What Unlost does to your drive, and what it doesn't

Scanning opens the drive read-only

To scan and to recover, Unlost opens the source volume for reading and never asks Windows for write access to it. That is not a policy or a promise about intentions — a handle opened without write access cannot write, and the operating system enforces it. Scanning cannot make your situation worse, and a scan you abandon halfway leaves the drive exactly as it was.

The app names the drive it has open in its title bar for the whole session, so you can see at a glance that it is the one you meant and not another one.

There is exactly one thing in Unlost that writes to the drive being scanned, and it is described in full below. It is never part of a scan or a recovery, it cannot happen without you asking for it by name, and everything above is true of every other use of the program.

The one feature that writes: Erase

Recovery has an opposite. Sometimes what somebody wants is not to get a file back but to be certain nobody else can — a card being sold, a laptop being passed on, a folder that should never have existed. The Erase button in Unlost writes zeros over the free space those files are lying in, so that what a later scan could bring back is zeros and not the file.

It is the only write path in the program, and it is fenced accordingly:

• You have to ask for it. Erase is a separate button that opens a dialogue naming the drive and the number of files, and nothing happens until you press the button inside that dialogue. No scan, recovery or preview ever reaches this code.
• It writes only into free space. Unlost asks Windows which clusters the volume is using right now and writes only into the ones it says are free. A file you still have is not touched, and neither is the file table, the boot sector or anything else the volume needs to work.
• It is checked before it writes. Every block is verified against the volume's own allocation map at the moment of writing, not at the moment the list was built.
• It cannot be undone. That is the entire point of it, and it is why the dialogue says so before the button rather than after.

A scan run afterwards will still list those files, and that is not a failure. A deleted file's name, size and address live in the volume's own file table, and the file table is not free space — erasing it would break the drive for everything still on it. So the row comes back, drawn exactly as it was: nothing on the volume records that the bytes behind it changed. What changed is the bytes. Recover one of those files after an erase and what lands on your disk is zeros.

If what you need is for the names to be gone as well, that is a different job from this one: format the drive, and erase the free space afterwards.

If you never press it, Unlost never writes a byte to the drive you are scanning.

Recovered files are written somewhere else — always

The destination picker at the bottom of the window will not accept the drive you are recovering from. This is the single most important safety rule in file recovery: writing a recovered file back onto the source drive can land it on the clusters that still hold the rest of your missing files, destroying them while you are in the middle of saving them.

The same logic is why the download page asks you to install Unlost onto a drive other than the one you lost files from. If your files were on your computer's own system drive, install to a spare USB stick.

Nothing about your drive goes over the network

Scanning, previewing and recovering happen entirely on your machine. No file, no file name, no drive list, no thumbnail and no fragment of content is uploaded anywhere. There is no account, no cloud storage and no server-side processing, so there is no place for your data to end up.

What does go out is a count — that an installation finished, that a version was started. Each line carries a random identifier that exists only to keep one computer from being counted as ten: it is generated from the operating system's random number generator, never derived from a disk serial, a network address, a machine ID or your Windows account, and nothing in the line comes from your disks. It is a number for working out whether anybody is using this, and it is the only traffic the program produces. The privacy page lists every field, and the app's count has a switch in the window.

The part that matters here you can check rather than take on trust: pull the network cable, and scanning, previewing and recovering all work exactly the same. Nothing about the recovery waits on a server, asks permission from one, or is held back until one answers.

Why it asks for administrator rights

A deleted file has no directory entry any more, so there is nothing to open by name. The only way to find it is to read the volume the way the disk stores it — sector by sector, past the file system's own bookkeeping. Windows treats that kind of raw volume access as privileged and will not grant it to an ordinary user process, which is why Unlost triggers the UAC prompt once when it starts.

That elevation is used for one thing: opening the volume for reading. Unlost installs no driver, registers no service, adds nothing to startup, makes no changes to system or security settings, and does not stay resident after you close it. It uninstalls from Settings like any other app.

The SmartScreen warning

When you run the installer, Windows may show a blue box saying "Microsoft Defender SmartScreen prevented an unrecognised app from starting", with a "Run anyway" hidden behind "More info". The useful thing to do at that moment is not to press it: check the file against the checksum published below first. The warning cannot tell you whether the file you hold is the one this site published — the checksum can, and it takes one line in PowerShell. Here is the honest explanation of what the warning is and is not.

What it means

SmartScreen is a reputation system, not a malware scanner. It asks a different question from an antivirus: not "does this file do something bad?" but "have enough Windows users run this exact file, or files signed by this exact publisher, for Microsoft to have formed an opinion?" For a new release from a small publisher the answer is no, so the warning appears. It appears for essentially every new independent Windows application on the day it ships.

Why Unlost gets it

The installer is signed — see who signed it below — and that still does not make the warning go away on day one. A signature gives reputation something to accumulate against: an identity that survives from one release to the next, instead of a fresh unknown file every time. It does not hand over the reputation itself. That is built by people downloading and running the file over weeks, and until enough of them have, a signed installer from a publisher Microsoft has not seen before is still an unrecognised one.

So expect the warning for a while yet. It should thin out as the same certificate signs more releases and more of them get run, and it does not reset to zero on every new version the way an unsigned file does.

What it does not mean

It does not mean Windows found anything in the file. It is not an antivirus verdict, and it is not evidence of a problem. It equally is not a clean bill of health — "unrecognised" is a statement about popularity, and no installer from any source becomes safe because someone's website says so. Check it.

Who signed the installer

Windows will name a publisher when you run it, and it will not be the word "Unlost". This is the part worth reading before you get there, because an unfamiliar company name on a prompt is exactly the sort of thing that should make you stop.

UnlostSetup.exe is signed with an extended validation code-signing certificate issued by Sectigo to Kanon Agro B.V., a company registered in the Netherlands under number 04067997. That is the entity that publishes Unlost, and it is the name Windows shows as the verified publisher in the User Account Control prompt. Extended validation means the certificate authority checked those company details against the register before issuing it — the name in the prompt is a name somebody had to prove.

The signature carries a timestamp from Sectigo's timestamping service, which matters for a reason that is easy to miss: a timestamped signature stays valid after the certificate itself expires. An installer you download today and keep on a stick for two years will still verify.

How to check the signature yourself

Right-click UnlostSetup.exe, choose Properties, then the Digital Signatures tab. The signer should read Kanon Agro B.V.; open Details and the certificate should say it was issued by Sectigo. Or in PowerShell:

Get-AuthenticodeSignature .\UnlostSetup.exe | Format-List Status, SignerCertificate

Status is Valid on a file that is intact and correctly signed. Anything else — HashMismatch above all — means the file was altered after it was signed, and you should not run it whatever this page says.

Some antivirus programs may flag it too — and why

Separately from SmartScreen, a handful of antivirus engines may report a brand-new installer as suspicious. This is a different system from SmartScreen, and it is not evidence that anything is wrong with the file.

Most of these verdicts come from machine-learning models that judge a file by its shape rather than by watching it do anything. An installer that carries an application inside it, from a publisher the model has never seen, matches the statistical profile those models were trained to distrust. Verdict names are the tell: "suspicious", "unsafe", "anomalous", "generic" or a confidence percentage describe a guess about the file, not a specific piece of malware found in it.

Two things push those verdicts down. One is the code-signing certificate, which the installer now has: it gives the file a stable publisher identity for reputation to build against. The other is simple age and download volume, and that one cannot be bought or hurried — it arrives at the speed people download the file. So a signed release still collects a verdict or two in its first weeks, and the honest answer stays what it was: do not take this page's word for it. Check the file yourself with the steps below, and if an engine flags it, the checksum published here lets you confirm you have the exact file we published and not a repackaged copy.

How to check the installer yourself

You do not have to trust this page. All five of these are things you can do in a couple of minutes, before you run anything.

1. Check the signature. Right-click the file, Properties, Digital Signatures: the signer should read Kanon Agro B.V. and the certificate should be issued by Sectigo. This is the quickest of the five and it answers two questions at once — who published the file, and whether anything has altered it since. The full explanation, including the PowerShell one-liner.
2. Compare the checksum. The SHA-256 of UnlostSetup.exe is: 59fd9cd0db55ede4357bc4b3e1cf98303b8cc69fd4876b44eae163b0edefa06c In PowerShell: Get-FileHash .\UnlostSetup.exe -Algorithm SHA256. If it does not match, the file you have is not the file published here — delete it.
3. Upload it to VirusTotal. Drop the installer at virustotal.com (opens in a new tab) and see roughly seventy engines look at it at once. That is a far more meaningful signal than any single warning box, and it is free.
4. Scan it with what you already have. Right-click the file, then "Scan with Microsoft Defender". Defender's scanner and SmartScreen's reputation check are different systems with different answers.
5. Watch it not talk to anyone. Disconnect from the network entirely, then install and run a scan. Everything works. Nothing about recovery needs the internet, so nothing about recovery breaks without it.

Downloading only from tryunlost.com matters too. Recovery software is a popular thing to repackage with something extra attached, and a copy from a download-portal mirror is not the file described on this page.

Reporting a security problem

If you find a vulnerability in Unlost or in this website, write to [email protected]. Machine-readable contact details are published at /.well-known/security.txt.

Please include enough detail to reproduce the issue. You will get a human reply, reports are not met with legal threats, and you are welcome to be credited by name in the release notes for the fix if you want to be.