Recover Deleted Files with Windows File Recovery (NTFS, exFAT, ReFS)

Recover Deleted Files with Windows File Recovery (NTFS, exFAT, ReFS)​

Difficulty: Intermediate | Time Required: 15-30 minutes

Introduction​

Accidentally deleted files can be scary, but Microsoft’s free Windows File Recovery tool gives you a good chance to restore files from NTFS, exFAT, and ReFS drives — without paying for third‑party software. This tutorial walks you step‑by‑step through installing and using Windows File Recovery from the command line, with sample commands and troubleshooting tips so you can recover documents, photos, and other files quickly.

Prerequisites​

• Windows 10 version 2004 (build 19041) or later, or Windows 11.
• An administrator account (you must run the tool from an elevated command prompt).
• A second drive (destination) with enough free space to hold recovered files. The destination drive must NOT be the same drive you're recovering from.
• Minimal command-line familiarity (copy/paste of the sample commands is fine).

Important safety note: Stop using the drive that held the deleted files immediately (don’t save, install, or download to it) — every write can overwrite recoverable data.

Detailed step-by-step instructions​

1. Install Windows File Recovery
   1. Open Microsoft Store and search for “Windows File Recovery” (published by Microsoft Corporation).
   2. Click Install. Once installed, the app is accessible via the Start menu, but you will run it from an elevated Command Prompt or PowerShell.
2. Prepare your destination drive
   1. Connect an external USB drive or ensure another internal drive has enough free space.
   2. Make a new folder on the destination drive (example: D:\Recovered) to keep recovered files organized.
3. Open an elevated Command Prompt
   1. Type Start → type cmd → right‑click Command Prompt → Run as administrator.
   2. Confirm the UAC prompt if shown.
4. Basic syntax and what it means
   • Basic command structure:
     winfr <source-drive>: <destination-drive>: <mode> <filters>
   • Example pieces:
     • source-drive: the drive letter where files were lost (e.g., C
     • destination-drive: the drive letter where recovered files will be saved (e.g., D
     • mode: /regular or /extensive (explained below)
     • filters: /n to narrow search (path or wildcard)
5. Choose the correct mode (overview)
   • Regular mode (/regular)
     • Best for NTFS when files were recently deleted and Master File Table (MFT) entries still exist.
     • Fast and conservative.
   • Extensive mode (/extensive)
     • Use when the disk was formatted, corrupted, or when MFT entries are missing.
     • Slower but more thorough. Extensive has sub‑search behaviors (segment/signature) to help when metadata is missing.
6. Recovering a specific recently deleted NTFS file (fast)
   1. Example: recover a single Word file from C: to D:\Recovered
      • Command:
        winfr C: D:\Recovered /regular /n \Users\YourUserName\Documents\Important.docx
   2. Press Y to confirm and start. The tool creates Recovery_<timestamp> on D: and stores recovered files there.
7. Recover multiple files by type or folder (wildcards)
   1. Example: recover all .docx files under Documents
      • Command:
        winfr C: D:\Recovered /regular /n \Users\YourUserName\Documents*.docx
   2. Example: recover all JPG photos from drive G: (use Extensive if files are older or drive was formatted)
      • Command:
        winfr G: D:\Recovered /extensive /n *.jpg
8. When to run Extensive + signature/segment searches
   • If Regular returns no results (especially after formatting or corruption), try Extensive.
   • Use signature search when the file system metadata is gone (useful for exFAT and some ReFS cases). Example:
     • Command:
       winfr G: D:\Recovered /extensive /signature /n *.jpg
   • If you don’t specify filters, Extensive will run a broad scan (this can take a long time).
9. Review results
   1. When complete, open the destination Recovery_<date> folder.
   2. Recovered files are placed inside subfolders; a log file (e.g., recovery.log) is created to show successes and failures.
   3. Move recovered files to a safe location and verify them before reformatting or reusing the source drive.

Tips, warnings, and troubleshooting​

• Tip: Always use a different destination drive — never recover to the same drive you’re scanning. Writing to the source can permanently overwrite files.
• Tip: Narrow your search with /n (path or wildcard) to make scans faster and more likely to yield usable files.
• Warning: Recovery is not guaranteed. If the file clusters were overwritten, Windows File Recovery can’t reconstruct them.
• Troubleshooting: If you see “Insufficient privileges” or similar, ensure you launched Command Prompt as Administrator.
• Troubleshooting: If the tool reports “No files found,” try Extensive mode or add signature/segment options. Also double‑check exact filenames and wildcards.
• Note on ReFS/exFAT: These file systems sometimes lose metadata faster. If Regular mode fails on exFAT/ReFS, use Extensive with signature to search raw data patterns for common file types (e.g., JPG, PNG, PDF).
• Note on time: Extensive scans can take a long time on large drives — plan accordingly.
• If Windows File Recovery can’t recover what you need, consider professional recovery services or reputable third‑party tools (as a last resort).

Examples (copy/paste)

• Recover a document:
  winfr C: D:\Recovered /regular /n \Users\Alice\Documents\Budget.xlsx
• Recover photos from a formatted USB drive:
  winfr G: D:\Recovered /extensive /n *.jpg
• Broad scan (no filters — slow):
  winfr C: D:\Recovered /extensive

Conclusion​

Windows File Recovery is a powerful built‑in (free) tool for retrieving deleted files from NTFS, exFAT, and ReFS volumes. By choosing the right mode (Regular for recent NTFS deletions, Extensive for formatted/corrupted or missing metadata) and using filters, you can often recover important documents and photos quickly. Remember to stop using the source disk, recover to a different drive, and be patient — extensive scans can take time but are often worth it.
Key Takeaways:

• Use Windows File Recovery on Windows 10 v2004+ or Windows 11 (admin required).
• Recover to a different drive to avoid overwriting recoverable data.
• Regular mode is fast for recent NTFS deletions; Extensive (with segment/signature) is for formatted/corrupted/exFAT/ReFS scenarios.
• Narrow searches with /n (wildcards/paths) for faster, more accurate recovery.
• If built‑in recovery fails, consider professional or reputable third‑party recovery services.

---

This tutorial was generated to help WindowsForum.com users get the most out of their Windows experience.