How to Recover Files Deleted by Windows Defender on Windows 10

The Windows 10 operating system comes with inbuilt antivirus protection called Windows Defender. This program defends your system against viruses and malware by scanning the data on your computer and removing any threats that can damage the system.

While it’s an important tool to safeguard your system, sometimes Windows Defender can delete harmless files if it identifies them as a threat.

How to Restore Files Deleted by Windows Defender

You can always attempt to restore files deleted by Windows Defender using methods on your computer. But we believe that the most reliable technique to get back the files removed by Windows Defender is to use professional data recovery software. Such tools are designed to thoroughly scan your device for deleted files and assist you in recovering them.

While various recovery tools are available on the market, we’ll follow the data recovery process using Disk Drill and Recuva in this article. They are amongst the top recovery tools in the industry and can effectively retrieve files removed by Windows Defender.

Option A: Disk Drill

Disk Drill is one of the leading data recovery solutions available to users. The software supports both Windows and macOS and comes packed with advanced features like data protection, byte-level backups, etc.

Follow these instructions for a step-by-step guide on recovering files deleted by Windows Defender using Disk Drill:

1. Download and Install Disk Drill from their official website.
2. Now, launch Disk Drill. Select the drive you wish to scan, then click All Recovery Methods to enable the algorithm to detect as many files as possible.
3. Choose Search for Lost Data to initiate the search. Note that you can pause, save or resume it whenever you wish. Disk Drill allows users to save search results and mount them as a disk.
4. Once the scan is complete, click Review Found Files to filter through the results.
5. Preview the files for recovery. You can do so by hovering your mouse over the eye button to the right of the file name. Disk Drill also indicates the success rate for recovery – low, average, or high.
6. Select your desired files and click Recover. Enter the recovery location and ensure that you’ve selected a different device or drive to restore the files deleted by Windows Defender. Finally, click Ok.

Option B: Recuva

Recuva by Piriform is a tried-and-tested data recovery solution that allows you to recover different data types like music, pictures, videos, and other important files in cases of a computer crash and even from damaged or formatted disks.

You can follow these steps to get back files deleted by Windows Defender using Recuva:

1. Download and Install Recuva, then launch the software on your computer.
2. Now, choose the general category of the files you wish to recover. You can either select the All Files for a broader search spectrum or the specific type of file you want the software to retrieve. Then, click Next.
3. In the next window, select the location from which you want to get back the files deleted by Windows Defender. Now, click Next again.
4. Recuva is now ready to scan your device for lost or deleted files. Tick the box beside Enable Deep Scan to retrieve deeply buried files. You can also hit the Switch to Advanced Mode button to filter through the results and find the exact files you’re looking for.
5. You can preview the files by clicking on them in the left window. Tick the checkboxes to select these files, then click Recover.
6. Now, select a location where you want to save the recovered files. Then, click OK.

How to Find Files Deleted by Windows Defender

Before you begin to recover deleted files, you must find files deleted by Windows Defender. If you don’t wish to get back files using data recovery software, you can use the methods outlined by Windows to find and recover deleted files:

Method 1: Restore Quarantined Files Using Windows Security

If you’ve turned on Microsoft Defender Antivirus and it is configured to detect and remediate threats on your computer system, Windows Defender will quarantine suspicious files. If you are absolutely sure that a quarantined file is not a threat, you can attempt to restore it.

Here’s how you can restore quarantined files using Windows Security on Windows 10:

1. Go to Search > Settings > Windows Security.
2. Select Virus & threat protection and then click Protection history.
3. In the list of All recent items, filter on Quarantined Items.
4. Select the item you wish to keep and take action, such as restoring it.

Method 2: Restore Quarantined Items With CMD

Another method to restore quarantined items is by using the Command Prompt. If you couldn’t find any quarantined items in Windows Security and are determined to get back the deleted file, run a command on CMD to restore the item deleted by Windows Defender.

Here’s how you can restore quarantined files with CMD on Windows 10:

1. Type cmd in the search box.
2. Right-click on Command Prompt from the list of results and select Run as Administrator.
3. In the CMD window, type the following command to navigate to the Windows Defender folder: cd C:\Program Files\Windows Defender
4. Type in the following command and hit Enter again to list all the quarantined items in your system. mpcmdrun -restore -listall
5. Now, type in the following command and press Enter to restore a quarantined item to its earlier destination successfully. MpCmdRun -Restore -Name ITEM-NAME Note: Remember to replace the “ITEM-NAME” with the name of the quarantined item you want to restore.

How to Stop Windows Defender from Quarantining Files?

While you can follow the methods mentioned above to restore files deleted by Windows Defender, there are ways for you to stop Windows Defender from deleting or quarantining files altogether. You can enable these settings or use these methods to prevent the deletion of some important files.

Let’s understand how to stop Windows Defender from deleting your files.

Method 1: Add Exclusions

You can add “exclusions” under Windows Security to prevent files with specific files, folders, or file types from being deleted by Windows Defender. These exclusions will stop your files from being deleted automatically if they’re perceived as threats.

Here’s how you can add Exclusions under Windows Security on Windows 10:

1. Go to Search > Settings > Windows Security > Virus & threat protection.
2. Now, go to Virus & threat protection settings and click Manage Settings.
3. Scroll down to Exclusions and click Add or remove exclusions.
4. Click + Add an Exclusion and select File, Folder, File Type, or Process to specify the exact files or file types you don’t want Windows Defender to delete.
5. Once you save the changes, all the files you’ve set as ‘Exclusions’ won’t be removed or deleted again.

Method 2: Disable Windows Defender Temporarily

Another way to stop Windows Defender from mistakenly quarantining a file is by temporarily disabling the Windows Defender. However, you can only disable it for a short while before it turns back on automatically.

Caution! – There is also a way to disable Windows Defender permanently, but we strongly recommend that you do not follow that path as it can make your system vulnerable to malware and virus attacks.

1. Go to Search > Settings > Windows Security > Virus & threat protection.
2. Now, go to Virus & threat protection settings and click Manage Settings.
3. Find Real-time protection and turn off the toggle switch under it.

FAQ

Conclusion

Windows Defender is an effective, built-in antivirus tool to protect your system against malware and virus threats. But sometimes, it can make mistakes and quarantine or delete harmless files.

You can recover these files using the methods mentioned in this article, including professional data recovery software to get back files removed by Windows Defender.