Users\\<username>\\Pictures\\*.PNG<\/pre>\n
Example 3:<\/strong> Recover file types having a specific extension<\/p>\n
Let’s say you want to recover deleted files that have the extension “.LLC” (e.g.
sample-proj.llc<\/code>). Assuming that the deleted file(s) was present on the D: drive and you want to restore it to a folder on the C: drive.<\/p>\nRun this command:<\/p>\n
winfr D: C: \/extensive \/n *.llc\n\n(or)\n\nwinfr D: C: \/extensive \/n \\media\\*.llc\n(if you remember the directory path of the deleted file)<\/pre>\n
The source and destination drives must be different.<\/p>\n
Microsoft automatically creates a recovery folder called Recovery_<date and time><\/strong> on the destination drive.<\/p>\n
![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/wfr-extensive-mode.png\")
<\/p>\nPress “y” when you see the following prompt:<\/p>\n
Windows File Recovery\nCopyright (c) Microsoft Corporation. All rights reserved\nVersion: 0.1.20151.0\n----------------------------------------------------------\n\nSource drive: D:\nDestination folder: C:\\Recovery_20211221_173440\nFilter: **.LLC\nExtension filter: *\n\nSector count: 0x0000000021ce47ff\nCluster size: 0x00001000\nSector size: 0x00000200\nOverwrite: Prompt\nMode: Extensive<\/strong>\n\n\nContinue? (y\/n)<\/pre>\n
Press”
y<\/code>“to open the folder containing the recovered file(s).<\/p>\n![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/wfr-extensive-mode-recovered.png\")
<\/p>\n\nExtensive mode and Disk Usage<\/h3>\n
When you use the Extensive mode, disk usage shoots up to 100% and remains at the peak throughout the operation. This is something the WFR development team must take note of and fix in the upcoming build.<\/p>\n
Depending on the size of your source drive, the extensive mode may take a while. To stop the recovery process, press Ctrl + C.<\/p>\n
![\"winfr](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/winfr-disk-usage-2.png\")
<\/p>\n![\"winfr](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2021\/12\/winfr-disk-usage.png\")
<\/p>\nOne of the hard disks was fully busy (100% disk usage<\/a>) when Winfr.exe ran in “Extensive mode.”<\/p>\n<\/div>\n
Deciding which mode to use<\/h2>\n
Here are the file systems supported by WFR:<\/p>\n
- \n
- FAT and exFAT are used by SD cards, flash, or USB drives (< 4GB).<\/li>\n
- ReFS is used by Windows Server and Windows Pro for Workstations.<\/li>\n
- NTFS is used in computers (HDD, SSD), external hard drives, flash or USB drives (> 4GB)<\/li>\n<\/ul>\n
To recover files from non-NTFS drives, you’ll need to use the Extensive mode. Alternately, you can use the Signature mode specifically (advanced command-line switch.)<\/p>\n
Use the following table to help you decide which mode to use. If you’re not sure, start with the default mode.<\/p>\n
\n\n
\n File system<\/strong><\/td>\n Circumstances<\/strong><\/td>\n Recommended mode<\/strong><\/td>\n<\/tr>\n \n NTFS<\/td>\n Deleted recently<\/td>\n Regular<\/td>\n<\/tr>\n \n NTFS<\/td>\n Deleted it a while ago<\/td>\n Extensive<\/td>\n<\/tr>\n \n NTFS<\/td>\n After formatting a disk<\/td>\n Extensive<\/td>\n<\/tr>\n \n NTFS<\/td>\n A corrupted disk<\/td>\n Extensive<\/td>\n<\/tr>\n \n FAT, exFAT<\/td>\n Any<\/td>\n Extensive<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Command-line Switches<\/h2>\n
Here are the general\/basic command-line switches<\/strong> for WFR.<\/p>\n
\n\n
\n Parameter \/ switch\u00a0\u00a0<\/b><\/th>\n Description<\/b><\/th>\n Supported mode(s)<\/b><\/th>\n<\/tr>\n<\/thead>\n\n \n Source-drive:<\/td>\n Specifies the storage device where the files were lost. Must be different from the destination drive.<\/td>\n All<\/td>\n<\/tr>\n \n Destination-drive:<\/td>\n Specifies the storage device and folder on which to put the recovered files. Must be different from the source drive.<\/td>\n All<\/td>\n<\/tr>\n \n \/regular<\/td>\n Regular mode, the standard recovery option for non-corrupted NTFS drives<\/td>\n Regular<\/td>\n<\/tr>\n \n \/extensive<\/td>\n Extensive mode, a thorough recovery option suitable for all file systems<\/td>\n Extensive<\/td>\n<\/tr>\n \n \/n<filter><\/td>\n Scans for a specific file by using a file name, file path,\u00a0file type, or\u00a0wildcards. For example:<\/p>\n - \n
- File name: \/n myfile.docx<\/li>\n
- File path: \/n \/users\/<username>\/Documents\/<\/li>\n
- Wildcard: \/n\u00a0myfile.*<\/li>\n
- \/n *.docx<\/li>\n
- \/n *<string>*<\/li>\n<\/ul>\n<\/td>\n
All<\/td>\n<\/tr>\n \n \/?<\/td>\n Summary of syntax and switches for general users.<\/td>\n All<\/td>\n<\/tr>\n \n \/!<\/td>\n Summary of syntax and switches for advanced users.<\/td>\n All<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Besides the regular<\/strong> and extensive<\/strong> modes, you can also selectively use Segment<\/strong> mode or Signature<\/strong> mode. Run the commandwinfr \/!<\/strong><\/code> to see the advanced command-line parameters .supported by WFR. However, for most users, the\/regular<\/code> and\/extensive<\/code> operators would be sufficient.<\/div>\nThe following is the list of advanced command-line switches<\/strong> supported by WFR:<\/p>\n
\nUSAGE: winfr source-drive: destination-folder [\/mode] [\/switches]\nUSAGE: winfr source-drive: destination-folder [\/mode] [\/switches]\n<\/pre>\n
Advanced modes and filters<\/h4>\n
\n\n
\n \/ntfs<\/td>\n NTFS mode (Fast recovery option for healthy NTFS drives using the master file table)<\/td>\n<\/tr>\n \n \/segment<\/td>\n Segment mode (Recovery option for NTFS drives using file record segments)<\/td>\n<\/tr>\n \n \/signature<\/td>\n Signature mode (Recovery option for all file system types using file headers)<\/td>\n<\/tr>\n \n \/n <filter><\/td>\n Filter search (NTFS\/Segment mode only, wildcards allowed, trailing \\ for folder)<\/td>\n<\/tr>\n \n \/y:<type(s)><\/td>\n Recover specific extension groups (Signature mode only, comma separated)<\/td>\n<\/tr>\n \n \/#<\/td>\n Displays signature mode extension groups and file types<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \nExample usage<\/strong>\n\nwinfr C: D:\\RecoveryDestination \/ntfs \/n Users\\
\\Downloads\\\nwinfr C: D:\\RecoveryDestination \/segment \/n *.pdf \/n *.jpg\nwinfr C: D:\\RecoveryDestination \/signature \/y:PDF,JPEG\n<\/pre>\n Advanced switches<\/h4>\n
\n\n
\n \/p:<folder><\/td>\n Specify recovery log destination (default: destination folder)<\/td>\n<\/tr>\n \n \/a<\/td>\n Accepts all user prompts<\/td>\n<\/tr>\n \n \/u<\/td>\n Recover non-deleted files (NTFS\/Segment mode only)<\/td>\n<\/tr>\n \n \/k<\/td>\n Recover system files (NTFS\/Segment mode only)<\/td>\n<\/tr>\n \n \/o:<a|n|b><\/td>\n Overwrite (a)lways, (n)ever or keep (b)oth always (NTFS\/Segment mode only)<\/td>\n<\/tr>\n \n \/g<\/td>\n Recover files without primary data stream (default: false, NTFS\/Segment mode only)<\/td>\n<\/tr>\n \n \/e<\/td>\n Disable extension exclusion list (NTFS\/Segment mode only)<\/td>\n<\/tr>\n \n \/e:<extension><\/td>\n Disable specific extension(s) (default extension list no longer applies) (NTFS\/Segment mode only)<\/td>\n<\/tr>\n \n \/s:<sectors><\/td>\n Number of sectors in volume (Segment\/Signature mode only)<\/td>\n<\/tr>\n \n \/b:<bytes><\/td>\n Number of bytes in cluster (Segment\/Signature mode only)<\/td>\n<\/tr>\n \n \/f:<sector><\/td>\n First sector to scan (Segment\/Signature mode only)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n See also Recover lost files on Windows 10 – Microsoft Support<\/a> for more command-line help.<\/p>\n
The Windows File Recovery app requires Windows 10 build 19041 (v2004) or later. See which version of Windows 10<\/a> you have. Visit
https:\/\/aka.ms\/winfrhelp<\/code> for the user guide.<\/p>\n
- “
- “