Enlarge /. Although an eraser utility can occasionally save your bacon, relying on one was never a good idea.

Although it's not yet built into Windows, Microsoft has finally released its own file recovery tool – it's called Windows File Recovery and it works with the latest builds of Windows (known as 20H1, 2004, and 19041). We were pretty excited to see that this tool became available – although proper system administration means frequent backups that make this tool unnecessary. In the real world, proper system administration and frequent backups are far less common than we would like.

The lack of a suitable file deletion tool in Windows means that many of us have hoarded one of a few old third-party shareware or freemium utilities that can be used to scan disks and search for remnants of deleted files. The "hoarding" part is unfortunately necessary because finding one of these utilities means searching batches of scam apps for desperate users – and often you can't be sure if you found one of the good ones or one of the scams until after You installed it (hopefully in a sandbox or isolated VM).

installation

  • Microsoft has an advertising problem: When you search Bing (the default search provider in Edge for a brand new installation from 2004) for Windows File Recovery, you are buried in ad pages for other things.

    Jim Salter

  • Browsing the Microsoft Store is no better. Where's Windows File Recovery?

    Jim Salter

  • We can filter the Microsoft Store search results by "apps only" – however, when searching for Windows File Recovery, there is still no evidence of Windows File Recovery.

    Jim Salter

  • Windows File Recovery only appears when you search for Windows File Recovery if you limit the results to apps, utilities, and tools only.

    Jim Salter

  • It shouldn't have been that hard to find it – but after all, we're ready to install Windows File Recovery.

    Jim Salter

  • Build 19041.0 or higher is required to restore Windows files (another version of Windows build numbers – this installation is referred to as all three of 20H1, 2004 and 19041.264). We qualify.

    Jim Salter

It's good news that Microsoft is finally introducing this feature internally – but the tool could certainly be easier to find. When we were looking for Windows File Recovery by name in a freshly installed Windows 10 2004 VM in Bing, we were buried under ad pages for other things.

The experience was no better when we moved to the Microsoft Store: searching for the exact name, we could only find the Windows file recovery tool after filtering our results first by apps and then only by tools and utilities.

After we found the tool and checked that we met the system requirements, the installation was just a click away.

In today's episode of "Ars Deletes a File"

  • What monster would a beautiful JPG like this delete?

    Jim Salter

  • After deleting the image, we use winfr to try to restore it. Attempts to restore JPGs in my image folder are filtered.

    Jim Salter

  • Although winfr was the first thing we did after deleting the file, nothing was restored.

    Jim Salter

  • If our filter was somehow too restrictive, we tried again without it. Still no luck.

  • Maybe for some reason winfr doesn't like files that have been deleted from the CMD prompt. Let's try Shift-Delete instead …

    Jim Salter

  • The file deleted from the layer cannot be recovered either – winfr cannot help us with anything deleted from our C: drive.

    Jim Salter

Unlike most "unrecovered" third-party utilities that winfr replaces, it is only a command line utility. Users don't get a graphical interface to wade through their drive. It's also incredibly picky about where to restore files – you need a separate storage volume, e.g. B. a USB stick to restore all files. If you try to easily restore an existing file, you will get a severe reprimand from winfr, and there seems to be no way to override this behavior.

More importantly, we couldn't get winfr to restore a deleted file from our VM's C drive. The first time we tried, we created and deleted an empty text file, but winfr couldn't find it. Since we thought the tool might ignore empty files "helpful", we tried again and this time we added some actual data to our victim text file. There was no change in the results.

To make sure we didn't miss anything, we tried again – this time with a large NASA image stored in the image directory. First we deleted the file with del * .jpg at a CMD prompt and then we tried to restore it on a USB drive with winfr C: F: -n Users Jim Pictures. Still no luck. We thought the filter might be a problem, so we removed it and this time asked for any recently deleted files from the C drive, using a simpler Winfr C F: – still without luck.

Now we wondered if there was something magical about the DEL command that made Windows think it should destroy these files instead of simply separating them. After downloading our test image again, this time we tried to delete it from the GUI using the Shift key in Explorer – still without changing the results.

SSDs, TRIM and your deleted files

  • This time we gave the VM a backup storage based on rust disks instead of SSDs and saved the JPG on it and then deleted it.

    Jim Salter

  • Success! If the data was saved to a hard drive without TRIM support, winfr could easily restore it.

    Jim Salter

After some frustrated digging, we realized that our VM's C drive was stored in a ZFS pool that itself lived on a number of SSDs – and that the TRIM functionality of these hard drives might destroy our data faster than we restore it could . To test this hypothesis, we created a new backup file for a second rust-based pool, forwarded it to our VM as a separate X drive, and tried again.

After deleting our third victim JPG from the new X drive with DEL on the command line, we tried again with winfr – and this time it worked perfectly. Our freshly deleted JPG showed itself in all its splendor on the "USB" drive mounted as F, just as we had asked for.

There are some important lessons to learn here. The more obvious is that most people are unlikely to benefit from winfr (or any other non-recovered application) at all – the vast majority of modern systems store C on an SSD with available TRIM functionality.

The less obvious aspect is that winfr may also have problems with some Shingled Magnetic Recording drives. Both SSDs and SMR hard drives use zone access with intelligent firmware and virtual drive mapping instead of literal direct addressing. This in turn requires the use of the TRIM command, which notifies the drive firmware if a block has been deleted. This allows the drive to treat this block as unused space and not as valuable data to keep.

We repeated our test on another virtual drive, this time supported by an SMR hard drive – the Western Digital Red 4 TB EFAX. On the positive side, winfr has successfully retrieved the file from SMR Red. On the negative side, however, this took almost 20 seconds, while the non-SMR hard drives had managed them in just two seconds. This may be another application that is not well suited for SMR hard drives that are increasingly found in desktop channels for price-conscious consumers.

LEAVE A REPLY

Please enter your comment!
Please enter your name here