Ransomware Doc File Recovery

July 7, 2017

Do ransomware doc file recovery with backup image, shadow copy, data recovery tool or decrypt software.

Not only ransomware but also other computer virus select users’ doc files as attack target. Been hit by those virus, the greatest influence is data loss. Thus, after infection, the most urgent need is to carry out ransomware doc file recovery. First thing first, here, I would like to introduce you with several ways to do ransomware data recovery.

Ransomware Doc File Recovery with Backup Image

If you have created backup images for your crucial doc files before, you can recover the data back immediately with a file restore software. If your backup image is made by Windows (maybe together with system backup), just go to Window Backup and Restore to restore the files back.

Restore My Files

Ransomware File Recovery Using Shadow Copy

Shadow copies are created while making volume backup to form restore point for system protection by Windows. Usually, computer users, especially green hands, are not aware of them, but it surely exist. And, in most times, we do not need these copies in case of accidents like ransomware attack.

To do ransomware doc file recovery making use of shadow copies, Shadow Explorer can be a big help for it will assist you to quick find out the shadow copies on your affected computer. To view detail steps to carry out ransomware infected file recovery under the help of Shadow Explorer, please refer to recover ransomware encrypted files.

Ransomware File Restore Assisted by Data Recovery Tool

If both methods above cannot help, you can try ransomware data recovery tool to restore doc files for you. Most ransomware infected victims’ machines by two ways, encrypt doc files or lock computer screen. If it’s the first way, like the recent ransomware WannaCry, the infection process is: make a copy of the personal files, encrypt the copy and delete the original files. If it is so, you can rely on a ransomware data recovery tool to restore the deleted original files back to another safe storage.

There are many data recovery software in the market. And, some anti-virus software itself has data recovery function, like Trend Micro and Malwarebytes.

Ransomware Doc File Recovery under the Help of Decrypt Software

As I said above, ransomware attack has two methods, encrypt file or lock screen. No matter which way it applies, a decrypt tool can help. It is said that encrypting or decrypting file keys generated by Windows application are save in memory. Thus, the keys to decrypt the locked files are also there. Just find a third party tool to help you find out these keys and release the encrypted doc files by ransomware.

Tip: There may be such a decrypt software which can directly decrypt your files or unlock the computer screen.

Move Data out to Do Ransomware Virus Data Recovery

If all solutions above does not work for you, you can try this – backup the important data out and further seek for help. Therefore, you first need a ransomware detection software and a data backup software to do so. Here, take CryptoSerach and AOMEI Backupper Free (Especially for WannaCry Ransomware) for example.

first of all, use CryptoSearch, a program to help find what files were encrypted by a particular ransomware, to detect what files are infected.

If you can still operate in the infected computer, download and install AOMEI Backupper Free to the machine. If not, operate on another uninfected machine and install the program on it. Then, create a bootable USB flash drive using “Create Bootable Media” function in AOMEI Backupper Free to boot the infected computer up. What you need to know is that while creating the bootable USB, AOMEI Backupper Free is packed into the USB. Thus, you can use the USB to first boot the victim computer up and then open the including AOMEI Backupper Free to backup data out.

Tip:Before start, insert another large USB flash drive or other external drive into the affected computer as storage device for the doc file backup.

1. Launch AOMEI Backupper Free and select “I Want to Backup Data”.

I Want to Backup Data

2. Add all the doc files you want to migrate out to the source column.

Select Files to Backup

3. Select the connected external storage device as backup destination.

File Backup Destination

Tip:You can also choose to backup to NAS if you cannot find a proper external storage device. However, you are not recommended to backup to cloud since this software so far only supports to back up to a few clouds and the clouds should have its app installed on the computer.

Backup to NAS

4. Click “Start Backup” and wait it finishes. Then, disconnect the storage device and bootable USB.

Then, you can insert the storage device to the healthy computer and use AOMEI Backupper Free to restore it to the working computer. If you are lucky enough, the restored files are normal and accessible since them have isolated from the affected machine. If not, you can feel free to find further solutions instead of worrying about them been deleted at any time.


  • Put the backed up files on healthy computer might get the healthy computer infected. So, be careful to do this. You can put it on a working machine which has no important data on it or whose data have been moved to another place in advance.

  • You can use Clone feature of AOMEI Backupper Free to directly copy doc files to storage device. This function won’t need further restoration to access the docs. Yet, this function has larger chance to bring virus out to other computer than backup feature.

  • If the data stored in the infected computer are stored on the second hard disk separated from system hard drive, you can just take out the disk out of the slot, insert the data disk into a working computer for ransomware virus data recovery. Still, this way has larger chance to bring virus out to other computer than backup feature, even larger than clone method.

If all ways above still not work for you, you may search google for other solutions. Or, you may pay the ransom or take your computer to data recovery shop for ransomware doc file recovery.