A professional, privacy-first Windows data recovery utility designed for recovering accidentally deleted files (including Shift+Delete and emptied Recycle Bin) from NTFS volumes.
Core Promise: Recover your own deleted files when the storage has not been overwritten.
- Core Principles & Safety Rules
- Architecture
- Getting Started
- Usage Guide
- Testing
- Development Status
- License
- Read-Only Scanning: The scanning engine never writes to the source device under any circumstances.
- Safe Recovery: Recovered files are never written back to the source drive by default. Attempting to do so triggers a strong warning.
- No Execution: No automatic execution of recovered files to prevent malware execution.
- Privacy First: 100% offline. No telemetry of recovered content and no cloud upload.
The suite is built with a reliable Rust core and a modern web frontend via Tauri, ensuring both high performance and a smooth user experience.
┌──────────────────────────────────────────┐
│ Tauri + React UI │
│ TypeScript + modern frontend │
└──────────────────────┬───────────────────┘
│
▼
┌──────────────────────────────────────────┐
│ Application / IPC Layer │
│ Commands, events, progress, errors │
└──────────────────────┬───────────────────┘
│
▼
┌──────────────────────────────────────────┐
│ Rust Recovery Core │
│ Scanner · NTFS · MFT · Carving · │
│ Confidence · Validation · Reconstruction│
└──────────────────────┬───────────────────┘
│
▼
┌──────────────────────────────────────────┐
│ Windows Storage Layer │
│ Safe / raw / read-only disk access │
└──────────────────────────────────────────┘
To build and run the project, ensure you have the following installed:
- Windows 10 or 11 (64-bit)
- Rust Toolchain (latest stable)
- Node.js (v16+)
- Cargo & npm
The workspace includes both the CLI engine and the Desktop UI.
1. Core Engine (Rust):
# Build the Rust workspace
cargo build --release2. Desktop UI (Tauri + React):
cd apps/desktop
npm install
npm run tauri buildYou can run the recovery engine directly from the CLI. Raw disk access requires administrator privileges.
To run the tool and recover your files, follow these steps:
- Open Windows PowerShell as Administrator.
- Navigate to the project directory:
cd /d D:\TESting\testing\windows-data-recovery - Run the recovery command (replace
\\.\D:andC:\RecoveredDatawith your source and destination):# Recover specific files using a filter target\release\recover-cli.exe recover \\.\D: --output C:\RecoveredData --filter "flerken" # Or recover EVERYTHING on the drive (use with caution) target\release\recover-cli.exe recover \\.\D: --output C:\RecoveredData
To run the graphical interface in development mode with hot-reloading:
cd apps/desktop
npm run tauri devScreens include: Home (drive selection) → Scan Mode → Progress → Results → Recover → Report.
The test suite includes controlled recovery fixtures under tests/fixtures/. Run the full test suite with:
cargo test --workspaceOn the synthetic NTFS test image (tests/fixtures/synthetic_ntfs.img), exact SHA-256 recovery is currently verified for:
notes.txt(resident deleted file)payload.bin(non-resident data runs)
To successfully test the tool on your physical machine without interference from Windows or SSD hardware features, follow these steps:
- Use a USB Flash Drive or a non-system Hard Disk Drive (HDD). (Do not use your
C:drive, and avoid modern SSDs with TRIM enabled). - Create a test folder (e.g.,
flerkenstudio) on the drive. - Place a sample file (e.g., a PDF or JPG) inside the folder.
- Permanently delete the folder (using
Shift + Delete). - Run the CLI recovery command immediately:
Note: Ensure your
target\release\recover-cli.exe recover \\.\D: --output C:\RecoveredData --filter "flerkenstudio"
--outputfolder is on a different drive than your test drive!
Sample Test Result:
D:\TESting\testing\windows-data-recovery>target\release\recover-cli.exe recover \\.\D: --output C:\RecoveredData --filter "flerken_test"
Opening device/image: \\.\D:...
Scanning MFT records...
[|] Scanned 1600512 / 1600512 MFT records (100%) | Found 899753 deleted candidate file(s)...
Recovering 3 candidate file(s) to "C:\\RecoveredData"...
[|] Recovered 3 / 3 files (100%) | Success: 3, Failed: 0
--- Recovery Summary ---
Total requested : 3
Successful : 3
Failed : 0
Destination : C:\RecoveredData
Details:
[OK] flerkenstudio (0 bytes) -> SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
[OK] Honey Mesh Vishwakarma.pdf (85040 bytes) -> SHA-256: b35bc96922454fbba532703f48b3b5cbe1a6ae12b4f7304e853e60a89c43d93c
[OK] HTU8eCGWMAADqQ6.jpg (1102096 bytes) -> SHA-256: 18168fd5528405934656b653c63ea056f77fc14d292b34988094238ba9adf23c
When testing the recovery tool on a live, physical Windows drive, be aware of the following:
1. The "Active C: Drive" Overwrite Limitation:
If you delete a file on your primary system drive (C:), Windows background processes (telemetry, indexing, logging) will instantly reuse the freed clusters. This destroys the file's MFT record and overwrites the physical data. Always test on a secondary drive (e.g., D:) or a USB flash drive.
2. Modern SSD Hardware TRIM (DZAT): When a file is deleted on a modern Solid State Drive (NVMe or SATA), Windows immediately issues a TRIM hardware command to the SSD controller. The controller unmaps the physical flash blocks. If a data recovery tool reads the raw LCNs of those blocks, the SSD controller intercepts the request and guarantees a response of 100% zeroes (Deterministic Read Zero after TRIM). Note: Because of TRIM, deleted files on modern SSDs are permanently destroyed in milliseconds. The tool will successfully find the deleted MFT records and rebuild the file paths, but the extracted files will contain only zeroes. To test actual data extraction, use an HDD, a USB drive, or an SSD with TRIM explicitly disabled.
Current milestone focus: Phase 1 — NTFS Read-Only Scanner + Recovery vertical slice.
See docs/architecture/ for detailed phase planning.
Proprietary / TBD. Intended solely for legitimate recovery of data the user is authorized to access.