DeepRecoveryDesk

1. What it can recover

2. Requirements

• Windows 10 (2004+) or Windows 11, 64-bit.
• For raw drive scanning: a local administrator account (you'll be prompted only when needed).

3. Getting started

1. Launch DeepRecoveryDesk. A brief branded splash appears, then the main window opens with three panels: Sources (left), results (centre) and Preview (right). The ⓘ button in the title bar opens an About dialog.
2. Pick a source in the left panel. Each drive shows its label, file system and free space. The Recycle Bin is always at the top and needs no special permissions. Use the ↻ refresh button if you plug in a drive after launching.
3. Choose a scan mode (left-panel toggle):
   • Quick (default) — fast; recovers files whose metadata still exists.
   • Deep — Quick plus signature carving of the raw drive. Much slower, but finds files with no surviving metadata.
4. Click “Scan for deleted files.” For the Recycle Bin, scanning starts immediately. For a real drive, Windows asks to relaunch as administrator — click Yes, and the app restarts with your drive and scan mode already selected and begins the scan. If you decline, the Recycle Bin still works.
5. Watch results stream in. The status bar shows progress; click Stop scan any time.

4. Reviewing results

The centre grid lists each recoverable file: name, original path, size, deletion date, source, and a colour-coded confidence:

• 🟢 Green (≥ 85%) — very likely to recover intact.
• 🟡 Amber (60–84%) — good chance; may be partial.
• 🔴 Red (< 60%) — low chance / metadata only.

• Tick the box on the left of a row to mark it for recovery. The header box selects or clears everything currently shown, and the counter above the grid reports how many are ticked in total — including rows a search or filter is hiding.
• Search by name or path with the box above the grid (it filters live). Ctrl+F jumps to it; Esc clears it.
• Filter with the controls above the grid — Recoverable only hides entries whose data is gone (names recovered from metadata alone), and Min. confidence hides anything below 60% or 85%. A deep scan can return tens of thousands of rows; these narrow it to what is worth acting on.
• Sort by clicking any column header — including confidence, usually the most useful.
• Click a row to preview it on the right — text, an image thumbnail, or a hex dump, plus size, confidence, and any note explaining a caveat.
• A note marker on a row means there is something to know about it; hover it, or select the row to read the note in full.
• Export the list to CSV with the button beside Recover selected. Worth doing before you recover: a second scan of a live drive will not necessarily return the same results.

Keyboard shortcuts

5. Recovering files

1. Tick the checkbox on each file you want (use the header checkbox to select all visible).
2. Click Recover selected.
3. Choose a destination folder. If it does not have room for everything you picked, you are warned before any files are written.
4. Each file is copied and verified with a SHA-256 checksum. The status bar shows which file is being written and how far along the batch is.
5. You can click Stop recovery at any point. Files already written are kept and complete; the rest are left untouched.

Each row shows its own outcome in the STATUS column as the batch runs, with the reason on hover. When the batch finishes you get a summary, and if anything failed it lists why — grouped by reason, naming the files affected — so you can tell a full drive apart from a file whose data was already overwritten.

6. Tips for the best results

• Stop using the affected drive immediately. Every write reduces the chance of recovery. If you deleted something from your system drive, recover to a USB stick or second drive.
• Recover sooner rather than later — freed space gets reused over time.
• Use Deep scan when Quick finds nothing, the drive was formatted, or you only need common file types (photos, documents, archives).

7. Understanding the limits

• FAT32: deletion erases the cluster chain, so recovery assumes the file was stored contiguously. Fragmented FAT32 files may come back partial (lower confidence).
• exFAT: contiguous files recover cleanly; fragmented files are reassembled from the allocation chain while it survives.
• Carved files (Deep scan) have no original name or folder — they’re named like carved_000123.jpg and may include trailing junk for formats without a clear end marker. Deep scan searches the drive’s free space only, so files still present on the drive are not listed as deleted.
• Compressed or encrypted files (folder Properties → Advanced) are listed but cannot be recovered: their raw data on disk is compressed or encrypted, and decoding it needs the file system itself or the owner’s key.
• Very large or heavily fragmented files sometimes store their layout across several internal records. These are listed as partially recoverable — the beginning of the file comes back, the rest does not.
• Change-journal entries: when a file was deleted recently but its record has been reused, the app can still show the name and time, but the data is usually gone (shown at low confidence with no preview).
• Deletion dates come from the drive’s own records. When those have been partly overwritten the date is shown as — rather than a guess.

8. Privacy & safety

• All drive access is read-only; the app never modifies a scanned drive.
• No network calls and no telemetry (shown in the status bar).