Windows File Recovery

1. If necessary, install the app from the Microsoft Store:

   Windows File Recovery

2. Press the Windows key, enter Windows File Recovery in the search box, and then select Windows File Recovery.

3. When you are prompted to allow the app to make changes to your device, select Yes.

4. In the Command Prompt window, enter the command in the following format:

   winfr source-drive: destination-drive: [/mode] [/switches]

5. There are 2 basic modes you can use to recover files: Regular and Extensive.

   Regular mode examples

   Recover your Documents folder from your C: drive to the recovery folder on an E: drive. Don’t forget the backslash (\) at the end of the folder.

   Winfr C: E: /regular /n \Users\<username>\Documents\

   Recover PDF and Word files from your C: drive to the recovery folder on an E: drive.

   Winfr C: E: /regular /n *.pdf /n *.docx

   Extensive mode examples

   Recover any file with the string "invoice" in the filename by using wildcard characters.

   Winfr E: C: /extensive /n *invoice*

   Recover jpeg and png photos from your Pictures folder to the recovery folder on an E: drive.

   Winfr C: E: /extensive /n \Users\<username>\Pictures\*.JPEG /n\Users\<username>\Pictures\*.PNG

   The source and destination drives must be different. When recovering from the operating system drive (often C: ), use the /n <filter> switches to specify the user files or folder.
   Microsoft automatically creates a recovery folder for you called, Recovery_<date and time> on the destination drive.

6. When you are prompted for confirmation to continue, enter Y to start the recovery operation. Depending on the size of your source drive, this may take a while. To stop the recovery process, press Ctrl + C.

The following information can help you decide which file system you have and which mode to use.

File systems

File system	Examples
FAT and exFAT	SD cards, flash or USB drives (< 4GB)
NTFS	Computers (HDD, SSD), external hard drives, flash or USB drives (> 4GB)

There are several file systems supported by Windows that vary depending on the storage device or operating system. Recovering files from non-NTFS file systems is only supported by extensive mode. To see which file system you have, right click a drive in File Explorer and select Properties.

Deciding which mode to use

Use the following table to help you decide which mode to use. If you are not sure, start with Regular mode.

File system	Circumstances	Recommended mode
NTFS	Deleted recently	Regular
NTFS	Deleted a while ago	Extensive
NTFS	After formatting a disk	Extensive
NTFS	A corrupted disk	Extensive
FAT and exFAT	Any	Extensive

General syntax

The following table summarizes what each advanced switch is used for.

Parameter / switch	Description	Supported mode(s)
Source-drive:	Specifies the storage device where the files were lost. Must be different from the destination-drive.	All
Destination-drive:	Specifies the storage device and folder on which to put the recovered files. Must be different from the source-drive.	All
/regular	Regular mode, the standard recovery option for non-corrupted NTFS drives	Regular
/extensive	Extensive mode, a thorough recovery option suitable for all file systems	Extensive
/n<filter>	Scans for a specific file by using a file name, file path, file type, or wildcards. For example: File name: /n myfile.docx File path: /n /users/<username>/Documents/ Wildcard: /n myfile.* /n *.docx /n *<string>*	All
/?	Summary of syntax and switches for general users.	All
/!	Summary of syntax and switches for advanced users.	All

Advanced syntax

The following table summarizes what each advanced switch is used for.

Switch	Description	Supported modes
/ntfs	NTFS mode, a fast recovery option for healthy NTFS drives using the master file table	NTFS
/segment	Segment mode, recovery option for NTFS drives using file record segments	Segment
/signature	Signature mode, recovery option for all file system types using file headers	Signature
/y:<type(s)>	Recover specific extension groups, comma separated	Signature
/#	Signature mode extension groups and supported file types.	Signature
/p:<folder>	Saves a log file of the recovery operation in a different location than the default location on the recovery drive (for example, D:\logfile).	All
/a	Overrides user prompts, which is useful in a script file.	All
/u	Recovers undeleted files, for example, from the Recycle Bin.	NTFS Segment
/k	Recovers system files.	NTFS Segment​​​​​
/o:<a|n|b>	Specifies whether to always (a), never (n), orkeep both always(b) when choosing whether to overwrite a file. The default action is to prompt to overwrite.	NTFS Segment​​​​​
/g	Recovers files without primary data streams.	NTFS Segment
/e	To keep your results manageable and focus on user files, some file types are filtered by default, but this switch removes that filter. For a complete list of these file types, see the information after this table.	NTFS Segment
/e:<extension>	Specifies which file types are filtered. For a complete list of these file types, see the information after this table.	NTFS Segment
/s:<sectors>	Specifies the number of sectors on the source device. To find sector information, use fsutil.	Segment Signature
/b:<bytes>	Specifies the cluster size (allocation unit) on the source device.	Segment Signature

File extension filter list

The following file types are filtered from results by default. Use the /e switch to disable this filter or the /e:<extension> filter to specify file types not to filter.

_, adm, admx, appx, appx, ascx, asm, aspx, aux, ax, bin, browser, c, cab, cat cdf-ms, catalogItem, cdxm, cmake, cmd, coffee, config, cp, cpp, cs, cshtm, css, cur, dat, dll, et, evtx, exe, fon, gpd, h, hbakedcurve, htm, htm, ico, id, ildl, ilpdb, iltoc, iltocpdb, in, inf, inf_loc, ini, js, json, lib, lnk, log, man, manifest, map, metadata, mf, mof, msc, msi, mui, mui, mum, mun, nls, npmignore, nupkg, nuspec, obj, p7s, p7x, pak, pckdep, pdb, pf, pkgdef, plist, pnf, pp, pri, props, ps1, ps1xm, psd1, psm1, py, resjson, resw, resx, rl, rs, sha512, snippet, sq, sys, t4, targets, th, tlb, tmSnippet, toc, ts, tt, ttf, vb, vbhtm, vbs, vsdir, vsix, vsixlangpack, vsixmanifest, vstdir, vstemplate, vstman, winmd, xam, xbf, xm, xrm-ms, xs, xsd, ym

Can you give some tips to help me use the correct syntax?

• Always use drive letters in the source and destination path, don’t forget the colon (:) after the drive letter, and make sure there is a space between the source and destination.

• When you specify just a folder name, such as /n \Myfolder\, add a backslash (\) at the end of it.

• If a file or folder name has spaces, surround it with quotes. For example:

winfr C: E: /regular /n "\Users\<username>\Documents\Quarterly Statement.docx"

What does <username> mean in the command examples?

In the File Explorer address bar, enter C:\users to see a list of potential users on your computer. There may be several users on your computer, including you, the administrator, and the default account. When you see <username> in a file path, it is a placeholder for the current username on your computer.

Why am I getting this message: "Source and Destination cannot refer to the same physical partition?"

The source and destination drive or partition path should not be the same. If you only have one drive, use a USB or external hard drive as your destination path. Don’t create a partition after losing data, because this reduces the chance of a successful recovery.

Why does the recovery operation take so long?

​Depending on the size of the disk, it may take some time to recover the file, especially if you are using Extensive mode.

Why are additional files recovered from my operating system drive?

Behind the scenes, Windows is constantly creating and deleting files. By default, Windows File Recovery filters out these files, but some slip through. To prevent this, use the /n <filter> as per examples in this article.

What is the $Recycle.Bin folder?

For NTFS and segment modes, you may also see lost files recovered from the Recycle Bin (files either in the recycle bin or that were permanently deleted) with the name $files.xxx and stored in a folder called $RECYCLE.BIN.

What happens if the destination drive is full?

If you see the following message: "Destination disk is full, please free up space before resuming: (R)esume, (S)kip file, or (A)bort," free up drive space on the destination drive, and then choose one of the options.

I was not able to recover the file, now what?

If you used Regular mode, try again in extensive mode if the file type is supported. It's possible that the free space was overwritten, especially on a solid-state drive (SSD). If you need help, contact your administrator.