How to Recover Files from Ransomware Attack [Full Guide 2022]

This page covers 4 ways on how to recover files from ransomware and offers some tips that can help you prevent ransomware attacks.


By Kelsey / Updated on April 2, 2024

Share this: instagram reddit

Is it possible to recover data from ransomware?


I'm looking at a computer after it's been hit by some ransomware. The files have been encrypted. I am trying some guides in removal and recovery, but they don't seem to be of much help. If you have suggestions on how to recover files from ransomware, I would appreciate it.

When a storage device or computer is infected by a ransomware virus, your files may be encrypted, deleted, hidden, or modified, and inaccessible. Fortunately, aside from paying for a decryption key, there are several easy and free ways that you can use to perform ransomware data recovery.

If you are looking for methods on how to recover ransomware-infected files, you have come to the right place. In the following chapter, we will show you some practical ways to recover lost data from ransomware attacks.

Recover Files From Ransomware

How to recover files from ransomware attack in 4 ways

Many solutions are available for you to solve how to recover data from ransomware attacks. We have selected some easy-to-implement methods for you. Read below for detailed information. 

Method 1. Recover files from ransomware with data recovery software

Usually, ransomware removes the original data after the intrusion. The encrypted files it creates are not the original files, but copies. Therefore, with the help of professional data recovery software, you can easily retrieve your original files deleted by ransomware.

MyRecover is fully-featured ransomware data recovery software that allows you to restore lost data from infected hard drives under trojan, malware, worms, and various virus attacks, and from system crashes.

With this tool, you can recover deleted files, photos, audio, music, emails, and hundreds of other types of files without any effort. It supports you to recover lost data from hard drives, USB flash drives, memory cards, SD cards, emptied Recycle Bin, etc.

Simply download and install this software on your computer, and then follow the steps below to learn how to recover data from ransomware:

Download SoftwareWin 11/10/8/7/Server
Secure Download

Step 1. Select location and start scan

Run MyRecover, hover the mouse over the drive and click Scan to scan.. If your files are lost from an external hard drive like a USB drive, please plug it into your PC in advance.

Select Partition To Scan

Step 2. Locate and preview your lost/deleted files

The recovery tool will automatically start looking for all the deleted and lost files.

Scan Lost Data

Step 3. Recover selected files

You can expand the Deleted files folder and Other missing files folder to select the desired items, then click Recover x files to begin ransomware attack recovery now.

Select Deleted Excel Files Click Recover

Method 2. Recover ransomware infected files via Backup and Restore

If you have a backup available, restoring files is as simple as ABC. You can easily recover encrypted files by finding the corresponding backup file and restoring the data you need. But this option is possible only when you regularly back up your data.

The how to recover ransomware encrypted files guide is instructed as follows. You can simply initiate a data restoration from Windows backup created through the Backup and Restore software when all your files have been encrypted by ransomware.

Step 1. Open Control Panel and click on System and Security. Then, hit Backup and Restore (Windows 7).

Windows Backup And Restore

Step 2. Tap on the Restore my files position in the Restore tab.

Windows Backup Restore My Files

Step 3. Click Browse for files to locate your lost data and choose to save your recovered files in your original location or another destination as needed.

Browse For Files To Restore

Method 3. Get back files from ransomware using File History

If you have used File History to save a copy of your precious data, you can follow the steps below to figure out how to recover encrypted files from ransomware. You can use this tool to recover permanently deleted folders and files on your computer as well.

Step 1. Go to Control Panel > System and Security, and click on File History.

File History

Step 2. Press the Restore personal files button on the left panel. Please make sure your File History is turned on.

Restore Personal Files

Step 3. Find the files you want to recover and click the arrow pointing left or right to choose the version you need. And then, click the Recover button.

Restore Deleted File

Method 4. Recover from ransomware through system restore

If you have created a restore point for your system, the system restore can bring your PC back to a previous point in time. This means that you can get back files on your computer that have been encrypted by ransomware through a system restore point.

Next, let’s have a look at how to recover files infected by ransomware from a system restore.

Step 1. Press Win + S to open the Windows search box, type Create a restore point, and click Open from the list of results.

Create A Restore Point Open

Step 2. Click on System Restore > Next.

System Drive On System Restore Next

Step 3. Choose a restore point from the list and tap on Scan for affected programs to check the items that will be deleted after the restore. Then, click Close.

Scan For Affected Programs Close

Step 4. Press Next. Confirm the selected restore point and click Finish. Then, hit Yes to begin the recovery of deleted files.

If there is no restore point, it might be because the system protection isn't turned on. You can check Protection Settings on the System Protection tab. If the Protection Settings for your system drive shows as Off, you can click on Configure > Turn on System protection, and then OK to turn it on.

Turn On System Protection Ok

Some ransomware decryption tools can help to decrypt files encrypted by ransomware. However, such tools do not fully guarantee that ransomware-encrypted files can be recovered. Thus, recovering files infected by ransomware using a ransomware recovery service like MyRecover or with the help of a backup file are the easiest and most workable ways.

Some tips on preventing ransomware

To prevent ransomware from attacking your computer and files again, we list several tips for you:

  • Make sure the antivirus software is enabled on the computer.
  • Don't click on emails and connections sent by strangers.
  • Report ransomware attacks to let authorities identify the attacker.
  • Regularly back up important data in case of emergencies.


Ransomware can't be prevented. Though there are multiple ways for you to accomplish how to recover files from ransomware, prevention is easier than rescue. We highly recommend you backup your important data periodically.

Kelsey · Editor
Kelsey is an English editor of AOMEI Technology. She is passionate about helping people find effective ways to deal with all problems in computer. She has great insights into data backup and recovery, disk partition and clone, and other data protection measures. She likes learn computer skills to improve herself and enjoy quality time with family and friends.