What to do right now
- Open the antivirus protection history or quarantine and look for the file.
- Restore only if you trust the source; otherwise get a clean copy.
- If it was truly deleted, scan the drive and check the recovered file again.
Step by step
Check Windows Security protection history
Open Windows Security › Virus & threat protection › Protection history. Quarantined items show the threat name and an Actions menu with Restore. Other antivirus products have a similar Quarantine section.
Decide whether it is a false positive
Files you created yourself, such as documents and spreadsheets, are rarely real threats. Programs, cracks, macros and archives from unknown sources often are. When in doubt, download a fresh copy from the original publisher.
Restore and add a narrow exclusion
If you restore a trusted file, the scanner may remove it again. Add an exclusion for that one file or folder, not for a whole drive.
Recover the file if it was deleted
If the file is not in quarantine, it was deleted. Run the Balanced scan on the drive where it was stored and save the result to another disk.
Scan the recovered file
Before opening it, scan the recovered copy with your antivirus or an online multi-engine scanner. Recovery brings back the bytes exactly as they were, including any malware.
Quarantine is not deletion
Quarantine moves the file into a protected folder and encrypts or locks it so it cannot run. The original location becomes empty, which looks like deletion, but the antivirus can put it back. Some products delete files automatically after a set period or when the detection is severe; only then is a recovery scan needed.
Quarantine folders are protected by the antivirus itself, so copying files out of them directly does not work. Use the product's own restore function.
If the file was in a cloud-synced folder, its deletion may also have been synced. Check the cloud recycle bin as well, because it keeps deleted items for a limited time.
When it won't work
- The antivirus cleaned the file by modifying it; the recovered file is then the cleaned version or a deleted earlier copy.
- The file was on an internal SSD with TRIM and was deleted rather than quarantined.
- Ransomware encrypted the original; recovering deleted originals sometimes helps, but often they were overwritten.
How FileFix Ultimate helps
- Recovers files the antivirus deleted from NTFS, FAT32 and exFAT drives, with original names where records survive.
- Saves recovered files only to a different volume so nothing is overwritten during recovery.
- Records a SHA-256 hash for each recovered file, useful for checking it against online scanners.
- Works offline and never uploads your files anywhere.
FileFix Ultimate is free, works offline and never writes to the drive you are recovering from. Check the signature before you run it.
Frequently asked questions
Is it safe to restore a quarantined file?
Only if you are confident it is a false positive. If you downloaded it from an unknown site, assume the detection is right.
Why does my antivirus keep deleting the same file?
Restoring does not change the detection. Add a narrow exclusion for that file after you have verified it, or report the false positive to the antivirus vendor.
Can ransomware-encrypted files be recovered with this method?
Sometimes the original unencrypted files were deleted rather than overwritten and can be recovered. Remove the ransomware first, and check whether a free decryptor exists for that strain.
Where are quarantined files stored?
In a protected folder managed by the antivirus, for Windows Security under ProgramData. The files are locked and encoded there, so restore them through Protection history rather than copying them manually.