How to recover files after ransomware virus

More and more computers are infected by ransomware. Every day there are new victims whose computer data is encrypted by ransomware. These are more and more private individuals but also large companies. If ransomware has encrypted the computer data, an amount of money is requested in virtual cryptocurrency.

If you pay – which I do not recommend – you will get the code to get the encrypted data back or the ransomware developers will decrypt the files remotely.

Recover ransomware encrypted files

If you don’t want to pay the ransomware developers and first try to decrypt the encrypted files yourself then there are a number of options you can try. In this article, I will give you some options to try to decrypt the encrypted files again. There is no guarantee that these tips will work.

Shadow Explorer

ShadowExplorer is a free program where you can view Shadow copies created by Windows itself. If Shadow copies in Windows are available then you can use Shadow Explorer to restore these copies. You can then restore entire folders or files. Most advanced ransomware is familiar with Shadow copies and removes them. So there is no guarantee that Shadow Explorer can restore copies.

Download Shadow Explorer

Install Shadow Explorer. First, you need to select a Shadow copy in the menu.

If there are no shadow copies available the shadow copies are deleted, there is no way to restore files using Shadow Explorer.
Continue to the next step instead.

Select your drive in the top left corner and browse the folder and files you would like to recover.

Select the folder or file, right-click, and click on Export. Select the output folder and click on OK.

The folder or file you have recovered is now in the out folder location.

Recuva

Recuva is another free program to recover pictures, music, documents, videos, emails, or any other file type you’ve lost. And it can recover from any rewriteable media you have memory cards, external hard drives, USB sticks, and more. Please note there is no guarantee Recuva can restore encrypted files by ransomware. Recuva works for some ransomware but not for the more sophisticated ransomware.

Download Recuva free

Install Recuva by following the installation process.

In the first step, read the information and click Next.

What file type would you like to recover? Click all Files and click the Next button.

Where are the files located? Click I’m not sure and click the Next button.

When Recuva is ready to search your files click on the Start button.

Wait a few minutes. Recuva is scanning for deleted files and folders.

In the column “Filename” you can restore any removed file. Check the file you would like to restore and click the “Recover…” button.

EaseUS data recovery

EaseUS is a premium program to restore files. Reliable and professional data recovery software, retrieves deleted & lost files
on PC/laptop/server or other digital storage media effortlessly.

You can perform a scan to recover files, when you would like to recover the detected files you need to purchase a license to do so.

Download EaseUS data recovery TRIAL

Install EaseUS data recovery using the simple installation process.

Click on the Local Disk (C:\) to begin scanning to recover files.

Wait for the scan to finish this might take a while when you have lots of files to recover.

When the EaseUS data recovery program is done scanning you need to save your scan session. In the top menu click on the Save button. Next, search for the files and folder you would like to recover and click on the Recover button.

I hope you have been able to restore files that are encrypted by ransomware.