DeepRecoveryDesk

1. What it can recover

2. Requirements

• Windows 10 (2004+) or Windows 11, 64-bit.
• For raw drive scanning: a local administrator account (you’ll be prompted only when needed).

Only one copy runs at a time — launching it again brings the running window to the front rather than opening a second one. If the running copy is elevated (running as administrator), Windows won’t let a normal launch bring it forward, so you’re told it is already running instead.

3. Getting started

1. Launch DeepRecoveryDesk. A brief branded splash appears, then the main window opens with three panels: Sources (left), results (centre) and Preview (right). The ⓘ button in the title bar opens an About dialog.
2. Pick a source in the left panel. Each drive shows its label, file system and free space. The Recycle Bin is always at the top and needs no special permissions. Use the ↻ refresh button if you plug in a drive after launching.
3. Choose a scan mode (left-panel toggle):
   • Quick (default) — fast; recovers files whose metadata still exists.
   • Deep — Quick plus signature carving of the raw drive. Much slower, but finds files with no surviving metadata.
4. Click “Scan for deleted files.” For the Recycle Bin, scanning starts immediately. For a real drive, Windows asks to relaunch as administrator — click Yes, and the app restarts with your drive and scan mode already selected and begins the scan. If you decline, the Recycle Bin still works.
5. Watch results stream in. The status bar shows progress; click Stop scan any time. If one part of the scan hits an error (for example a damaged area of the drive), the other parts still run and you’re told which part stopped early. A Deep scan reads past unreadable sectors instead of stopping, and the status bar reports how much of the drive could not be read.

4. Failing drives & disk images

Every scan and every recovery reads the drive again. On a drive that is clicking, slowing down or throwing read errors, that extra wear can be what finishes it off. The safe approach is to read it once, into a disk image, and do everything else from the copy.

Create a disk image

1. Select the drive in the Sources panel.
2. Click the create disk image button at the top of the Sources panel and choose where to save the .img file.
3. Every sector is read once and copied to the file. Unreadable sectors are filled with zeroes and counted rather than stopping the copy.
4. When it finishes you’re offered to switch to the image, so scanning and recovering put no further wear on the drive.

Open a disk image

Use the open disk image button beside it to add any image file (.img, .dd, .raw, …) as a source — one made by DeepRecoveryDesk or by another tool. It scans exactly like a drive, and no administrator rights are needed. A whole-disk image with an MBR or GPT partition table lists each of its NTFS, FAT32 or exFAT partitions separately.

5. Reviewing results

The centre grid lists each recoverable file: name, original path, size, date, source, and a colour-coded confidence:

• 🟢 Green (≥ 85%) — very likely to recover intact.
• 🟡 Amber (60–84%) — good chance; may be partial.
• 🔴 Red (< 60%) — low chance / metadata only.

• Tick the box on the left of a row to mark it for recovery. The header box selects or clears everything currently shown, and the counter above the grid reports how many are ticked in total — including rows a search or filter is hiding.
• Search by name or path with the box above the grid (it filters live; on very large result sets it waits for a pause in your typing). Ctrl+F jumps to it; Esc clears it.
• Filter with the controls above the grid — Recoverable only hides entries whose data is gone (names recovered from metadata alone), and Min. confidence hides anything below 60% or 85%. A deep scan can return tens of thousands of rows; these narrow it to what is worth acting on.
• Sort by clicking any column header — including confidence, usually the most useful.
• Click a row to preview it on the right — text, an image thumbnail, or a hex dump, plus size, confidence, and any note explaining a caveat.
• A ⓘ marker on a row means there is something to know about it; hover it, or select the row to read the note in full.
• Export the list to CSV with the button beside Recover selected. Worth doing before you recover: a second scan of a live drive will not necessarily return the same results.

The DATE column

The DATE column shows when the file was deleted, where the drive records that (NTFS and the Recycle Bin). FAT32 and exFAT never record deletion times, so for those drives it shows the file’s last-modified time instead, in italics — hover it to see which kind of date it is.

Overwritten files

Each deleted file’s storage is checked against the drive’s record of what is in use. If another file has since taken some or all of it, the row says Partly overwritten or Overwritten and the confidence drops. Recovering it would return the newer file’s contents, not the one you deleted.

Saving and reopening a scan

Save the scan (Ctrl+S) to a .drscan file and open it again later (Ctrl+O), even after closing the app. Each result keeps where its data lives and its recovery status, so you can preview and recover from it without scanning again.

Keyboard shortcuts

6. Recovering files

1. Tick the checkbox on each file you want (use the header checkbox to select all visible).
2. Click Recover selected.
3. Choose a destination folder. If it does not have room for everything you picked, you are warned before any files are written. If the folder is on the source drive you’re told straight away and can pick another — and when only some of the selected items come from that drive, you’re offered to recover the rest.
4. Each file is copied and fingerprinted with a SHA-256 checksum. The status bar shows which file is being written and how far along the batch is.
5. You can click Stop recovery at any point. Files already written are kept and complete. The file being written when you stop is removed rather than left half-written, and the rest are left untouched. Closing the window during a scan or recovery asks first, then stops it cleanly the same way.

Keep folders

Tick Keep folders (above the results) to recover each file into its original folder layout under the destination, for example <destination>\C\Users\Sam\Docs\report.pdf. Carved files, which have no original folder, go into Carved.

The STATUS column and Partial files

Each row shows its own outcome in the STATUS column as the batch runs, with the reason on hover. Partial (amber) means the file was written but is incomplete: either part of it could not be located on the drive any more, or some sectors could not be read and were filled with zeroes. Partial files are kept, because part of a file is often still useful, but don’t trust them as complete copies. A file interrupted by Stop is marked Skipped.

When the batch finishes you get a summary, and if anything failed it lists why — grouped by reason, naming the files affected — so you can tell a full drive apart from a file whose data was already overwritten.

7. Tips for the best results

• Stop using the affected drive immediately. Every write reduces the chance of recovery. If you deleted something from your system drive, recover to a USB stick or second drive.
• Recover sooner rather than later — freed space gets reused over time.
• Image a failing drive first, then scan and recover from the image.
• Use Deep scan when Quick finds nothing, the drive was formatted, or you only need common file types (photos, documents, archives).

8. Understanding the limits

• FAT32: deletion erases the cluster chain, so recovery assumes the file was stored contiguously. Fragmented FAT32 files may come back partial (lower confidence). Windows also wipes half of a deleted file’s starting location on FAT32. On drives larger than a few gigabytes the app works out the real location from the free space and the file’s type. When more than one location fits, the file is shown at low confidence with a note; check the preview before trusting it.
• exFAT: contiguous files recover cleanly; fragmented files are reassembled from the allocation chain while it survives.
• Carved files (Deep scan) have no original name or folder — they’re named like carved_000123.jpg and may include trailing junk for formats without a clear end marker. Photos are carved to their real end, not to the end of the small preview image cameras embed inside them. PDFs edited after saving keep every saved revision. ZIP-based files (including DOCX, XLSX and PPTX), SQLite, 7z, BMP, WAV / AVI / WebP and MP4 / MOV / HEIC are carved to the exact length the file records. Old-style Word, Excel, PowerPoint and Outlook files are named .doc, .xls, .ppt or .msg from their contents. Deep scan searches the drive’s free space only, so files still present on the drive are not listed as deleted.
• Compressed or encrypted files (folder Properties → Advanced) are listed but cannot be recovered: their raw data on disk is compressed or encrypted, and decoding it needs the file system itself or the owner’s key.
• Very large or heavily fragmented files sometimes store their layout across several internal records. The app follows those records and recovers the whole file. Only when one of them has since been reused by another file is the result partial: the beginning of the file comes back and the rest does not.
• Drives with 4 KB sectors (“4K native”) are supported for NTFS scans.
• Change-journal entries: when a file was deleted recently but its record has been reused, the app can still show the name and time, but the data is usually gone (shown at low confidence with no preview). The newest part of the journal is read, so the most recent deletions are the ones listed.
• Deletion dates come from the drive’s own records. When those have been partly overwritten the date is shown as — rather than a guess.

9. Privacy & safety

• All drive access is read-only; the app never modifies a scanned drive.
• No network calls and no telemetry (shown in the status bar).