Posted on

Lost files in Windows 10? Windows File Recovery to the Rescue

If you can’t locate a lost file from your backup, then you can use Windows File Recovery, which is a command line app available from the Microsoft Store. Use this app to try to recover lost files that have been deleted from your local storage device (including internal drives, external drives, and USB devices) and can’t be restored from the Recycle Bin. Recovery on cloud storage and network file shares is not supported.

Note   This app requires Windows 10 build 19041 or later (See which version of Windows 10 you have).

Important

If you want to increase your chances of recovering a file, minimize or avoid using your computer. In the Windows file system, the space used by a deleted file is marked as free space, which means the file data can still exist and be recovered. But any use of your computer can create files, which may over-write this free space at any time. 

How to recover and restore lost files on Windows 10

General


Basic Steps

  1. If necessary, download and launch the app from the Microsoft Store.
  2. Press the Windows key, enter Windows File Recovery in the search box, and then select Windows File Recovery.
  3. When you are prompted to allow the app to make changes to your device, select Yes.
  4. In the Command Prompt window,enter the command in the following format:winfr source-drive: destination-drive: [/switches]
    The source and destination drives must be different. When recovering from the operating system drive (often C: ), use the /n <filter> and /y:<type<(s)> switches to specify the user files or folder.

    Microsoft automatically creates a recovery folder for you called, Recovery_<date and time> on the destination drive.

    There are three modes you can use to recover files: Default, Segment, and Signature.

    Default mode examples

    Recover a specific file from your C: drive to the recovery folder on an E: drive.winfr C: E: /n \Users\<username>\Documents\QuarterlyStatement.docx
    Recover jpeg and png photos from your Pictures folder to the recovery folder on an E: drive.winfr C: E: /n \Users\<username>\Pictures\*.JPEG /n \Users\<username>\Pictures\*.PNG
    Recover your Documents folder from your C: drive to the recovery folder on an E: drive.winfr C: E: /n \Users\<username>\Documents\
    Don’t forget the backslash (\) at the end of the folder.

    Segment mode examples (/r)

    Recover PDF and Word files from your C: drive to the recovery folder on an E: drive.winfr C: E: /r /n *.pdf /n *.docx
    Recover any file with the string “invoice” in the filename by using wildcard characters.winfr C: E: /r /n *invoice*
    Signature mode examples (/x)

    When using signature mode, it’s helpful to first see the supported extension groups and corresponding file types.winfr /#
    Recover JPEG (jpg, jpeg, jpe, jif, jfif, jfi) and PNG photos from your C: drive to the recovery folder on an E: drive.winfr C: E: /x /y:JPEG,PNG
    Recover ZIP files (zip, docx, xlsx, ptpx, and so on) from your C: drive to the recovery folder on an E: drive.winfr C: E:\RecoveryTest /x /y:ZIP 
  5. When you are prompted for confirmation to continue, enter Y to start the recovery operation.

    Depending on the size of your source drive, this may take a while.

    To stop the recovery process, press Ctrl+C.

About modes and file systems

The following information can help you decide which file system you have and which mode to use.

File systems​

There are several file systems supported by Windows that vary depending on the storage device or operating system. Recovering files from non-NTFS file systems is only supported in signature mode. To see which file system you have, right click a drive in File Explorer and select Properties.

File systemExamples
FAT and exFATSD cards, Flash or USB drives (< 4GB)
ReFSWindows Server and Windows Pro for Workstations
NTFSComputers (HDD, SSD), external hard drives, flash or USB drives (> 4GB)

Deciding which mode to use

Use the following table to help you decide which mode to use. If you’re not sure, start with the default mode.

 File SystemCircumstancesRecommended mode
 NTFSDeleted recentlyDefault
 Deleted a while agoFirst try Segment, then Signature
 After formatting a disk
 A corrupted disk
 FAT, exFAT, ReFSRecovery file type is supported (See following table)Signature

Signature mode extension groups and file types

The following table summarizes the extension groups and the supported file types for each group when you use the /y:<type(s)> switch:

Extension groupFile type
ASFwma, wmv, asf
JPEGjpg, jpeg, jpe, jif, jfif, jfi
MP3mp3
MPEGmpeg, mp4, mpg, m4a, m4v, m4b, m4r, mov, 3gp, qt
PDFpdf
PNGpng
ZIPzip, docx, xlsx, pptx, odt, ods, odp, odg, odi, odf, odc, odm, ott, otg, otp, ots, otc, oti, otf, oth

Command line syntax

The following table summarizes what each basic command line parameter and switch is used for.


Parameter or switchDescriptionSupported modes
Source-drive:Specifies the storage device where the files were lost. Must be different from the destination-drive.All
Destination-drive:Specifies the storage device and folder on which to put the recovered files. Must be different from the source-drive.All
/rUses segment mode, which examines File Record Segments (FRS).Segment
/n <filter>Scans for a specific file by using a file name, file path, or wildcards. For example:File name: /n myfile.docxFile path: /n /users/<username>/Documents/Wildcard: /n myfile.*
/n *.docx
/n *<string>*
Default
Segment
/xUses signature mode, which examines file types and works on all file systems.Signature
/y:<type(s)>Scans for files with specific file types. Separate multiple entries by using commas. For a list of extension groups and corresponding file types, see the table, “Signature mode extension groups and file types” in the section, “About modes and file systems”.Signature
/#Shows signature mode extension groups and corresponding file types in each group.All
/?Shows a quick summary of syntax and switches for general users.All
/!Shows a quick summary of syntax and switches for advanced users.All


Frequently asked questions

Can you give some tips to help me use correct syntax?

Here are some suggestions:

  • Always use drive letters in the source and destination path, don’t forget the colon (:) after the drive letter, and make sure there is a space between the source and destination.
  • If a switch has a colon, such as /y:, don’t add a space between the colon and the rest of the value.
  • When you specify just a folder name, such as /n \Myfolder\, add a backslash (\) at the end of it.
  • If a file or folder name has spaces, surround it with quotes. For example:
     winfr C: E: /n "\Users\<username>\Documents\Quarterly Statement.docx"
  • To stop the recovery process, press Ctrl+C.

What does <username> mean in the command examples?

In the File Explorer address bar, enter C:\users to see a list of potential users on your computer. There may be several users on your computer, including you, the administrator, and the default account. When you see <username> in a file path, it is a placeholder for the current username on your computer.

Why am I getting this message: “Source and Destination cannot refer to the same physical partition?”

The source and destination drive or partition path should not be the same. If you only have one drive, use a USB or external hard drive as your destination path. Don’t create a partition after losing data, because this reduces the chance of a successful recovery.

Why does the recovery operation take so long?

​Depending on the size of the disk, it may take some time to recover the file, especially if you are using signature mode.

Why are additional files recovered from my operating system drive?

Behind the scenes, Windows is constantly creating and deleting files. By default, Windows File Recovery filters out these files, but some slip through. To prevent this, use the /n <filter> switch in default and segment modes and the /y:<type(s)> switch in signature mode.

What is the $Recycle.Bin folder?

For default and segment modes, you may also see lost files recovered from the Recycle Bin (files either in the recycle bin or that were permanently deleted) with the name $files.xxx and stored in a folder called $RECYCLE.BIN.

What happens if the destination drive is full?

If you see the following message: “Destination disk is full, please free up space before resuming: (R)esume, (S)kip file, or (A)bort”, Free up drive space on the destination drive, and then choose one of the options.

I was not able to recover the file, now what?

If you used default or segment mode, try again in signature mode if the file type is supported. It’s possible that the free space was over-written, especially on a solid state drive (SSD). If you need help, contact your administrator.

Advanced


Command line syntax

The following table summarizes what each advanced switch is used for.

SwitchDescriptionSupported modes
/p:<folder>Saves a log file of the recovery operation in a different location than the default location on the recovery drive (for example, D:\logfile).All
/aOverrides user prompts, which is useful in a script file.All
/uRecovers undeleted files, for example, from the Recycle Bin.Default
Segment
/kRecovers system files.Default
Segment​​​​​
/o:<a|n|b>Specifies whether to always (a), never (n), orkeep both always(b) when choosing whether to overwrite a file. The default action is to prompt to overwrite.Default
Segment​​​​​
/gRecovers files without primary data streams.Default
Segment
/eTo keep your results manageable and focus on user files, some file types are filtered by default, but this switch removes that filter. For a complete list of these file types, see the information after this table.Default
Segment
/e:<extension>Specifies which file types are filtered. For a complete list of these file types, see the information after this table.Default
Segment
/s:<sectors>Specifies the number of sectors on the source device. To find sector information, use fsutil.Segment
Signature
/b:<bytes>Specifies the cluster size (allocation unit) on the source device. Segment
Signature
/f:<sector>Specifies the first sector on the source device to start the scan operation, for example, to bypass unusable sectors. To find sector information, use fsutil.Segment
Signature


File extension filter list

The following file types are filtered from results by default. Use the /e switch to disable this filter or the /e:<extension> filter to specify file types not to filter.

_, adm, admx, appx, appx, ascx, asm, aspx, aux, ax, bin, browser, c, cab, cat cdf-ms, catalogItem, cdxm, cmake, cmd, coffee, config, cp, cpp, cs, cshtm, css, cur, dat, dll, et, evtx, exe, fon, gpd, h, hbakedcurve, htm, htm, ico, id, ildl, ilpdb, iltoc, iltocpdb, in, inf, inf_loc, ini, js, json, lib, lnk, log, man, manifest, map, metadata, mf, mof, msc, msi, mui, mui, mum, mun, nls, npmignore, nupkg, nuspec, obj, p7s, p7x, pak, pckdep, pdb, pf, pkgdef, plist, pnf, pp, pri, props, ps1, ps1xm, psd1, psm1, py, resjson, resw, resx, rl, rs, sha512, snippet, sq, sys, t4, targets, th, tlb, tmSnippet, toc, ts, tt, ttf, vb, vbhtm, vbs, vsdir, vsix, vsixlangpack, vsixmanifest, vstdir, vstemplate, vstman, winmd, xam, xbf, xm, xrm-ms, xs, xsd, ym

Background concepts

As you use the Windows File Recovery app, it’s often helpful to understand what’s going on “under the hood” of a storage device.

The three modes of operation

The three modes work in the following way:

  • Default mode   This mode uses the Master File Table (MFT) to locate lost files. Default mode works well when the MFT and file segments, also called File Record Segments (FRS), are present.
  • Segment mode    This mode does not require the MFT but does require segments. Segments are summaries of file information that NTFS stores in the MFT such as name, date, size, type and the cluster/allocation unit index.
  • Signature mode    This mode only requires that the data is present and searches for specific file types. It doesn’t work for small files. To recover a file on an external storage device, such as a USB drive, you can only use Signature mode.

How a storage device is organized

The bytes on a storage device are organized into clusters and sectors. A cluster is the smallest amount of disk space that can be allocated for a file. A sector is a unit of storage on a storage device. NTFS organizes disks based on cluster size, which is determined by the number of sectors in a cluster. On NTFS, clusters start at 0 and are numbered sequentially from the beginning of the partition into logical cluster numbers.

How a storage device is organized

The default cluster size varies depending on the capacity of the storage device:

Device sizeCluster sizeSectors
7 to 512 MB512 bytes1
513 to 1,024 MB1 KB2
1,025 MB to 2 GB2KB4
2 GB to 2 TB4 KB8

The NTFS file system

New Technology File System (NTFS) is the default file system in Windows. NTFS organizes files by using a well-defined structure to describe how files are stored, what information to include, and how to locate the files. A critical element is the Master File Table (MFT), which is a table made up of one row for each file and several columns of file attributes. This row is the File Record Segment (FRS). The MFT is like a table of contents for every file on the storage device. NTFS also keeps a backup of the MFT in case the original MFT becomes unusable.

Overview of NTFS
MFT AttributeDescription
Standard informationSettings, such as read-only and archive, file creation and modification dates, and so on.
File nameThe name of the file including the MS-DOS short name.
DataThe contents of the file if it’s small.
IndexInformation about the file allocation.


Additional attributes include file type, permissions, size, and file path.

Thank you to Microsoft

Posted on

Windows 10 May 2020 update 2004 makes it easy to Refresh Windows

Microsoft is now informing Windows 10 users that it’d moved the ‘Fresh start’ feature to ‘Reset this PC’ in Windows 10 May 2020 Update(a.k.a. Windows 10 Version 2004) – says MS power user. However, if you’re running an older version of Windows 10, which is Windows 10 1909 or older, you can still locate the ‘Fresh Start’ option in the Windows Security app. Right below the ‘Fresh start’ option, you’ll also see an option called ‘Additional info’ option, clicking on which will display the ‘Get Started’ button. You’ll need to click on it will start the process of reinstalling Windows 10.

In Windows 10 May 2020 Update, things have changed a bit. While you’ll still see the ‘Fresh start’ option in May 2020 Update, clicking on the ‘Additional info’ will no longer give you the ‘Get Started’ option. Instead, it’ll lead you to the “Windows Security Track device performance & Health page’ in the browser(via Techdows).

Fresh start is available for Windows 10 versions prior to 2004. For version 2004 and after, Fresh start functionality has been moved to Reset this PC. To reset your PC, go to Start  > Settings  > Update & Security   > Recovery  > Reset this PC Get Started. Then select Keep my files, choose cloud or local, change your settings, and set Restore preinstalled apps? to No.

If you don’t see the option to Restore preinstalled apps, it means your PC doesn’t have preinstalled apps configured and won’t restore apps from your PC manufacurer.

In other words, if you’re using Windows 10 May 2020 Update or later and want to reinstall Windows 10, you now need to go to  Start  > Settings  > Update & Security   > Recovery  > Reset this PC Get Started — and that’s the only way!

Posted on

Windows and Linux are now one? The new Windows Terminal

Dual Boot is Dead. Turn your Windows machine into a developer workstation with WSL 2.

The new Windows Terminal WSL2

Dimitris Poulopoulos for Towards Dark Science started building a machine learning workstation. He writes, a great CPU, lots of RAM and a competent GPU, among others. My OS of choice for almost anything was Ubuntu, except I needed Microsoft Office for proposal writing. Office online is just not there yet and, let’s face it, LibreOffice is a disaster. So, the solution was to dual boot Ubuntu and Windows 10. The freedom you experience moving from Apple to Ubuntu is unparalleled, and the options you have building your own PC are almost infinite.

Dual boot was the answer for a long time. One million of context switches later, WSL came. Thus, I started moving a portion of my workflow to Windows. But still, there were many things missing. However, WSL 2 seems to be a game-changer. In this story, I will show you how to move your development workflow to Windows 10 and WSL 2, its new features and what to expect in the near future.

What is WSL 2

WSL 2 is the new version of the architecture in WSL. This version comes with several changes that dictate how Linux distributions interact with Windows.

With this release, you get increased file system performance and a full system call compatibility. Of course, you can choose to run your Linux distribution as either WSL 1 or WSL 2, and, moreover, you can switch between those versions at any time. WSL 2 is a major overhaul of the underlying architecture and uses virtualization technology and a Linux kernel to enable its new features. But Microsoft handles the nitty-gritty details so you can focus on what matters.

Installation

Microsoft promises a smooth installation experience in the near future for WSL 2 and the ability to update the Linux kernel via Windows updates. For now, the installation process is a bit more involved but nothing scary.

In this example, we will install Ubuntu 20.04 on Windows 10. But the process is the same for any distribution available in Microsoft store. First, you should enable the Windows Subsystem for Linux optional feature. Open PowerShell as Administrator and run the following command:

dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart

On the next step, we will update our system to WSL 2. For this, Windows 10 must be updated to version 2004 and Intel’s virtualization technology must be enabled in BIOS settings. Launch PowerShell as Administrator and run the following command:

dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Restart your machine to complete the WSL install and update to WSL 2. Then, you need to set WSL 2 as our default version when installing a new distribution. For this, open PowerShell as Administrator and run the following command:

wsl --set-default-version 2

You might see this message after running that command: WSL 2 requires an update to its kernel component. For information please visit https://aka.ms/wsl2kernel. Follow the link and install the MSI from that page to install a Linux kernel on your machine for WSL 2 to use. Once you have the kernel installed, run the command again and it should complete successfully without showing the message.

Last but not least, we should install a Linux distribution. Open the Microsoft store and search for Ubuntu 20.04 LTS. After installing it, you should be able to find a new Ubuntu app on our start menu. Launch it and follow the instructions (mainly create a new UNIX user) to finalize the installation.

To check whether your Linux distribution is installed on WSL 2 run wsl --list --verbose. If the result indicates that it uses WSL 1 you can change it by running wsl --set-version <distribution name> <versionNumber>.

And that’s it. You now have a complete Ubuntu distribution running inside Windows 10!

A Developer Workstation

Having Ubuntu up and ready, you can now install whatever you need. For example, you can install the latest Anaconda distribution if you are a data scientist, angular and npm if you are a front-end engineer and many more. But there are two tools I would like to focus on: Visual Studio Code and Docker + Kubernetes.

Visual Studio Code

Visual Studio Code is the IDE of choice for many developers. Now that we have WSL 2 enabled, the absolutely necessary extension for VS Code is Remote Development.

This plug-in enables remote development against source code that exists on WSL 2, a container image or even a remote VM via SSH. Thus, we can now create our project folders inside our Linux distribution running on WSL 2 and use the Visual Studio Code editor installed on Windows 10 as our IDE.

All the features are there: full language support with IntelliSense, git integration, Visual Studio Code extensions we know and love, the debugger and the terminal. So, get your hands dirty and start coding!

Docker + Kubernetes

Docker for Windows is good but not great. That was the thing that I was missing the most, the thing that was making me switch between Windows and Ubuntu whenever I needed to build a docker image for my code. But WSL 2 comes with full docker support which, in my opinion, is even better than the pure Linux experience.

To enable it, navigate to your Docker Desktop settings and enable the Use the WSL 2 based engine option.

Enabling Docker for WSL 2

Moreover, you can run a local Kubernetes cluster, by navigating to the Kubernetes section of the settings and ticking the box.

Enable Kubernetes on WSL 2

You can now return to Ubuntu on WSL 2, run docker version or kubectl version and see that the two are up and running.

Docker and Kubernetes running on WSL 2

Bonus: The new Windows Terminal

For an added bonus, you can install the new Windows Terminal. The store description defines the new Windows Terminal as a modern, fast, efficient, powerful, and productive terminal application for users of command-line tools and shells like Command Prompt, PowerShell, and WSL. Its main features include multiple tabs, panes, Unicode and UTF-8 character support, a GPU accelerated text rendering engine, and custom themes, styles, and configurations.

Moreover, it is very beautiful and you can style it however you want, through its accessible settings that are just a JSON file. Look here for inspiration! More on the new Windows Terminal here:The New Windows Terminal: You Could Not Have Asked for MoreThe new Windows terminal combines everything in a smart and highly-customizable package.towardsdatascience.com

Roadmap

There are still some features missing, but WSL 2 is on the right path. In the upcoming months, you will be able to install WSL with a single command. Just open a Windows Terminal and enter wsl.exe --install. Also, WSL 2 will be the new default when installing for the first time.

But there are two features that developers expect the most: GPU support and GUI app support.

Adding CUDA and/or GPU Compute support to WSL is the most requested feature since the release of WSL 1. Over the last years, the WSL, Virtualization, DirectX, Windows Driver teams, and other partners have been working hard on this engineering feature. So stay tuned!

Train a Deep Learning model on WSL 2 (CUDA enabled)

Furthermore, support for Linux GUI apps is coming as well. For example, you will be able to run your preferred Linux GUI text editor or IDE in the Linux environment you have installed. You will be able to even develop Linux GUI apps, all in your Windows machine!

Linux GUI support for WSL 2

Conclusion

In this story, we saw how WSL 2 can turn your Windows PC into a developer workstation running a Linux distribution. The speed is there, the features are there, more are coming up, thus, I would argue that dual boot is dead!