The ReFSUtil executable has four main modes of operation:
- fixboot – Repair boot sectors.
- leak – Leak Detection and Fixing.
- triage – Handle corruptions.
- salvage – Salvage operations for corrupt volume.
The command I’ve found most useful is “salvage“, which I’ll go into at the end of this article.
WARNING: If data deduplication is turned on for these volumes, anything recovered may be missing parts of the files. As far as I can tell, ReFSutil does not reconstruct the full data from a deduplicated file.
The “fixboot” command offers this help:
WARNING: THIS OPERATION CHANGES BOOT SECTOR(S) OF A VOLUME AND CAN RESULT IN TOTAL LOSS OF DATA.
Usage: refsutil fixboot [-f] [-w
] [-smr] [-x]
<drive> Drive letter in format “L:”.
<MajorVersion> Major version of the ReFS volume.
<MinorVersion> Minor version of the ReFS volume.
<ClusterSize> Cluster size of the volume. Either 4096 or 65536.
-f Ignore any valid boot sector found. Fix boot sector based on input parameters.
-w <Dir> Actually write to the boot sector(s) if needed and backup the current boot sector(s)
into the backup directory.
-smr Specifies this if volume is of SMR format. Cluster size must be 65536.
-x Force the volume to dismount first if necessary. All opened handles to
the volume would then be invalid.Example: refsutil fixboot D: 3 3 4096
Example: refsutil fixboot D: 3 1 65536 -f -w c:\backup
Personally, I have not used the fixboot option as I think I’ve never had to repair the boot sector on an ReFS volume. AFAIK, ReFS volumes are not bootable at the time of this article? Sorry I don’t have any more information on this command.
The “leak” command offers this help:
—- Leak Detection and Fixing —-
Usage: refsutil leak [/a] [/x] [/v] [/d] [/q] [/t ] [/s ]
/a If leak detection finds a corruption, setting this switch attempt to fix it and re-run leak
detection. With this switch set leak detection will be restarted once for every corrupted
directory found on the volume.
/x Operate holding an exclusive lock on the volume. Without this switch leak detection will
create a snapshot of the volume for processing.
/v Verbose output.
/d Diagnose only. Leaks will be printed to stdout, but not fixed.
/q Query required space for operation.
/t Number of threads to spawn for leak detection. Specifying a value of 0 will run leak detection
synchronously (this is not recommended). Default is 4.
/s Run operation using as a scratch buffer. must be able to grow to the value
reported by /q. Ommision of this switch will create a scratch buffer in TEMP.
Drive letter in format “L:”, or a path to the volume mount point.
Note that providing /d alongside /a will triage all found directory/file corruptions, but will not fix leaks.
Eg: refsutil leak D: /a /t 4 /s R:\scratch.tmp
Eg: refsutil leak D: /a /d /v /t 4
Eg: refsutil leak D: /q
The “triage” command offers this help:
—- Triage and corruption handling —-
Usage: refsutil triage [/s ] [/v]
/s Scrub the directory corresponding to . Is the file id for the directory. This will scrub all files under the given directory.
/v Verbose output.
Drive letter in format “L:”, or a path to the volume mount point.
Example: refsutil triage D: /s 15100
Example: refsutil triage D: /s 16040 /v
Again, I haven’t had any ReFS corruption to test this out, or even know how to find the of a directory.
The “salvage” command offers this help:
Attempts to diagnose heavily damaged ReFS volumes, identify remaining files,
and copy those files to another volume. (Be sure where you copy the rescued files to has the same (or more) storage space than the corrupted volume.)
ReFS Salvage has a Scan Phase and a Copy Phase.
In automatic mode, the Scan Phase and Copy Phase will run sequentially.
In manual mode, each phase can be run separately.
Progress and logs are saved in a working directory to allow phases to be run separately as well as Scan Phase to be paused and resumed.
Here are the automatic mode Command Line Usages:
Quick Automatic Mode Command Line Usage:
refsutil salvage -QA <source volume> <working directory> <target directory> <options>
This will perform a Quick Scan Phase followed by a Copy Phase.
This mode runs quicker as it assumes some critical structures of the volume
are not corrupted and so there is no need to scan the entire volume to
locate them. This also reduces the recovery of stale files/directories/volumes. (I’m not sure what a “stale file” is.. Can anyone share more information?)
Full Automatic Mode Command Line Usage:
refsutil salvage -FA <source volume> <working directory> <target directory> <options>
This will perform a Full Scan Phase followed by a Copy Phase.
This mode may take a long time as it will scan the entire volume for any
recoverable files/directories/volumes.
Here are the manual mode Command Line Usages:
Diagnose Phase Command Line Usage:
refsutil salvage -D <source volume> <working directory> <options>
Attempt to determine if <source volume> is an ReFS volume and determine
if the volume is mountable. When a volume is not-mountable, reason(s) will
be determined. This is a standalone phase.
Quick Scan Phase Command Line Usage:
refsutil salvage -QS <source volume> <working directory> <options>
Quick Scan <source volume> for any recoverable files.
This mode runs quicker as it assumes some critical structures of the volume
are not corrupted and so there is no need to scan the entire volume to
locate them. This also reduces the recovery of stale files/directories/volumes.
Discovered files will be logged to “foundfiles.<volume signature>.txt” under
<working directory>. If the Scan Phase was previously stopped, running with
the -QS flag again will resume the scan from where it left off.
Full Scan Phase Command Line Usage:
refsutil salvage -FS <source volume> <working directory> <options>
Scan entire <source volume> for any recoverable files.
This mode may take a long time as it will scan the entire volume for any
recoverable files.
Discovered files will be logged to “foundfiles.<volume signature>.txt” under
<working directory>. If the Scan Phase was previously stopped, running with
the -FS flag again will resume the scan from where it left off.
Copy Phase Command Line Usage:
refsutil salvage -C <source volume> <working directory> <target directory> <options>
Copy all files described in “foundfiles.<volume signature>.txt” to
<target directory>. If Scan Phase is stopped too early,
“foundfiles.<volume signature>.txt” may not have been written yet and so no file
will be copied to <target directory>.
Copy Phase with List Command Line Usage:
refsutil salvage -SL <source volume> <working directory> <target directory> <file list> <options>
Copy all the files in <file list> from <source volume> to <target directory>.
The files in <file list> must have first been identified by the Scan Phase
though the scan need not have been run to completion.
<file list> can be generated by copying “foundfiles.<volume signature>.txt”
to a new file, removing lines referencing files that shouldn’t be restored,
and preserving files that should be restored. The PowerShell cmdlet
Select-String may be helpful in filtering “foundfiles.<volume signature>.txt”
to only include desired paths, extensions, or file names.
Copy Phase with Interactive Console:
refsutil salvage -IC <source volume> <working directory> <options>
Salvage files in an interactive console for advanced users.
This mode also requires files generated from either of the Scan Phases.
Parameter definitions:
<source volume> ReFS volume to process. Drive letter in format “L:”,
or a path to the volume mount point.
<working directory> Location to store temporary information and logs.
It must not be located on <source volume>.
<target directory> Location where identified files will be copied to.
It must not be located on <source volume>.
<options>
-m Recover all possible files including deleted ones.
This option will be ignored on refsutil salvage v1.
WARNING: Not only this will take longer time to run,
it can lead to unexpected result.
-v Verbose mode
-x Force the volume to dismount first if necessary. All
opened handles to the volume would then be invalid.
Eg: refsutil salvage -QA R: N:\WORKING N:\DATA -x
