This is a basic guide on using the Windows File Recovery tool to pull information off of a flash drive. We’ll discuss the modes required and basic syntax for scanning a flash drive and recovering delete files. We’ll also cover how to specify a certain file type to search for, as this will significantly shorten the time required to recover files.
First you can find the Windows File Recovery Tool on the Microsoft store here: https://www.microsoft.com/en-us/p/windows-file-recovery/9n26s50ln705?activetab=pivot:overviewtab
This is a command line tool. You can open the downloaded app and it will display the help file for you. You can also open Windows PowerShell or Command Prompt then type: winfr /?
This will show you the same help file. One important note is the tool does require Windows 10 version 2004 or later to install. Make sure you’re updated before you attempt to install it, otherwise you won’t be able to. We’re going to attempt to recovery some intentionally deleted pictures from a 16GB flash drive D:
Once you open the tool, you should be greeted by the following screen. It’ll explain the basic syntax, detail what the switches do and gives you several examples. There is also a link at the bottom that provides more detailed information. We’ll link this in our resources section at the bottom of this article.
It’s important to note the modes for this tool and their file system limitations. We’re recovering from a flash drive that’s formatted FAT32. We can only use Signature mode. We’ll type the following command:
winfr D: C:\DataRecoveryTest\Recovered /x /y:JPEG
Let's break this down - Winfr is our executable. D is our target to recovery data from. The next segment is the path on our C drive, where we want the tool to recover data to. /x tells the tool to use signature mode. This is required because the flash drive is formatted as FAT32. If the flash drive is NTFS, you won’t need to include this. Lastly /y specifies the types of files to search for. You can have more than one file type, separate your file types by commas. For instance if I wanted to search JPG and PNG, I would type /y JPEG,PNG. Typing winfr /# will show you all compatible file types in a list.
- We’re going to press enter. It’ll indicate what we’ve told it to do. That we’re searching the D drive, that our target is on our C drive in a folder called DataRecoveryTest. That our mode is Signature and our extension filter is JPG for our pictures. Press ‘y’ and enter to continue.
- Now we’re going to wait for it to scan. If you need to cancel the scan you can press Control + C. This may take quite a while on even on a relatively small storage device. Default mode is considerably faster, relying on the MFT table to recover data. It is possible with default mode to recover a specific file that was deleted in say your documents folder by name. We’ll explain more on this later and link to the support article that has several examples.
Looks like we’ve got some files. We’ll press ‘y’ and it’ll open our File explorer, and show us individual folders for all the file types we specified. The tool successfully recovered all 15 pictures that I intentionally deleted for this test and completed in about 15 minutes.
Examples for this tool
The tool worked fairly well. This was a a simple example, but it’s free and it’s certainly worth giving it a shot if you accidentally delete your files. I’m going to include some other examples that might be useful to you below. We’ll also link the support page from Microsoft at the bottom.
Example 1: Recover a specific file that you know the file name of. Include the file extension in the name of the file. For instance if you lost an Excel file called fiscal years 2012 and your username is bob, you would type the following.
Type:
winfr C:D: /n \Users\Bob\Documents\fiscalyear2012.xlsx
You must recover to another volume. In this example the command would locate that file and restore it to your D drive.
Example 2: We’ll use Segment mode for this one. Let's say we need to search the drive for a file we can’t recall the name of, so we’re not sure what we’re looking for. We just remember “Fiscal” was in the filename.
Type:
winfr D: C:\DataRecoveryTest\Recovered /r /n *fiscal*
/r specifies segment mode, /n applies a filter, in this case to search for a string. Our string is ‘fiscal’.
Those are just a few examples of how this tool can be of use to you.
FAQ for the file recovery tool
What file systems are supported?
FAT, exFAT, NTFS and ReFS.
What are the modes and what are the file system restrictions on them?
Default, Segment and Signature. NTFS supports all modes. FAT, exFAT and ReFS can only use Signature mode.
What are the differences between the modes?
To keep it simple here, Default and Segment seem more geared towards finding specific, recently deleted files, when you know what you're looking for. Signature is the only type that supports FAT32 and exFAT. It's a deeper dive into finding and rebuilding lost files and it generally you're last stop and the most time consuming.
What are the chances this tool will recover my important files?
On a recently deleted file very good. When a file is deleted it isn’t erased, it’s forgotten about. Generally it’s easy to recover in the immediate future. The issue is the space where that data is written is no longer protected. You’re fine until something overwrites it, then data recovery becomes much more difficult. The file could be damaged, and your less likely to be able to recover information about a file, like the name, as an example.
What operating systems are supported?
You must be on Windows 10 version 2004 or later.
Will it work on SD cards?
Yes, it’ll work on any accessible storage device with a compatible file system.
Is this an alternative to file history or windows backup?
No, data recovery is the last resort. We would encourage you to use tools like file history and the automatic backup system on Windows 10. They’re easy to setup and they are the best way to protect your data.
Resources:
https://support.microsoft.com/en-us/help/4538642/windows-10-restore-lost-files
https://docs.microsoft.com/en-us/windows/whats-new/whats-new-windows-10-version-2004
