How to recover files infected by a virus?

The loss of files and data, whether due to accidental deletion or the entry of a virus into our system or device, is very common. With the years we have spent in the world of cybersecurity and IT solutions, we have realized that data recovery services or Disaster Recovery continue to be in high demand.

That's why we believe it is important to create this post in the form of a guide, where you will find a list of options for recovering your files infected by viruses, both in Windows and external USB devices and hard drives, that you can do yourself. If none of these basic solutions work for you, we recommend seeking assistance from a specialist in IT solutions to help you recover the information. Poor data recovery management can result in permanent file loss.

Guide to Recovering Files Infected by a Virus

In Windows

There are several methods offered by Windows to recover files infected by a virus, depending on their location and file type. Here are some of the options available to you.

File Recovery from Backup

To perform this type of recovery, follow these steps:

1. Go to "Start" (click on the Windows icon in the taskbar).

2. Select "Control Panel." A list of all the items in the Control Panel will appear.

3. Choose "Backup and Restore." A new window will open. Scroll to the bottom of the screen using the scroll bar.

4. Click on "Restore my files." A new window will open.

5. Select either "Browse," "Search files," or "Search folders" (depending on the information you want to recover), and add the files you want to recover from the corresponding backup file. Once done...

6. Click "Next" to proceed to the configuration window.

7. In the configuration window, specify the location where you want the files to be restored. Once specified, click "Restore."

By following these seven steps, you should be able to recover your files.

Recovery from a Previous Version

To perform this type of recovery, follow these steps:

1. Go to "Start" (click on the Windows icon in the taskbar).

2. Select "This PC." A window will open, displaying the available files and folders for restoration.

3. Right-click on the folder and click on "Restore previous versions." A new window will open, showing all the previous saved versions that were automatically created by the system based on the established parameters. Simply select the desired option to recover the data.

Recovery from File History

To perform this type of recovery, follow these steps:

1. Go to "Start" (click on the Windows icon in the taskbar) and open the "This PC," "Computer," or "My Computer" folder (depending on your system settings).

2. A tab will open where you can see all the files and folders on your computer. In the toolbar, you will find the "History" option, which displays a multitude of temporary backup copies of files saved at different times.

3. Select the backup copy or copies you want to recover and click on the green button at the bottom.

For a Damaged or Virus-Infected USB

Recovering Information Using Command Prompt

You can recover lost data from a hard drive or USB using CMD commands. However, it's important to note that improper use of CMD can have serious consequences and may not work as expected.

We recommend reading through the following steps before starting, as certain keys may vary depending on your device. This will help you avoid errors.

To recover information from a flash drive using CMD, follow these steps:

1. Connect the device to your computer so that it is detected.

2. Press the Win+R keys, type "cmd," and press ENTER to open the Command Prompt window.

3. Type "chkdsk D: /f" (replace "D" with the letter corresponding to your device) and press ENTER.

4. Type "Y" and press ENTER.

5. Type "D" and press ENTER (again, replace "D" with the letter corresponding to your external device).

6. Type "D:>attrib -h -r -s/s/d*.*" and press ENTER (replace "D" according to your device).

After completing these steps, you can check your device to confirm that your files have been recovered.

*Contribution from ESED: "This is a measure against the recycler virus. This virus hides the files on a drive and only leaves visible shortcuts that it generates, giving the impression that it has directly converted them into shortcuts. The command 'D:>attrib -h -r -s/s/d.*' basically removes the hidden attribute status of the files to make them visible again." 

ESED: File Recovery with a Specific Data Recovery Solution

It is important to note that depending on the complexity of the virus infection, the above recommendations may not be effective, and you may need to seek professional assistance.

At ESED, we offer Housing Data Center and Disaster Recovery solutions to ensure the continuity of your operations and the proper functioning of your server at all times. We provide remote backup systems and data recovery in case of loss or virus entry into the system.