Windows Defender proactively blocks threats. It doesn’t limit itself to scanning executable or scripts. It will scan all types of files including archives, images, documents, spreadsheets, and more. The antivirus doesn’t really ask users if they want to scan a particular file or directory. Any time it detects new files, it will scan them and it will automatically delete anything that it deems malicious. The only problem is, it gets false-positives and deletes files that are safe.
Recover file from Windows Defender
In order to recover a file deleted by Windows Defender, you will need admin right. You will also need a file recovery app.
Note: Do NOT recover a file unless you know for a fact that it is safe.
1. Allow file in Windows Defender
Before you can recover a file deleted by Windows Defender, you need to mark it safe for your system.
- Open Windows Defender.
- Go to the Virus and threat protection tab.
- Click ‘Protection History’.
- You will see a list of all files that Windows Defender has blocked.
- Click the dropdown next to the file you want to recover.
- Select Allow.
2. Recover deleted file
Once you allow the file on your system, you can recover it. A recovery app is needed and you can use any app of your choice but for a quick and free solution, use the Windows File Recovery app.
- Install the Windows File Recovery app from the Microsoft Store.
- Open Command Prompt with admin rights.
- Run the following command after modifying the paths.
- Source-drive should be replaced with the drive the file was deleted from.
- Destination-folder should be replaced with where the restored file should be saved and it should NOT be on the same drive that you’re recovering the file from.
- .file-extension should be replaced with the actual extension of the file you’re trying to recover.
- Do not edit ‘/n’.
winfr source-drive: destination-folder /n *.file-extension
winfr C: "D:\Recovered File" /n *.docx
- Tap the ‘y’ key when the app asks for confirmation.
- Once the command has run, open the Destination Folder in File Explorer and the file should be there.
File recovery should be done as soon as you realize a file has been deleted or removed. It is generally not a good idea to allow your system to shut down and power up again between the deletion and recovery. You may still be able to recover a file after multiple restarts but it may be corrupted. There are paid apps that may perform better if you’ve already restarted your system several times but there aren’t any guarantees.