Most types of malware do not seek to harm your files; they seek access to information (credentials) or system resources. When you lose access to files following an infection, it's usually due to the cleanup, in one of three ways: they've been placed into quarantine as a result of detection by an AV product, they've been removed by a removal tool, or a restoration point was used as part of the recovery process. The first of these can be reversed at no charge.
Most antivirus programs don't delete the files they find. They move them to a “quarantine” area where they sit, untouched. If the antivirus program determines a file has been infected with a virus, the file remains there unaltered. Windows Defender keeps its quarantine under Virus & threat protection, in Protection history. Any third-party product used will also have its own quarantine location.
A significant number of enquiries stop here, within five minutes, without charge. We recommend you check here before concluding your files have been deleted.
Next, check System Restore and Previous Versions. Frequently, after performing a malware removal, they will remain intact and can restore an entire folder to its previous state from last week.
In situations where the computer is currently infected with malware and you want the data, the best method is to remove the drive from service, create an image of the drive, and recover the desired file(s) from the image created from the infected computer as opposed to recovering from the running infected computer. By doing so, nothing will execute and nothing will spread.
The extracted files are then scanned prior to being returned to you. Additionally, all documents are checked for embedded macros and scripts. In this process, what you receive is data and not a restored computer system. This is by design. An infected machine needs to be completely reinstalled from clean media; disinfecting it does not make it trustworthy.
We don't return your original operating system when you are infected with malware. We advise against restoring your operating system through a company offering such services.
The cost for extracting data from a compromised computer's drive is from £300 +VAT. If the underlying drive has also failed, it would be quoted as a job in the appropriate class of recovery.
If it turns out that your files are in the security program's quarantine, we will inform you of this at no expense. This occurs enough times to make it worth mentioning.
First check the security program's quarantine. Most programs do not delete suspected files but instead move them to the quarantine area. As such, many of these enquiries are resolved in a few minutes with no charges incurred.
Your documents were almost certainly left alone by the malware removal, which took necessary system files that the malware was using. Do not simply reinstall over the top of the existing system: extract the data first, then build again from scratch.
We will remove your data, then scan and verify it; we will not return a disinfected operating system. Compromised machines should be rebuilt from “clean” media rather than trusted after cleaning up.
All extracted files will be scanned prior to their return. Documents will also be reviewed for embedded macros or scripts. All data will be recovered from an image of the disk (not from a running OS); therefore, no executable code is run during our process.
The malware that infected your computer is a type of ransomware (not a virus), which means the approach is different. Do not wipe or reimage the disk(s): there will be unencrypted originals on them, sitting in unused space.
It takes 3-7 working days. Imaging/extraction of your files is quick; the time-consuming part is scanning/verifying a large set of documents.
Our diagnostic service is free, and in most cases you only pay if we recover your data, which we pull clean from any infected device (drive, memory stick or card). Get your recovery moving today.