1.If necessary, download and launch the app from Microsoft Store.

2.Press the Windows key, enter Windows File Recovery in the search box, and then
select Windows File Recovery.

3.When you are prompted to allow the app to make changes to your device, select Yes.

4.In the Command Prompt window, enter the command in the following format:

winfr source-drive: destination-drive: [/mode] [/switches]

5.There are 2 basic modes you can use to recover files: Regular and Extensive.

Regular mode examples

Recover your Documents folder from your C: drive to the recovery folder on an E:
drive. Don’t forget the backslash (\) at the end of the folder.

Winfr C: E: /regular /n \Users\<username>\Documents\

Recover PDF and Word files from your C: drive to the recovery folder on an E: drive.

Winfr C: E: /regular /n *.pdf /n *.docx

Extensive mode examples

Recover any file with the string "invoice" in the filename by using wildcard characters.

Winfr E: C: /extensive /n *invoice*

Recover jpeg and png photos from your Pictures folder to the recovery folder on an E: drive.

Winfr C: E: /extensive /n \Users\<username>\Pictures\*.JPEG /n\Users\

<username>\Pictures\*.PNG

The source and destination drives must be different. When recovering from the operating system
drive (often C: ), use the /n <filter> switches to specify the user files or folder.

Microsoft automatically creates a recovery folder for you called, Recovery_<date and
time> on the destination drive.

6.When you are prompted for confirmation to continue, enter Y to start the recovery
operation. Depending on the size of your source drive, this may take a while. To stop the recovery
process, press Ctrl + C.
Modes And File Systems

The following information can help you decide which file system you have and which mode
to use.

File systems

File system Examples

FAT and exFAT SD cards, flash or USB drives (< 4GB)

NTFS Computers (HDD, SSD), external hard drives, flash or USB drives (> 4GB)

There are several file systems supported by Windows that vary depending on the storage
device or operating system. Recovering files from non-NTFS file systems is only
supported by extensive mode. To see which file system you have, right click a drive in File
Explorer and select Properties.

Deciding which mode to use

Use the following table to help you decide which mode to use. If you are not sure, start
with Regular mode.

File system Circumstances Recommended mode

NTFS Deleted recently Regular

NTFS Deleted a while ago Extensive

NTFS After formatting a disk Extensive

NTFS A corrupted disk Extensive

FAT and exFAT Any Extensive

Command Line Syntax
General syntax

The following table summarizes what each advanced switch is used for.

Supported
Parameter / switch Description
mode(s)

Specifies the storage device where the files were

Source-drive: All
lost. Must be different from the destination-drive.

Specifies the storage device and folder on which

Destination-drive: to put the recovered files. Must be different from All
the source-drive.

Regular mode, the standard recovery option for

/regular Regular
non-corrupted NTFS drives

Extensive mode, a thorough recovery option

/extensive Extensive
suitable for all file systems

Scans for a specific file by using a file name, file

path, file type, or wildcards. For example:

 File name: /n myfile.docx

/n<filter>  File path: /n /users/<username>/Documents/ All

 Wildcard: /n myfile.*

 /n *.docx

 /n *<string>*

/? Summary of syntax and switches for general users. All

 Supported
Parameter / switch Description
mode(s)

Summary of syntax and switches for advanced

/! All
users.

Advanced syntax

The following table summarizes what each advanced switch is used for.

Supported
Switch Description
modes

NTFS mode, a fast recovery option for healthy NTFS drives

/ntfs NTFS
using the master file table

Segment mode, recovery option for NTFS drives using file

/segment Segment
record segments

Signature mode, recovery option for all file system types

/signature Signature
using file headers

/y:<type(s)> Recover specific extension groups, comma separated Signature

/# Signature mode extension groups and supported file types. Signature

Saves a log file of the recovery operation in a different

/p:<folder> location than the default location on the recovery drive (for All
example, D:\logfile).

/a Overrides user prompts, which is useful in a script file. All

 Supported
Switch Description
modes

NTFS
/u Recovers undeleted files, for example, from the Recycle Bin.
Segment

NTFS
/k Recovers system files.
Segment

Specifies whether to always (a), never (n), orkeep both

NTFS
/o:<a|n|b> always(b) when choosing whether to overwrite a file. The
Segment
default action is to prompt to overwrite.

NTFS
/g Recovers files without primary data streams.
Segment

To keep your results manageable and focus on user files,

some file types are filtered by default, but this switch NTFS
/e
removes that filter. For a complete list of these file types, Segment
see the information after this table.

/ Specifies which file types are filtered. For a complete list of NTFS
e:<extension> these file types, see the information after this table. Segment

Specifies the number of sectors on the source device. To Segment

/s:<sectors>
find sector information, use fsutil. Signature

Specifies the cluster size (allocation unit) on the source Segment

/b:<bytes>
device. Signature

File extension filter list

The following file types are filtered from results by default. Use the /e switch to disable this
filter or the /e:<extension> filter to specify file types not to filter.

_, adm, admx, appx, appx, ascx, asm, aspx, aux, ax, bin, browser, c, cab, cat cdf-ms,
catalogItem, cdxm, cmake, cmd, coffee, config, cp, cpp, cs, cshtm, css, cur, dat, dll, et, evtx,
exe, fon, gpd, h, hbakedcurve, htm, htm, ico, id, ildl, ilpdb, iltoc, iltocpdb, in, inf, inf_loc, ini,
js, json, lib, lnk, log, man, manifest, map, metadata, mf, mof, msc, msi, mui, mui, mum, mun,
nls, npmignore, nupkg, nuspec, obj, p7s, p7x, pak, pckdep, pdb, pf, pkgdef, plist, pnf, pp,
pri, props, ps1, ps1xm, psd1, psm1, py, resjson, resw, resx, rl, rs, sha512, snippet, sq, sys, t4,
targets, th, tlb, tmSnippet, toc, ts, tt, ttf, vb, vbhtm, vbs, vsdir, vsix, vsixlangpack,
vsixmanifest, vstdir, vstemplate, vstman, winmd, xam, xbf, xm, xrm-ms, xs, xsd, ym

Basic steps

1. If necessary, download and launch the app from Microsoft Store.

2. Press the Windows key, enter Windows File Recovery in the search box, and then select Windows
File Recovery.

3. When you are prompted to allow the app to make changes to your device, select Yes.

4. In the Command Prompt window, enter the command in the following format:

winfr source-drive: destination-drive: [/switches]

The source and destination drives must be different. When recovering from the operating system
drive (often C: ), use the /n <filter> and /y:<type<(s)> switches to specify the user files or folder.

Microsoft automatically creates a recovery folder for you called Recovery_<date and time> on the
destination drive.

There are three modes you can use to recover files: Default, Segment, and Signature.

Default mode examples

Recover a specific file from your C: drive to the recovery folder on an E: drive.

winfr C: E: /n \Users\<username>\Documents\QuarterlyStatement.docx

Recover jpeg and png photos from your Pictures folder to the recovery folder on an E: drive.

winfr C: E: /n \Users\<username>\Pictures\*.JPEG /n \Users\<username>\Pictures\*.PNG

Recover your Documents folder from your C: drive to the recovery folder on an E: drive.

winfr C: E: /n \Users\<username>\Documents\

Don’t forget the backslash (\) at the end of the folder.

Segment mode examples (/r)

Recover PDF and Word files from your C: drive to the recovery folder on an E: drive.

winfr C: E: /r /n *.pdf /n *.docx

Recover any file with the string "invoice" in the filename by using wildcard characters.

winfr C: E: /r /n *invoice*

Signature mode examples (/x)

When using signature mode, it's helpful to first see the supported extension groups and
corresponding file types.

winfr /#

Recover JPEG ( jpg, jpeg, jpe, jif, jfif, jfi) and PNG photos from your C: drive to the recovery folder on
an E: drive.

winfr C: E: /x /y:JPEG,PNG
 Recover ZIP files (zip, docx, xlsx, ptpx, and so on) from your C: drive to the recovery folder on an E:
drive.

winfr C: E:\RecoveryTest /x /y:ZIP

5. When you are prompted for confirmation to continue, enter Y to start the recovery operation.

Depending on the size of your source drive, this may take a while.

To stop the recovery process, press Ctrl+C.

About modes and file systems

The following information can help you decide which file system you have and which mode
to use.

File systems

There are several file systems supported by Windows that vary depending on the storage
device or operating system. Recovering files from non-NTFS file systems is only supported
in signature mode. To see which file system you have, right click a drive in File Explorer and
select Properties.

File system Examples

FAT and exFAT SD cards, flash or USB drives (< 4GB)

ReFS Windows Server and Windows Pro for Workstations

NTFS Computers (HDD, SSD), external hard drives, flash or USB drives (> 4GB)

Deciding which mode to use

Use the following table to help you decide which mode to use. If you're not sure, start with
the default mode.
File system Circumstances Recommended mode

NTFS Deleted recently Default

Segment, followed by
NTFS Deleted a while ago
Signature

Segment, followed by
NTFS After formatting a disk
Signature

Segment, followed by
NTFS A corrupted disk
Signature

Recovery file type is supported (see following

FAT, exFAT Signature
table)

Signature mode extension groups and file types

The following table summarizes the extension groups and the supported file types for each
group when you use the /y:<type(s)> switch

Extension group File type

ASF wma, wmv, asf

JPEG jpg, jpeg, jpe, jif, jfif, jfi

MP3 mp3

MPEG mpeg, mp4, mpg, m4a, m4v, m4b, m4r, mov, 3gp, qt

PDF pdf
PNG png

zip, docx, xlsx, pptx, odt, ods, odp, odg, odi, odf, odc, odm, ott, otg, otp,
ZIP
ots, otc, oti, otf, oth

Command line syntax

General syntax

The following table summarizes what each basic command line parameter and switch is
used for.

Supported
Parameter or switchDescription
modes

Specifies the storage device where the files were lost.

Source-drive: All
Must be different from the destination-drive.

Specifies the storage device and folder on which to

Destination-drive: put the recovered files. Must be different from the All
source-drive.

Uses segment mode, which examines File Record

/r Segment
Segments (FRS).

Scans for a specific file by using a file name, file path,

or wildcards. For example:

Default
/n <filter>  File name: /n myfile.docx
Segment
 File path: /n /users/<username>/Documents/

 Wildcard: /n myfile.*
/n *.docx
 /n *<string>*

Uses signature mode, which examines file types and

/x Signature
works on all file systems.

Scans for files with specific file types. Separate

multiple entries by using commas. For a list of
extension groups and corresponding file types, see
/y:<type(s)> Signature
the table, "Signature mode extension groups and file
types" in the section, "About modes and file
systems".

Shows signature mode extension groups and

/# All
corresponding file types in each group.

Shows a quick summary of syntax and switches for

/? All
general users.

Shows a quick summary of syntax and switches for

/! All
advanced users.

Advanced syntax

The following table summarizes what each advanced switch is used for.

Supported
Switch Description
modes

Saves a log file of the recovery operation in a different

/p:<folder> location than the default location on the recovery drive (for All
example, D:\logfile).
/a Overrides user prompts, which is useful in a script file. All

Default
/u Recovers undeleted files, for example, from the Recycle Bin.
Segment

Default
/k Recovers system files.
Segment

Specifies whether to always (a), never (n), orkeep both

Default
/o:<a|n|b> always(b) when choosing whether to overwrite a file. The
Segment
default action is to prompt to overwrite.

Default
/g Recovers files without primary data streams.
Segment

To keep your results manageable and focus on user files,

some file types are filtered by default, but this switch Default
/e
removes that filter. For a complete list of these file types, Segment
see the information after this table.

/ Specifies which file types are filtered. For a complete list of Default
e:<extension> these file types, see the information after this table. Segment

Specifies the number of sectors on the source device. To Segment

/s:<sectors>
find sector information, use fsutil. Signature

Specifies the cluster size (allocation unit) on the source Segment

/b:<bytes>
device. Signature

Segment
/f:>sector> First sector to scan on the source device.
Signature