How to Recover Files Deleted by Antivirus?

Antivirus programs are designed to protect your PC from malware threats like viruses and Trojans. But sometimes, they mistakenly flag legitimate files as threats and mark them for permanent deletion. The good news is that, in many cases, you can successfully recover those files deleted by antivirus.

This guide will explain why antivirus software sometimes delete files, how do they decide whether the files will be quarantined or permanently removed, and some effective ways to recover them on your Windows PC.

Why Did the Antivirus Delete My File?

Antivirus software protects your system from malicious programs by scanning files for known malware signatures and suspicious behavior. While it doesn’t intentionally delete your files, but when a file appears harmful, the antivirus may take action to prevent any unwanted infection in your system. It may also remove a file for several other reasons.

• False positive: An antivirus will attack a legitimate file as malware if it’s code or behavior looks like that of a malicious program—a major reason why some trusted apps, scripts, or cracked programs are flagged.
• Heuristic or behavior-based detection:  Modern antivirus programs don’t just depend on virus signature; they also analyze how a file behaves. When a file shows behavior which resembles malware, like modifying system files, encrypting data, or making unauthorized registry changes, the antivirus may block or remove it even if it’s not infected.
• Confirmed malware detection: When the file is really infected or contains malicious code, the antivirus may quarantine, disinfect, or permanently delete it to prevent the threat from spreading.

Before trying any recovery method, the first step is to determine whether your antivirus quarantined the file or permanently deleted it. The next section explains how to identify the difference and choose the appropriate recovery method.

5 Methods to Recover Files Deleted by Antivirus

The right recovery method depends on how the antivirus really handled your files. In case they were quarantined, then you can restore them directly from the antivirus program. But if the files were permanently deleted, then you’ll have to restore them from a recent back up folder or use a professional data recovery software.

1. Recover Deleted Files from Quarantine

Most antivirus programs have a “virus chest” called quarantine, which is an isolated area that holds suspicious files so they can’t harm your system. In case, the antivirus quarantined files instead of deleting them outright – you can easily restore them from here. But be very cautious while restoring a file from quarantine. Do it only if you’re sure that it’s a false positive, else you may end up restoring an infected file and put your system at risk.

Restore Files from Windows Defender Quarantine

• Open Windows Security.
• Select Virus & threat protection.
• Click Protection history.
• If you have a list of items, you can filter on Quarantined Items.

• Select the files you want and click Restore.

Restore Files from Avast Antivirus Quarantine

• Launch Avast Antivirus.
• Click Protection > Quarantine.

• Click the … menu (More options), then select an action:

Restore: It will move the file to its original location on your device

Restore and add exception: It will move the file to its original location and also add it to the exceptions list to exclude it from all Avast Antivirus scans and shields.

Extract: It will move the file to a chosen location on your device.

• The selected files will be restored.

Restore files from Kaspersky Antivirus Quarantine

• Open Kaspersky.
• Go to Security > Quarantine or More Tools > Quarantine.
• Locate the file you want to recover.
• Click Restore.

You can restore files from the quarantine section of most antivirus programs like this. But if you’re unable to locate your files in quarantine it’s likely that the file is permanently deleted, cleaned, or automatically removed after the retention period.

2. Check the Recycle Bin

Take some time to quickly check Recycle Bin before trying advanced recovery methods. Although most antivirus programs bypass the Recycle Bin and remove the suspected files directly, still check the Recycle Bin once. In case you accidentally deleted the file yourself around the same time, then restore it from there.

• Open Recycle Bin.
• Look for the deleted files.
• Right-click on the file and select Restore.

The file will be returned to its original location.

3. Restore from File History Backup

File History is a Windows backup feature which can restore lost files – including those that are deleted by an antivirus software. It creates automatic backups of important locations like Documents, Pictures, Videos, Desktop, etc. But it works only if File History was enabled before the files were lost.

• Go to Control Panel > System and Security > File History and click Restore personal files.

• Use the on-screen left/right arrow buttons at the bottom of the window to browse through backup versions and locate your files.
• Select the files you want to recover.
• Click Restore to the move the files to the original location.