How to Restore Quarantined Files in Windows Defender on Windows 11

Why Files Get Quarantined by Windows Defender?

Windows Defender, now also known as Microsoft Defender Antivirus, is a built-in security feature in Windows operating systems. It provides real-time protection against a variety of security threats, such as viruses, malware, spyware, phishing attempts and more. It works by scanning your computer for potential security threats and blocking or quarantining suspicious files.

However, there are times when trusted programs or important files may also be quarantined by Windows Defender. This is usually caused by the following reasons.

• False Positive Detection: Windows Defender might mistakenly flag a trusted file as malicious. It is a common occurrence when new or rare software behaves similarly to known threats.
• File Modification: If a trusted file be modified, windows defender may flag it as suspicious, especially the modification is significant.
• Potentially Unwanted Programs: Sometimes files or programs aren't outright malicious, but they are considered Potentially Unwanted Programs (PUPs). These are often bundled with other software and could have undesirable behavior, like showing ads or collecting data without consent.
• Heuristic Analysis: Defender uses heuristic scanning, which looks for suspicious behavior rather than relying solely on virus definitions. If a file starts performing actions that resemble those of a malware sample, Defender may quarantine it.
• Invalid Signature: If a file has a corrupted signature or its digital certificates is out of data, windows defender might quarantine it.
• Conflicting Software: Sometimes trusted files can get quarantined due to conflicts with other security software running on your system.

How to Restore Quarantined Files Windows Defender on Windows 11

Files quarantined by Windows Defender will be removed from their original locations and stored in this path: C:\ProgramData\Microsoft\Windows Defender\Quarantine. You can only view or manage these files through the Windows Security Center.

In some cases, they may also be deleted, but you can recover the deleted files by Windows Defender. If you're certain a quarantined file isn't a threat, you can use the following three methods to restore the file from quarantine Windows Defender on Windows.

Method 1. Restore from Windows Security (GUI)

Windows Defender does not immediately delete the quarantined files. Instead, it moves them to a quarantine area, from which you can restore the files. Files will be remained for 30 days by default. The faster you restore the file, the greater the chance of successful recovery.

Step 1. Type "Windows Security" in the start menu and open it.

Step 2. Click "Virus & threat protection" and choose "Protection history" under the "Current threats".

Step 3. Look for the files you want restore choosing "Quarantined Items" by "Filters".

Step 4. Select the files and click "Actions" to choose "Restore".

Method 2. Using the MpCmdRun Command Line

MpCmdRun.exe is a built-in command-line tool for Microsoft Defender Antivirus, located in the %ProgramFiles%\Windows Defender directory. It provides advanced scanning, updating, diagnostic, and quarantined file management functions, suitable for administrators and advanced users. It’s particularly useful for advanced users or when automating tasks.

Step 1. Press Win+X and select "Terminal (Admin)" to open command prompt as administrator (For windows 10, you can locate "Command prompt" in the start menu and open it as administrator).

Step 2. Enter the following command and press "Enter":

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name

★Tips:

Relace the "Name" with your exact name of the quarantined file you want to restore (you can open Windows Security > Protection history to check it).

Method 3. Download or Collect Files (for IT administrator)

Microsoft Defender provides an advanced method called "Download or Collect Files," which allows administrators or users to download or collect quarantined files from the quarantine area for further analysis or recovery. This method is typically used for enterprise devices managed by Microsoft Defender for Endpoint (MDE), but similar functionality can also be achieved on local devices using PowerShell.

Selecting Download file from the response actions allows you to download your quarantined file. It will be downloaded to your local machine as a ".zip" archive or similar format, which can then be extracted for further analysis.

How to Recover Deleted Files by Windows Defender on Windows 11

If you encounter special circumstances where you cannot restore quarantined files in Windows Defender or the files have been deleted, you can also use professional data recovery software-MyRecover-to restore your files. It has no time restrictions on deleted files and is easy to operate without running complex command lines.

MyRecover excels at recovering data from various complex scenarios, such as formatted hard drives, inaccessible drives, deleted partitions, and system crashes. Quarantined files become inaccessible, but MyRecover can scan the disks on your computer to accurately locate lost files and recover them effectively. It has no time restrictions on deleted files and is easy to operate without running complex command lines.

Step 1. Download and install MyRecover on a different drive from the one containing the lost files on your computer.

Step 2. Launch it and select the drive to scan for the lost data.

Step 3. Choose the files you want recover and click "Recover" to restore them.

Step 4. Select a secure location to save the recovered files.

Once the process is finished, you can check the recovered files in the destination folder.

Summary

After reading this article, you should now understand how to restore files quarantined in Windows Defender on Windows11. If restoration fails or the file is deleted, MyRecover can also provide methods for data recovery. This ensures both your computer's security and your data's safety.

Since file name may become corrupted during the loss process, you can upgrade to the Professional or Technician Edition of MyRecover, which allows you to preview the file's contents before recovery to confirm if it is the file you wish to restore.