Windows File Recovery is a free command-line utility for recovering deleted files in Windows. If you have lost files on your PC after accidentally deleting them, this article explains how to use Windows File Recovery to recover them in a couple of steps.
Windows File Recovery (WFR) is a newer file restore utility Microsoft released around the time of Windows 10 version 2004 (approximately May 2020). The application is available to download from the Microsoft Store on Windows 10 and Windows 11.
If you can’t find a lost file on your C: drive and you’re without a backup, Windows File Recovery may come to your rescue. But, it would help if you act fast… I’ll get to that in a bit.
Windows File Recovery can restore files deleted from your local SSD drive, USB sticks, memory cards (sd card), and even external hard drives, and ZIP drives. How’s that for a blast from the past?
Just a reminder that there is no official GUI application for Windows File Recovery. It is a command-line-only program.
Hopefully, you’re an IT Pro who is in a Windows Terminal shell often throughout your workday. It will make learning how to use Windows File Recovery and being adept at it much easier. However, if you’re brand new to command-line shells and utilities, this post will get you onboard quickly and easily.
Let’s move on to the engineering of what happens when you delete a file, especially after emptying the Recycle Bin.
I believe we all know that when you delete a file in the Explorer interface of Windows – the Desktop, File Explorer, etc. – the file goes to the Recycle Bin, a special hidden folder on your local volume (C: drive). The file stays there until you empty it or restore it easily in Windows.
However, what happens when you ‘permanently’ delete the file from the Recycle Bin, or empty the Recycle Bin? Windows (the filesystem) marks the logical blocks on the hard drive as free. However, the data that houses your file(s) is probably still there, but it’s ‘hidden’ from Windows.
How long will your file still be recoverable? Let’s answer that question by explaining how Windows File Recovery works.
Recent releases of Windows File Recovery use two scanning methods to search for your deleted files.
To install Windows File Recovery, you’ll need to use the Microsoft Store. Let’s go over some requirements first, then I’ll show you how to download and install it.
To download and use Windows File Recovery, you will need to be running at least Windows 10 version 2004 (May 2020) or Windows 11. You also need the Microsoft Store to download the application.
Here are the steps to download and install WFR.
Because there is no official GUI interface from Microsoft, you’ll need to use the command line to access Windows File Recovery.
Note: You may have noticed something interesting in the Microsoft Store when searching for Windows File Recovery. If you happen to use winfr as your search term, you’ll find ‘WinfrGUI’. This is a third-party program that offers a GUI front-end to Windows File Recovery. You need to know that the program is NOT supported by Microsoft and you are on your own if you choose to use it. We recommend you stick to the official WFR program provided and supported by Microsoft.
Go ahead and open your favorite shell, I’ll use Windows Terminal. Type in winfr and hit Enter.
You’ll see the basic usage of the program and some examples of how to proceed. Based on a few facts, it will behoove you to use the best mode immediately. Let’s discuss this.
You’ll most likely be using the /regular switch to perform your recoveries of files. If you are on an NTFS partition or volume and the volume is in good shape, you’ll be able to use this mode. This offers the quickest and most effective method to get your files back.
You’ll need to use the Extensive mode if you are using any other filesystem, like FAT32, FAT, ExFAT, or ReFS. Let’s go through a good number of examples and get you on your way to recovering those TPS reports.
You can also use this table provided by Microsoft to assist you in determining which mode is best for your situation.
|Deleted a while ago
|After formatting a disk
|A corrupted disk
|FAT and exFAT
First, let’s do a search in our Downloads folder for any deleted files. Here’s one example to try.
winfr c: d: /regular /n \Users\sovit\Downloads\
Press ‘y‘ to continue.
Here, The source drive is ‘C:’. The destination or location the files will be restored to is on the ‘D:’ drive. We are using the /regular switch. The /n is to tell the utility we are using a filter. In this case, we want to limit the search to the Downloads folder in my profile.
Let’s see what WFR found for us! And, be prepared – this will take some time to run.
You can see the utility created a ‘Recovery’ folder on your destination volume and appends the date/time to it for easy reference. Here, you can search through the contents and copy files you wish to recover as easily as any other files!
You can also use file extension filters to search for specific file types. File extensions like .mp3, .MPEG, .pdf, .xps, .png, .jpeg, .jpg, and .docx are some examples.
Here is a quick example of a command to use for searching for PDF files exclusively:
Winfr c: e: /regular /n *.pdf
Let’s use the more ‘extensive’ (ahem…) mode to do a more thorough scan for specific files. Here, we will scan the entire D: drive for deleted files and save them to the C: drive.
You can use the following command to proceed:
winfr d: c: /extensive
Let’s see what it found. We can open the C: drive and find the Recovery folder with all of its contents.
Here are all the files it was able to recover, sorted by location and file type.
This is an important point: You may not be able actually to use the restored files. The utility just pulled the data from the various parts of the volume or partition you scanned. Although it may be able to extract file contents, there is no guarantee that the files are actually usable. If you run into that situation, I recommend you engage a company that specializes in data restoration and recovery of physical media.
In earlier versions of WFR, there were 3 modes – Default, Segment, and Signature. In more recent versions, Microsoft is only listing Regular and Extensive as the modes to use in their documentation. They have moved the previous 3 (really 2 – Segment, and Signature) as ‘Advanced’ switches to use. Let’s go through those here.
The Segment mode is a recovery option for NTFS drives using file record segments. Instead of searching through the MFT (Master File Table), the various NTFS segments on the disk are searched. These can be file attributes like filename, type, size, date/time, etc.
The Signature mode searches the disk using the file signatures of different file types. Winfr has a few built-in signatures for the most popular file types. But be advised – this mode is not as effective for finding lots of small files.
You should now have a better understanding of what Windows File Recovery is and how it can assist you and your users in recovering deleted files. The requirement for Windows 10 version 2004 or later may be an issue. However, you always have the option of using another computer running later versions of Windows 10 or Windows 11 to examine your data.
If you have any questions about this article or wish to offer some commentary, please do so below. Thank you for reading!