Can I restore data deleted by Kaspersky antivirus?
Solved Email & Outlook
MS
Michael Scofield
April 9, 2020
2 replies
8,940 views
Reviewed by moderators

Kaspersky flagged and removed a file I actually needed, a work document it mistook for a threat. Is it gone or is there a way back?

It happened a few hours ago and I have not done much since.

Accepted Answer
Verified by Kerry Morris, Forum Moderator ยท Reviewed April 2020

Good news that you asked quickly, because antivirus rarely destroys outright, it quarantines and the not much since matters for the fallback if quarantine fails. In order of likelihood:

The quarantine, where it almost certainly is: Kaspersky moves suspected threats to a quarantine or backup area rather than deleting them, exactly so mistakes are reversible. Open Kaspersky, find Quarantine or the threats detection report, More Tools and Quarantine in most versions, locate your file in the list and Restore it. The file returns to its original location, and you then add it to exclusions so Kaspersky stops flagging it. This recovers the great majority of antivirus false positives, the feature existing for your exact situation.

The restore with exclusion, so it does not repeat: after restoring, add the file or its folder to Kaspersky's trusted exclusions, Settings, Threats and Exclusions or the file gets requarantined on the next scan, the frustrating loop when people restore without excluding.

If quarantine truly does not hold it, the deleted file fallback: a file genuinely deleted rather than quarantined follows normal deletion recovery, check the Recycle Bin first, then file recovery tools like Recuva or PhotoRec scanning for the deleted file, most effective the sooner you run them since continued disk use overwrites deleted data. Your not much since is exactly right, minimize writing to that drive until recovered.

The prevention going forward: a genuine false positive on a known good file deserves reporting to Kaspersky so their detection improves, and important work documents deserve a backup that antivirus quarantine cannot touch, since the real lesson of a needed file vanishing is that one copy in one place is one antivirus mistake from a bad afternoon.

It was in Quarantine exactly as you said, restored it in seconds and added it to exclusions so it stayed put this time. I had restored it once before without excluding and it vanished again, which the loop warning explained. Reported the false positive too. Relief.