ReFS Data Recovery

New Features in ReFS

Usage in conjunction with Storage Spaces

ReFS was designed as a filesystem to be used in conjunction with Storage Spaces - a new capability introduced in Windows 8. These two components, ReFS and Storage Spaces, working together can withstand data loss caused by various factors like bit rot or lost writes.

The most powerful protection is achieved on a fault tolerant volume such as mirror or parity volumes. When a read error occurs on such a volume, Storage Spaces driver is able to read data from two copies, while ReFS driver can select a correct copy and fix the damaged one. In case of a write error, Storage Spaces driver redirects record to a new location automatically. ReFS is obviously not capable of auto-correcting the data when used on a non-mirrored disk.

Copy on write

ReFS is equipped with a new "copy on write" feature to battle torn writes, write operations which have not been completed for whatever reason, for example due to a power failure. When ReFS driver needs to update filesystem metadata, it does not just overwrite the previous data, like NTFS does, but creates a new copy of the metadata in another location. Once ReFS driver sees that write was performed successfully, it updates all the necessary pointers so that they point to the newly created copy of the metadata. Note that you can configure ReFS so that it applies the "copy on write" feature to user data as well. This option which is called integrity streams is enabled automatically on a mirrored space.


ReFS, first among the Windows filesystems, checksums all filesystem metadata on a mandatory basis. Additionally, ReFS can checksum user data but it is not a default option. Checksum feature allows ReFS to know that something is wrong with filesystem structure and to take the necessary measures to fix the errors.


Sometimes content of disks and arrays can be damaged little by little; the phenomenon called "bit rot". Although people often suppose that bit rot happens due to cosmic rays, the simplest example of bit rot is a "write hole" leading to unnoticeable damage of RAID array content. "Write hole" is especially harmful because the damage of the disk content can lurk for a long time until you need to read data located on the corrupted area of the disk. ReFS has a new feature called "scrubbing" to fight bit rot. However, it is available only for a mirrored storage space. The essence of this feature is that when idling, the ReFS driver inspects all areas of the disk and checks correctness of the data based on the checksums. If the checksums do not match the data, the driver detects what the checksum is correct and fixes the wrong data using the correct copy.

Repair of damaged data

If ReFS encounters a read error on a mirrored storage space, it can read the data from the "healthy" copy and correct the damaged one. If a write error occurs, the ReFS driver allocates another space to write the data automatically.

ReFS is designed to be never offline

ReFS was designed to provide access to the data no matter what. If the filesystem faces a problem, the ReFS driver isolates a failed part of the filesystem while still being able to provide access to the remaining data. However, parts located downstream of this failed part have to be isolated as well. Generally, a filesystem based on B-trees, for example ReFS and HFS+, is vulnerable to damage close to the root of the tree when it is needed to isolate large amount of data. In the worst case an "isolation" of entire volume may occur.