Microsoft Windows File Recovery is an official tool to recover deleted files from hard drives, SD cards, USB drives and other storage media. Here is a detailed step-by-step guide on how to use this command line utility.
What do you want to know
Microsoft Windows File Recovery Tool does not have a GUI, it is only a command line utility. We’ll show you how to use it, but it’s a more hands-on process than you might expect from an official Microsoft utility available in the Microsoft Store.
This tool requires that you have installed Windows 10 May 2020 Update or newer, or any version of Windows 11. It does not work on older versions of Windows.
Whether or not Microsoft’s tool can find and recover a file you’ve deleted depends on the drive. Deleted files are not immediately deleted from hard drives, but they are often deleted immediately from SSD drives. If you have written a lot of data to a device like an SD card since you deleted the file, chances are the data in the file has been overwritten.
Even if you manage to recover a file, you may only get part of the file’s data—the file may be corrupt. You can only get data that is still on the drive. There are no guarantees here, and that’s why backups are so important.
The utility also has several modes intended for different situations and file systems. We’ll explain which ones you should use and how to use them.
How to Install Windows File Recovery
To start, install windows file recovery tool from the Microsoft Store to get started. You can open the Store and search for “Windows File Recovery” or just click this link to open the Store.
Once installed, open your start menu and search for “File Recovery”. Launch the “Windows File Recovery” shortcut once and click “Yes” on the UAC prompt.
You will see a command prompt window with administrator access. This is where you will run file recovery commands.
You can use other command line environments like Windows Terminal and PowerShell, but be sure to launch them with admin access. (From the start menu, right-click the one you want to use and select “Run as administrator”.)
How to Recover Deleted Files on Windows 10 and Windows 11
To use this tool, you will run the winfr , specifying the drive where you want to search for the deleted file, the destination where you want to save it, and the various switches that control what the tool looks for and how it looks. You need to save the deleted file to another drive.
Here is the basic format:
winfr source-drive: destination-drive: /switches
After running the command, the tool will automatically create a directory named “Recovery_[date and time]” on the destination drive you specify.
What mode should you use?
Before continuing, you must determine the “mode” you want to search for the deleted file. There are three modes, default, segment and signature. Default is the fastest mode, while Segment is similar but slower and more in-depth. Signature mode can search for files by type. It supports ASF, JPEG, MP3, MPEG, PDF, PNG and ZIP files. (Searching for “ZIP” files can also find Office documents stored in formats like DOCX, XLSX, and PPTX.)
You will need to know what file system the drive you are scanning is formatted with. To find it, open File Explorer, right-click the drive under This PC, and select “Properties.” You will see the file system displayed in the “General” tab.
Here’s when to use the different modes:
- Are you trying to find a file you recently deleted on a drive formatted with NTFS, which is the default file system in Windows 10 and 11? Use the default mode.
- If you are scanning an NTFS drive in another situation – for example, if you deleted the file some time ago, formatted the drive, or are dealing with a corrupted drive – try Segment mode first, then try Signature mode afterwards.
- Are you trying to find a file stored on a FAT, exFAT or ReFS drive? Use signature mode. Default and Segment modes only work on NTFS file systems.
If in doubt, just start with the default mode. You can then try Segment then Signature if the default mode doesn’t work.
How to recover a file in default mode
To use the default mode, you use /n followed by a search path:
- To search for a file named document.docx, you would use
/n document.docx. You can also specify a full file path, such as/n UsersBobDocumentsdocument.docx - To find all the files that were in the Documents folder if your username is Bob, you would use
/n UsersBobDocuments. - To search with a wildcard, use a *. For instance
/n UsersBobDocuments*.docxwill find all DOCX files that were in the Documents folder.
Let’s put it all together now. To find all DOCX files on the C: drive and copy them to the D: drive, run the following command:
winfr C: D: /n *.docx
You will need to type “y” to continue.
As we mentioned above, you will find the recovered files in a directory named “Recovery_[date and time]” on the destination drive you specified in the command line.
To find all files with a word in their name, use wildcards. So to find all documents with “project” anywhere in their name, you would run:
winfr C: D: /n *project*
You can specify multiple searches with multiple /n switches. So, to find all Word, Excel and PowerPoint files, you need to run the following:
winfr C: D: /n *.docx /n *.xlsx /n *.pptx
To find a specific file named important_document.pdf that was in the UsersBobDocuments folder on the C: drive, and then save it to the D: drive, you would use:
winfr C: D: /n UsersBobDocumentsimportant_document.pdf
How to recover a file in segment mode
Segment mode works almost exactly like the default mode. To use segment mode, which examines file record segments, you use /r in addition to /n .
In other words, you can build recovery commands in Segment mode the same way you build commands in default mode – just add the /r .
For example, to recover all deleted MP3 files from your C: drive and save them to your D: drive, you would run:
winfr C: D: /r /n *.mp3
So if a search in default mode doesn’t find what you’re looking for, add the /r and try again.
How to recover a file in signature mode
Signature mode works a little differently. It examines file types, so it can only find deleted files of certain file types. To use Signature mode, you use /x to specify Signature mode and /y: to list the groups of file types you want to search.
Here is a list of supported file types and the groups they are sorted into, taken from Microsoft documentation:
- ASF: wma, wmv, asf
- JPEG: jpg, jpeg, jpe, jif, jfif, jfi
- MP3: mp3
- MPEG: mpeg, mp4, mpg, m4a, m4v, m4b, m4r, mov, 3gp, qt
- PDF: pdf
- PNG:png
- ZIP *: ENGLISH: zip, docx, xlsx, pptx, odt, ods, odp, odg, odi, odf, odc, odm, ott, otg, otp, ots, otc, oti, otf, oth
Note that the “ZIP” group includes ZIP files in addition to Microsoft Office and OpenDocument documents.
You can view this list at any time by running the following command:
winfr /#
Suppose you want to search drive E: for images in JPEG format and save them to drive D:. You would run the following command:
winfr E: D: /x /y:JPEG
You can specify multiple filegroups by separating them with a space. So if you want to find JPEGs, PDFs and Word documents, you would run:
winfr E: D: /x /y:JPEG,PDF,ZIP
More help with winfr
More information is available at Microsoft official winfr documentation. You will find a detailed list of all winfr also the command line options on this page.
For a refresher on the basics, just run winfr Where winfr /? .
There are also additional advanced options which you can see by running winfr /! .
Comments are closed.