← All posts

Recover Files After a Windows Crash Without Making It Worse

August 19, 2026 · DiskRescue Blog

A crash that takes your files with it leaves one of three situations behind. Windows boots but your Documents folder and desktop are empty. Windows refuses to boot at all. Or the drive doesn't show up any more. Each one calls for a different first move, and the advice repeated most often, run a disk check and let Windows repair it, is the one that does lasting damage. Whether the machine boots or not, a disk check run against a file system that is already broken cuts the surviving data loose into numbered fragments and marks the rest of the space free for reuse.

Quick answer: Stop writing to the affected drive, and don't run chkdsk /f or accept Windows' offer to scan and fix it. Check for a temporary profile and File History first, since both are free and take minutes. If the files are genuinely gone, run a read-only scan with the DiskRescue trial from a different drive and write the results to separate storage.

Stop writing to the drive first

Deleted and orphaned file data isn't erased at the moment of loss. The clusters holding it are marked available, and Windows reuses them the next time it needs space: update caches, search indexing, log files, the page file, restore points. None of that asks permission. Every minute a crashed system stays booted may be filling the space your files still occupy.

A few hard rules:

• If the lost files were on the system drive (usually C:), shut down. Recovering C: while running from C: means the operating system is writing over your evidence the entire time. Pull the drive and attach it to a second PC through a USB adapter or dock, or boot the machine from external media. DiskRescue enforces the same rule from its side: the running system disk appears in the disk list greyed out and locked, and can't be selected as a source.
• If they were on a second internal drive or an external one, disconnect it and leave it alone until you're ready to scan.
• Don't reinstall Windows on the drive, don't let Setup repair it, and don't click through the "There's a problem with this drive, scan and fix it" prompt. That prompt runs the same repair as chkdsk /f, and both that switch and /r write changes to the file system. When the file table is already damaged, the repair resolves the damage by cutting orphaned data loose into numbered .chk fragments inside a FOUND.000 folder and marking everything else free. Plain chkdsk C: with no switches is read-only and safe to look at.

Work out which situation you're actually in

The symptom tells you whether this is a profile problem, a file system problem, or a hardware problem, and only the first two are yours to solve.

The third row is the one people over-treat. If the drive still enumerates and the volume still mounts on a second machine, your files are sitting under C:\Users\<your name> exactly where you left them, and Explorer is the whole procedure. A broken Windows installation is not a broken file system, and recovery software has nothing to add to that case.

Check the free options before you install anything

Four checks, ten minutes, no software.

A temporary profile. Open C:\Users and see whether your normal folder is still there beside a TEMP folder. If it is, your files never moved. Restart the machine twice first, since a profile that failed to load once will sometimes load cleanly on the next boot.

If you still land in the temporary profile after that, make a second local account with administrator rights, log into it, and copy Desktop, Documents, Downloads and anything else you care about out of C:\Users\<your original name> into the new profile. Windows will ask for permission when you open the old folder; accept it and continue. The files are physically present the whole time, so no recovery tool is involved. The cause is usually a duplicated entry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, where your account's SID appears twice and the original carries a .bak suffix. Repairing that entry is a real fix, but do it after your files are already copied somewhere safe, never before. If the desktop won't stay up long enough to copy anything, log in through safe mode and copy from there.

File History. Control Panel → File History → Restore personal files. This only works if it was switched on before the crash and had somewhere to write. Greyed out and empty means it was never running, not that it broke.

Previous Versions. Right-click the folder that held the files, then Properties → Previous Versions. That list is built from restore points and File History, so an empty list is a real answer rather than a bug.

Office temp files. If the loss is one document that was open when everything died, check %AppData%\Microsoft\Word for .asd AutoRecover files and %Temp% for .tmp files carrying that afternoon's timestamp. This helps for the file in progress and nothing else.

If none of those turn anything up, which is the ordinary outcome since most people discover their backup situation on the day they need it, the data has to be read off the disk directly.

What a read-only scan can and can't get back

Recovery works two ways, and they are two separate features you choose between on the opening screen rather than one scan that works it out for you. Picking the wrong one costs you information you could have had.

The first is NTFS undelete, offered as "Restore deleted files". Windows keeps a master file table describing every file, and a deleted record still points at the original clusters until something reuses them. Reading through that table hands back real filenames, the original folder structure and timestamps, and the result list labels each entry with how recoverable it is: OK, fragmented, compressed, encrypted, sparse, or empty. That's the good outcome, and it needs a drive Windows still mounts as NTFS.

The second is carving, offered as recovery from a disk or USB stick. When the file table itself is gone, whether through a RAW volume, a reformat, or severe corruption, the scanner reads raw sectors looking for the byte signatures that begin a JPEG, a DOCX or a PDF, and rebuilds files from those. Carved files arrive sorted into folders by type, with generic names derived from their position on the disk, no original folders and no dates. A large fragmented file can come back partial. Useful, but not the same thing as getting your folder tree back.

One limit applies to both methods. On a healthy SSD with TRIM enabled, the controller clears deleted blocks on its own schedule within minutes, which is why the same accident often recovers cleanly from a hard drive and comes back empty from an SSD. On flash storage the hours right after the loss matter more than anything else you do.

Running DiskRescue without adding damage

1. Install it on a drive other than the one you're recovering from. Installing onto the affected drive can overwrite the files you're trying to reach.
2. Choose the mode before anything else. If the drive still mounts normally and is formatted NTFS, start with "Restore deleted files", because that path is the only one that returns original filenames and folders. If the drive shows as RAW, asks to be formatted, or won't open at all, use the disk and USB recovery path, which reads sectors directly and needs no mountable file system.
3. Select the source. The sector-reading path lists physical disks, and a disk Windows can't mount is still selectable there. The undelete path lists mounted NTFS volumes instead, and marks anything formatted otherwise as unsupported.
4. Start the scan. The source is opened for reading only and nothing is written back to it, so a scan that finds nothing leaves you no worse off than you were before starting it.
5. If the drive is slow, throwing read errors, or reporting bad SMART values, take the two-step route instead: back the whole disk up to a single image file on healthy storage, then scan that image. The imaging engine takes everything that reads easily on its first sweep and returns afterwards only for the regions that failed, so the failing drive spends far less time under load than it would under repeated full scans, and every scan after that runs against the image rather than the original. Budget free space equal to the size of the source disk.
6. Point the output at a different drive from the one being read. DiskRescue checks this and refuses an output folder sitting on the source disk, since writing recovered files back onto the disk you're reading is what quietly destroys the files still waiting their turn.
7. Watch the counters while it runs. The progress screen shows what it has found and what it has saved, split into photos, videos, documents and other. The trial saves files in the order it discovers them and stops writing after 20, but the scan carries on and keeps counting, so the found total still tells you roughly how much is down there.
8. Open the saved files. Anything that opens and looks right is intact. Anything that won't open, or that renders as grey bands and noise, came from clusters that had already been partly overwritten. Treat those 20 as a sample of what a full run would return, not as a shortlist you get to curate.

Plan for one wrinkle before you buy. The trial limit stays with the job that is already running, so registering mid-scan does not unlock the rest of that scan; you have to run the scan again to save everything. On a drive that is already struggling, a second full pass over the original is a genuine risk rather than an inconvenience. That is the strongest argument for making the image in step 5 first and scanning the image both times.

What the results are telling you

Which feature you used decides the shape of the results, so read them accordingly. From the undelete path, named files in their original folders mean the file table survived, while entries flagged compressed or encrypted are ones NTFS stored in a form that can't be rebuilt from the record alone. From the sector-reading path, generic names sorted by type are the expected outcome rather than a sign that something went wrong, and you will be identifying files by opening them.

Zero-byte results and files that open as noise mean those clusters have already been written over. No tool of any kind recovers overwritten data, because the previous contents are no longer on the disk to read.

Nobody can promise you a recovery rate. The outcome was mostly decided by how much the drive was used between the crash and the scan, which is why the first section here is about stopping writes rather than about choosing software.

When software is the wrong tool

Clicking, beeping, grinding, a drive that spins up and immediately stops, one missing from BIOS, or any drive that took a fall or a spill: none of that is a software problem, and DiskRescue can't help with it. Those symptoms point to failed heads or a dead controller board, and every scan attempt spends read passes the drive may not have left. Power it down and get a quote from a recovery lab with a cleanroom and donor parts. That runs from several hundred to a few thousand dollars, which is exactly why it's worth confirming the drive is mechanically dead before paying for it. A drive that still enumerates and still reads, however slowly, is not that case.

How DiskRescue Compares

On a lifetime license, DiskRescue costs about 1/5 what the big-name recovery suites below charge — paid once and used for life, with no auto-renewal.

Prices, features, and free-tier limits checked on each official site (Windows editions) on July 14, 2026 — they may change with sales or updates. The price comparison uses DiskRescue's launch price ($29.99). EaseUS free recovery is 500 MB by default, expanding to 2 GB after a social-media share (kb.easeus.com); Disk Drill's official free limit is 100 MB (cleverfiles.com).

Further reading

• Handling Clicking Noises from Your External Hard Drive
• Retrieve Deleted Files from a USB Flash Drive Easily
• What to Do When Your USB Drive Shows No Files