This GitHub repository is a tool to recover deleted files on exFAT-formatted drives.
- Windows 10 or later (no other OS supported)
- Administrator privileges
- An externally connected storage device formatted with the exFAT file system
Once started the tool will show all the drives connected to the system using the following table:
| Drive number | Drive letter | File system type | Size (GB) |
|---|
The user will be asked to choose a drive using the Drive number column. The tool will stop if the selected drive does not exist or if the selected drive exists but it's not exFAT-formatted.
The tool will only show the first nine drives it detects.
After having chosen the drive the user can apply a filter by specifying the extension of the files they want to recover.
The user can also choose where to save the recovered files by specifying the FULL PATH of the folder of their choice. If the path is invalid or cannot be found the tool will stop immediately and return an error. If the user doesn't specify any path and leaves it blank, the recovered files are saved where the tool is located by default.
The tool will now print some technical data and then will start scanning for deleted entries. Depending on the size of the drive and the amount of stored data this process may take from a few seconds to a few minutes.
Once the tool has finished scanning the drive the user will be shown all the deleted entries found using the following table:
| File no. | File name | File size (KB) | Recoverable |
|---|
This tool is able to find directories but it does NOT scan their content unless the user chooses to recover them.
At this point the user will be asked to choose one file to recover using the number shown in the File no. column.
If the chosen deleted file is a regular file the tool will automatically determine the correct method to read and reassemble the file's data.
If the chosen deleted file is a directory the tool will recursively recover all the files and subdirectories until it reaches the end of the main folder's tree.
This tool allows the user to filter the files by extension. It's important to specify the extension without the dot as this would result in no match. The filter is case-sensitive so an extension typed in lowercase won't match with the same extension typed in uppercase.
The following is an example to filter TXT files.
As directories do not have any extension they are automatically excluded.
Due to the exFAT file system's nature, file recovery is not always guaranteed as Windows may immediately clear the cluster reference and other entry data as part of the deletion process, making recovery impossible regardless of the technology or technique used. This behaviour is more likely to happen when the deleted entry points to a large file or a large directory containing many files.
While the first three columns on the left are self-explanatory, the right column might cause some confusion.
The Recoverable column shows if a file or directory is recoverable by checking the location of the file in the drive. As the first two clusters in any exFAT-formatted drive are always reserved, when Windows clears the cluster reference of a deleted entry that file becomes impossible to recover, this will result in the Recoverable value to be False. If the cluster reference of the deleted entry is higher or equal to two, the Recoverable value will be set to True.
During the recovery process the tool can either follow the FAT chain or just check the allocation bitmap, based on the entry's metadata.