7 Ways to Restore Deleted Files on Windows Defender (Quarantine) 2023

In the fast-paced world of technology, security has become a paramount concern for individuals and organizations alike. To protect your Windows system from malware and other threats, Windows Defender has been a trusted choice for many users. One of its key features is the Quarantine, where potentially harmful files are isolated from your system. But what happens when a legitimate file gets falsely flagged and deleted? In this comprehensive guide, we’ll delve into the 7 ways to restore deleted files from Windows Defender Quarantine in 2023.

Table of Contents

1. Introduction
2. Why Files End Up in Windows Defender Quarantine
3. Method 1: Using Windows Defender Security Center
4. Method 2: PowerShell Command
5. Method 3: Using Group Policy
6. Method 4: Registry Editor
7. Method 5: Windows Security App
8. Method 6: Restore from Windows Defender History
9. Method 7: Third-party Recovery Tools
10. Frequently Asked Questions (FAQs)
11. Conclusion

Introduction

Windows Defender has come a long way since its inception and is now a robust security tool included in all Windows operating systems. However, there can be instances where it identifies legitimate files as potential threats and moves them to quarantine, leaving users perplexed. This guide aims to equip you with the knowledge of how to restore these deleted files from Windows Defender Quarantine in 2023.

Why Files End Up in Windows Defender Quarantine

Before we delve into the restoration methods, it’s essential to understand why Windows Defender moves files to quarantine in the first place. Windows Defender uses real-time protection and scans files as they are accessed. If it detects a file that exhibits suspicious behavior or is known to be malicious, it takes action. Sometimes, it may mistakenly categorize a legitimate file as a threat, leading to its quarantine.

Method 1: Using Windows Defender Security Center

The most straightforward method to restore files from Windows Defender Quarantine is through the Windows Defender Security Center. Follow these steps:

1. Open Windows Defender Security Center from your Start menu or taskbar.
2. Click on “Virus & threat protection.”
3. Under the “Current threats” section, you will see a list of quarantined items.
4. Select the file you want to restore and click “Restore.”

This method is suitable for users who prefer a user-friendly and built-in approach.

Method 2: PowerShell Command

For users who are comfortable with PowerShell, this method provides a more efficient way to restore files from the Windows Defender Quarantine. Here’s how:

1. Press the Windows + X keys and select “Windows PowerShell (Admin)” to open PowerShell with administrative privileges.
2. Use the following command to list all items in quarantine:

Get-MpThreat | Select-Object -Property Detection, Path, RemediationPath

3. Locate the file you want to restore and note its “RemediationPath.”
4. To restore the file, use the following command, replacing “C:\Path\To\File” with the actual file path:

Remove-MpThreat -RemediationPath "C:\Path\To\File"

This method is more suitable for advanced users comfortable with PowerShell commands.

Method 3: Using Group Policy

Group Policy provides a way to configure Windows Defender settings, including the handling of quarantined files. Follow these steps:

1. Press Windows + R, type “gpedit.msc,” and press Enter to open the Local Group Policy Editor.
2. Navigate to “Computer Configuration” > “Administrative Templates” > “Windows Defender Antivirus” > “Excluded items.”
3. Double-click on “Configure the ‘Low Risk Processes’ setting.”
4. Select “Enabled,” then click “Show” to specify the paths for quarantined files to restore.
5. Click “OK” to confirm the settings.

This method is particularly useful for IT administrators managing multiple systems.

Method 4: Registry Editor

The Windows Registry allows you to configure Windows Defender settings. Here’s how you can use it to restore quarantined files:

1. Press Windows + R, type “regedit,” and press Enter to open the Registry Editor.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine.
3. Look for the quarantined file in the list and delete its entry.
4. Close the Registry Editor.

Please exercise caution when editing the Windows Registry, as incorrect changes can affect your system’s stability.

Method 5: Windows Security App

The Windows Security app is another user-friendly way to restore files from Windows Defender Quarantine:

1. Open the Windows Security app from your Start menu.
2. Click on “Virus & threat protection.”
3. Scroll down to “Protection history.”
4. Here, you’ll find a list of detected items, including quarantined files.
5. Select the file you want to restore and click “Actions,” then choose “Restore.”

This method is suitable for users who prefer a graphical interface and do not want to venture into PowerShell or the Registry.

Method 6: Restore from Windows Defender History

Windows Defender maintains a history of all detected items, including quarantined files. You can use this history to restore files:

1. Open Windows Defender Security Center.
2. Click on “Virus & threat protection.”
3. Scroll down to “Protection history.”
4. Here, you’ll find a list of all detected items.
5. Select the file you want to restore and click “Actions,” then choose “Restore.”

This method is effective if you can’t locate the file in the quarantine but know that it was previously detected.

Method 7: Third-party Recovery Tools

If the above methods do not work, or if you need to recover files that have been permanently deleted from the quarantine, you can turn to third-party recovery tools. These tools are designed to retrieve lost or deleted files, and some are specifically tailored for Windows Defender Quarantine recovery.

Popular third-party recovery tools include EaseUS Data Recovery Wizard, Recuva, and MiniTool Power Data Recovery. Ensure you download from reputable sources and follow the tool’s instructions for recovery.

Frequently Asked Questions (FAQs)

Conclusion

In 2023, Windows Defender continues to be a reliable choice for protecting

your Windows system from threats. However, false positives and the quarantine of legitimate files can be a source of frustration for users. This guide has provided seven distinct methods for restoring deleted files from Windows Defender Quarantine, catering to users with varying levels of technical expertise. Whether you prefer a user-friendly interface, PowerShell commands, or third-party recovery tools, you now have the knowledge to retrieve your valuable files and maintain the security of your system.

Windows Defender, with its continuous updates and improvements, offers robust protection while occasionally presenting challenges. By following the methods outlined in this guide and taking preventive measures, you can navigate these challenges and ensure your system remains secure and your files easily recoverable.