Sometimes Windows Defender quarantines some suspicious files that are actually trustworthy. In this case, you have to restore quarantined files in Windows Defender. This article will explore comprehensive knowledge about quarantined files and provide several step-by-step methods to restore files quarantined by Windows Defender on Windows 11.
Windows Defender, now also known as Microsoft Defender Antivirus, is a built-in security feature in Windows operating systems. It provides real-time protection against a variety of security threats, such as viruses, malware, spyware, phishing attempts and more. It works by scanning your computer for potential security threats and blocking or quarantining suspicious files.
However, there are times when trusted programs or important files may also be quarantined by Windows Defender. This is usually caused by the following reasons.
Files quarantined by Windows Defender will be removed from their original locations and stored in this path: C:\ProgramData\Microsoft\Windows Defender\Quarantine. You can only view or manage these files through the Windows Security Center.
In some cases, they may also be deleted, but you can recover the deleted files by Windows Defender. If you're certain a quarantined file isn't a threat, you can use the following three methods to restore the file from quarantine Windows Defender on Windows.
Windows Defender does not immediately delete the quarantined files. Instead, it moves them to a quarantine area, from which you can restore the files. Files will be remained for 30 days by default. The faster you restore the file, the greater the chance of successful recovery.
Step 1. Type "Windows Security" in the start menu and open it.
Step 2. Click "Virus & threat protection" and choose "Protection history" under the "Current threats".
Step 3. Look for the files you want restore choosing "Quarantined Items" by "Filters".
Step 4. Select the files and click "Actions" to choose "Restore".
MpCmdRun.exe is a built-in command-line tool for Microsoft Defender Antivirus, located in the %ProgramFiles%\Windows Defender directory. It provides advanced scanning, updating, diagnostic, and quarantined file management functions, suitable for administrators and advanced users. It’s particularly useful for advanced users or when automating tasks.
Step 1. Press Win+X and select "Terminal (Admin)" to open Command Prompt as administrator (For windows 10, you can select "Command Prompt" from the menu instead).
Step 2. Enter the following command and press "Enter":
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name
Microsoft Defender provides an advanced method called "Download or Collect Files," which allows administrators or users to download or collect quarantined files from the quarantine area for further analysis or recovery. This method is typically used for enterprise devices managed by Microsoft Defender for Endpoint (MDE), but similar functionality can also be achieved on local devices using PowerShell.
Selecting Download file from the response actions allows you to download your quarantined file. It will be downloaded to your local machine as a ".zip" archive or similar format, which can then be extracted for further analysis.
If you encounter special circumstances where you cannot restore quarantined files in Windows Defender or the files have been deleted, you can also use professional data recovery software-MyRecover-to restore your files. It has no time restrictions on deleted files and is easy to operate without running complex command lines.
MyRecover excels at recovering data from various complex scenarios, such as formatted hard drives, inaccessible drives, deleted partitions, and system crashes. Quarantined files become inaccessible, but MyRecover can scan the disks on your computer to accurately locate lost files and recover them effectively. It has no time restrictions on deleted files and is easy to operate without running complex command lines.
Step 1. Download and install MyRecover on a different drive from the one containing the lost files on your computer.
Step 2. Launch it and select the drive to scan for the lost data.
Step 3. Choose the files you want recover and click "Recover" to restore them.
Step 4. Select a secure location to save the recovered files.
Once the process is finished, you can check the recovered files in the destination folder.
After reading this article, you should now understand how to restore files quarantined in Windows Defender on Windows11. If restoration fails or the file is deleted, MyRecover can also provide methods for data recovery. This ensures both your computer's security and your data's safety.
Since file name may become corrupted during the loss process, you can upgrade to the Professional or Technician Edition of MyRecover, which allows you to preview the file's contents before recovery to confirm if it is the file you wish to restore.
