Windows 10 News and info | Forum
July 14, 2020, Loading... *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: This is a clean Ad-free Forum and protected by StopForumSpam, Project Honeypot, Botscout and AbuseIPDB | This forum does not use audio ads, popups, or other annoyances. New member registration currently disabled.
 
  Website   Home   Windows 8 Website GDPR Help Login Register  
By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy.
Pages: [1]
  Print  
Share this topic on Del.icio.usShare this topic on DiggShare this topic on FacebookShare this topic on GoogleShare this topic on MySpaceShare this topic on RedditShare this topic on StumbleUponShare this topic on TechnoratiShare this topic on TwitterShare this topic on YahooShare this topic on Google buzz
Author Topic: Microsoft quietly created a Windows 10 File Recovery tool, how to use  (Read 25 times)
javajolt
Administrator
Hero Member
*****
Online Online

Gender: Male
United States United States

Posts: 31581


I Do Windows


WWW Email
« on: June 30, 2020, 02:32:16 PM »
ReplyReply

Microsoft has created a Windows 10 File Recovery Tool that recovers deleted files and forgot to tell anyone.

Everyone has deleted a file by accident and then realized that they had no backup. If this file was critical, then you may get lucky using a third-party file recovery, or undelete, a program to recover the deleted data.

Windows sleuth WalkingCat recently discovered a program created by Microsoft called the 'Windows Recovery Tool.'

This tool states it is a file recovery program that allows you to undelete files on a hard drive, USB drive, and even an SD card.

Quote
"Accidentally deleted an important file? Wiped clean your hard drive? Unsure of what to do with corrupted data? Windows File Recovery can help recover your personal data."


Microsoft's Windows File Recovery Tool supports three modes of operation: 'Default,' 'Segment,' and 'Signature.'

Each of these modes attempts to recover deleted files from a storage device in a different way, as described below.

Default mode: This mode uses the Master File Table (MFT) to locate lost files. Default mode works well when the MFT and file segments, also called File Record Segments (FRS), are present.

Segment mode: This mode does not require the MFT but does require segments. Segments are summaries of file information that NTFS stores in the MFT such as name, date, size, type, and the cluster/allocation unit index.

Signature mode: This mode only requires that the data is present and searches for specific file types. It doesn't work for small files. To recover a file on an external storage device, such as a USB drive, you can only use Signature mode.

When installed, the program will be installed as a command-line tool called winfr.exe.

Below we have provided some examples of how to use the winfr tool in Windows 10.

How to use Microsoft's Windows File Recovery tool

To use the Windows 10 File Recovery Tool, you need to install the app first from the Microsoft Store.

As this program requires administrative privileges, once installed, you need to launch a Windows 10 elevated command prompt to use it.

In the command prompt, you can type winfr and press enter to see a list of the available commands.


Windows 10 File Recovery Tool

Quote
Windows File Recovery
Copyright (c) Microsoft Corporation. All rights reserved
Version:            0.0.11761.0
----------------------------------------------------------

USAGE: winfr source-drive: destination-folder [/switches]

/r           - Segment mode (NTFS only, recovery using file record segments)
/n [filter]  - Filter search (default or segment mode, wildcards allowed, trailing \ for folder)

/x           - Signature mode (recovery using file headers)
/y:[type(s)] - Recover specific extension groups (signature mode only, comma separated)
/#           - Displays signature mode extension groups and file types

/?           - Help text
/!           - Display advanced features

Example usage - winfr C: D:\RecoveryDestination /n Users\[username]\Downloads\
                winfr C: D:\RecoveryDestination /x /y:PDF,JPEG
                winfr C: D:\RecoveryDestination /r /n *.pdf /n *.jpg

Visit http://aka.ms/winfrhelp for user guide
For support, please email winfr@microsoft.com


Winfr also includes advanced options, which can be viewed by typing winfr /!.

These advanced options, shown below, allow you to fine-tune the recovery process by specifying what sectors to scan, how the recovery should perform, and disabling specific file extensions.

Quote
Windows File Recovery
Copyright (c) Microsoft Corporation. All rights reserved
Version:            0.0.11761.0
----------------------------------------------------------

USAGE: winfr source-drive: destination-folder [/switches]
/p:[folder]    - Specify recovery log destination (default: destination folder)
/a             - Accepts all user prompts

/u             - Recover non-deleted files (default/segment mode only)
/k             - Recover system files (default/segment mode only)
/o:[a|n|b]     - Overwrite (a)lways, (n)ever or keep (b)oth always (default/segment mode only)
/g             - Recover files without primary data stream (default: false, default/segment mode only)
/e             - Disable extension exclusion list (default/segment mode only)
/e:[extension] - Disable specific extension(s) (default extension list no longer applies) (default/segment mode only)

/s:[sectors]   - Number of sectors in volume (segment/signature mode only)
/b:[bytes]     - Number of bytes in cluster (segment/signature mode only)
/f:[sector]    - First sector to scan (segment/signature mode only)


When using the Windows 10 File Recovery Tool, you need to specify the source drive, the drive files will be recovered, and any filters that fine-tune what files are recovered and the file recovery mode.

For example, to use the 'default' mode to recover all deleted .JPG files on the D: drive and restore them to the E: drive, you would use the following command:

Quote
winfr D: F: /n *.JPG


To use the 'default' mode to recover all deleted files from the E:\temp folder, you would use the command:

Quote
winfr E: F: /n \temp\*.PNG



winfr.exe example

To use the 'segment' mode to search the C: drive for deleted files whose filename contained the string 'statement' and recover them to the E: drive, you would use the following command.

Quote
winfr C: E: /r /n *statement*


Finally, to use the 'signature' mode to recover Word documents (.docx) from the C: drive, you would use the following command:

Quote
winfr C: D:\RecoveryDestination /x /y:DOCX


It should be noted that when using filters that match a folder name, you should leave off the drive letter.

For example, if you set your source drive to C: and want to recover files from C:\ test, you would use a filter of /n \test\.

Unfortunately, in our tests, many of the recovered files were not actually usable. When attempting to recover .txt files from our E:, the recovered files were corrupt, as shown below.


Corrupted recovered file

We will continue to use the tool in real-life recovery tests to see how well it performs.

For now, though, you may have better success using tools like Photorec or Recuva to recover any deleted files.

source
Logged


Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2017, Simple Machines

Google visited last this page July 05, 2020, 11:21:39 AM