Recovering Files

Recovering Deleted Files

Tools > Recover Deleted Files searches local NTFS, exFAT, and FAT12/16/32 drives for deleted files whose metadata survives. It requires administrator access and runs separately from the disk-usage scan. Network shares and MTP devices cannot be recovery sources.

Recover Files

1. Minimize writes to the source drive. If the files are still in the Windows Recycle Bin, restore them there first.
2. Choose File > Run Elevated, then Tools > Recover Deleted Files.
3. Select the source drive and press Resume (the play button) to start. Suspend pauses the operation; Stop ends it and keeps discoveries already validated.
4. After scanning, narrow the list with Path filter: enter part of a path, a filename wildcard such as *.jpg, or enable Use Regular Expressions. Matching is case-insensitive.
5. Select files and set Save To to an existing folder on another drive or a network share. Choose Recover Selected, then check each row's Result and open the recovered files to verify their contents.

Recovered files go directly into the destination folder; the original directory tree is not recreated. Existing files are not overwritten. If names collide, use separate destination folders. Saving to the source volume requires confirmation because it can overwrite other deleted data.

Assessments and Limits

Assessment	Meaning
Recoverable	File data remains inside an NTFS metadata record, or the file is empty.
May Be Recoverable	The required disk clusters are currently unallocated; their contents may already have changed.

Recovered - Verify File Data confirms that a file was copied, not that its contents are intact. Overwriting, SSD TRIM, or missing metadata can prevent useful recovery.

• NTFS recovery copies the main file contents; compressed or encrypted files, reparse points, and files requiring additional metadata records are skipped. Alternate data streams and original permissions are not restored.
• exFAT recovery supports files recorded as contiguous. FAT recovery assumes consecutive free clusters, so fragmented files may produce incorrect contents. Files inside deleted FAT/exFAT directories may be absent; FAT short names can begin with _ when the original first character is lost.
• If the result says Source metadata changed, scan the volume again before retrying. Recovery is not a replacement for a backup.