Deleted-file discovery and recovery for Windows
Find and recover deleted files with JoHex by analyzing residual filesystem data. Review the findings and verify the recovered contents.
- Select the data source
- Review deleted-file findings
- Recover and verify contents
Workflow
- Select the data source
- Review deleted-file findings
- Recover and verify contents
Select the relevant filesystem data source and start deleted-file analysis. Review the files found from residual information, recover the needed contents and check that the results are complete and usable.
Deleted-file recovery
Find and recover deleted files by analyzing residual filesystem data. Recovery depends on what remains and is not guaranteed.
Disk analysis
Read, write and analyze disk data. Review changes carefully because direct writes can affect the filesystem.
Before changing data
Recovery depends on filesystem data that remains. JoHex does not guarantee a success rate or recovery of every deleted file. A detected candidate does not by itself establish that its contents can be recovered completely.
Common questions
Can JoHex guarantee deleted-file recovery?
No. The analysis relies on residual filesystem data. If the information needed to reconstruct a file is missing, recovery may be incomplete or unsuccessful.
How does recovery differ from disk analysis?
Disk analysis focuses on examining and modifying underlying disk data. Deleted-file recovery uses remaining filesystem information to find and reconstruct deleted files.
Use JoHex for your next binary analysis task.
Review the available edition and download options before installing.