Recover deleted files on Windows with Shadow Explorer

If you have accidentally deleted files on Windows Vista, Windows 7, or Windows 8/8.1 and the files are not in recycle bin, you still have a chance to recover those files with Shadow Explorer if you have enabled system restore on that drive (system restore is enabled by default on system drive). If system restore is disabled, you can’t recover files with this method.

Note: You can try Previous versions to recover the files first. If no success, then you may try Shadow Explorer. However, Shadow Explorer may recover some files that Previous versions cannot.

Shadow Explorer is a free tool which allows you to browse the Shadow Copies, which created by Volume Shadow Copy Service, to retrieve older versions of files that you accidentally deleted or been altered. Shadow Explorer requires .NET Framework 3.5 Client Profile to run.

In this article, I show how to recover my encrypted photo on D drive which was done by a virus using Shadow Explorer.
Note: I won’t be responsible if you can’t recover your files using the tool.

Watch on YouTube


Check if system restore is enabled on the drive

  1. Open System window.
    • On Windows 8 and 10, right-click on Windows icon at bottom left on desktop screen. And select System.
    • On Windows 7, left-click on Windows icon at bottom left on desktop screen. And right-click on Computer and select Properties.
  2. Click System Protection on the left menu.
    Open System Protection
  3. On System Protection tab, if the protection status of the drive that you want to recover files is On, you can try Shadow Explorer to recover those files.
    System restore status

Recover files with Shadow Explorer

  1. Here are my encrypted photos which are corrupted. Sample corrupted photos
  2. Download Shadow Explorer. In this example, I choose Portable version which you can run the program without installation.
    Download Shadow Explorer
  3. Run the program. If you don’t have .NET Framework 3.5 on your system, it will ask you to download and install it first. Click Download and install this feature to continue.
    Download and install .NET Framework 3.5
  4. After that, run the program again. On the tool, you can select drive and snapshot of date/time that you want to recover files from these drop-down options at top-left.
    Note: Number of snapshots usually depends on system restore points you have. If you have enabled system restore, but you don’t have any value in these drop-down to select, it is possible that you have just enabled it recently and your system hasn’t create any shadow copy yet. Or someone may deleted these shadow copies data.
    Select date/time snapshot to restore on Shadow Explorer
  5. After select snapshot of date/time, browse to files. To recover files, right-click on any files or folder that you want and select Export.
    Browse to files on Shadow Explorer
  6. Select where do you want to save files.
    Note: I recommended to clean any virus on your system (if you have any) before attempt to recover files to prevent any chance that the recovered files may get infected from the virus again.
  7. Check if those files are in good condition. If the files still damaged or corrupted, you may try to recover from an earlier snapshot.
    Recovered photos from Shadow Explorer


  1. Patrick Dowling August 2, 2016
  2. linglom August 6, 2016
  3. mike December 6, 2016
  4. Thomas December 23, 2016
  5. linglom December 23, 2016
  6. rick May 14, 2018
  7. MANJUBHASKARA August 9, 2019

Leave a Reply