Recover Files Deleted by Windows Defender

How to Recover Files Deleted by Windows Defender on Windows 10

Last updated:

No robots used, our articles are crafted by humans under strict Editorial Guidelines.

Written by Joshua Solomon Joshua Solomon Contributing Writer • 53 articles Joshua Solomon, formerly a staff writer and now a contributing writer for Handy Recovery, has authored numerous articles on our site about data loss and recovery concerning Windows and external devices. LinkedIn Approved by Andrey Vasilyev Andrey Vasilyev Editor Andrey Vasilyev is an Editorial Advisor for Handy Recovery. Andrey is a software engineer expert with extensive expertise in data recovery, computer forensics, and data litigation. Andrey brings over 12 years of experience in software development, database administration, and hardware repair to the team. LinkedIn

The Windows 10 operating system comes with inbuilt antivirus protection called Windows Defender. This program defends your system against viruses and malware by scanning the data on your computer and removing any threats that can damage the system.

While it’s an important tool to safeguard your system, sometimes Windows Defender can delete harmless files if it identifies them as a threat.

🗨️

If Windows Defender has deleted your important data, fret not. This article gives a detailed insight into how you can recover files deleted by Windows Defender and how to avoid such a situation altogether.

How to Restore Files Deleted by Windows Defender

You can always attempt to restore files deleted by Windows Defender using methods on your computer. But we believe that the most reliable technique to get back the files removed by Windows Defender is to use professional data recovery software. Such tools are designed to thoroughly scan your device for deleted files and assist you in recovering them.

⚠️

Software solutions are great if you need to recover files your know was permanently deleted by Windows Defender. However, your file in question might be quarantined by the system and not be technically deleted yet. Read on to learn more.

While various recovery tools are available on the market, we’ll follow the data recovery process using Disk Drill and Recuva in this article. They are amongst the top recovery tools in the industry and can effectively retrieve files removed by Windows Defender.

👀

Note that you can also use professional data recovery tools in various data loss situations, such as to recover deleted items from the Recycle Bin. It’s also interesting to note that Windows Defender usually flags browser downloads as malware and deletes them. In such scenarios, data recovery tools can help retrieve your deleted downloads.

Option A: Disk Drill

Disk Drill logoDisk Drill is one of the leading data recovery solutions available to users. The software supports both Windows and macOS and comes packed with advanced features like data protection, byte-level backups, etc.

Windows Defender has a knack of quarantining and eliminating browser downloads: especially .exe files and archives. Disk Drill is your go-to solution for recovering such deleted Windows Defender files. Moreover, the tool not only recovers deleted files on Windows 10, but you can also use it to retrieve various file types, including audio, videos, images, documents, and archives lost due to storage corruption, accidental deletion, or drive formatting. Also, Disk Drill allows users to recover up to 500MB for free!

Follow these instructions for a step-by-step guide on recovering files deleted by Windows Defender using Disk Drill:

  1. Download and Install Disk Drill from their official website.
  2. Now, launch Disk Drill. Select the drive you wish to scan, then click All Recovery Methods to enable the algorithm to detect as many files as possible. selecting disk for scanning
  3. Choose Search for Lost Data to initiate the search. Note that you can pause, save or resume it whenever you wish. Disk Drill allows users to save search results and mount them as a disk. reviewing the scanned files
  4. Once the scan is complete, click Review Found Files to filter through the results.
  5. Preview the files for recovery. You can do so by hovering your mouse over the eye button to the right of the file name. Disk Drill also indicates the success rate for recovery – low, average, or high. selecting files for data recovery
  6. Select your desired files and click Recover. Enter the recovery location and ensure that you’ve selected a different device or drive to restore the files deleted by Windows Defender. Finally, click Ok. selecting the destination for saving the recovered files
🔗

Take a look at our comprehensive review of Disk Drill to learn more about the software and its premium features like advanced file recovery and data protection.

Option B: Recuva

Recuva logoRecuva by Piriform is a tried-and-tested data recovery solution that allows you to recover different data types like music, pictures, videos, and other important files in cases of a computer crash and even from damaged or formatted disks.

It is a fast, lightweight software solution available for free download on Windows. While the free version offers most of its advanced features, Recuva also has a pretty budget-friendly professional version.

You can follow these steps to get back files deleted by Windows Defender using Recuva:

  1. Download and Install Recuva, then launch the software on your computer. installing recuva
  2. Now, choose the general category of the files you wish to recover. You can either select the All Files for a broader search spectrum or the specific type of file you want the software to retrieve. Then, click Next. selecting the file type for scanning
  3. In the next window, select the location from which you want to get back the files deleted by Windows Defender. Now, click Next again. selecting the drive for data recovery
  4. Recuva is now ready to scan your device for lost or deleted files. Tick the box beside Enable Deep Scan to retrieve deeply buried files. You can also hit the Switch to Advanced Mode button to filter through the results and find the exact files you’re looking for. enabling deep scan on recuva
  5. You can preview the files by clicking on them in the left window. Tick the checkboxes to select these files, then click Recover. selecting files for data recovery
  6. Now, select a location where you want to save the recovered files. Then, click OK. selecting destination for saving files
🔗

For an in-depth analysis of Recuva and its many fascinating features, go through our full review of data recovery using the Recuva software.

How to Find Files Deleted by Windows Defender

Before you begin to recover deleted files, you must find files deleted by Windows Defender. If you don’t wish to get back files using data recovery software, you can use the methods outlined by Windows to find and recover deleted files:

Method 1: Restore Quarantined Files Using Windows Security

If you’ve turned on Microsoft Defender Antivirus and it is configured to detect and remediate threats on your computer system, Windows Defender will quarantine suspicious files. If you are absolutely sure that a quarantined file is not a threat, you can attempt to restore it.

❗️

Beware! – Windows Defender does not always delete or quarantine files by mistake. In most cases, the deleted files can actually be harmful to your device. Thus, ensure that you are confident that a quarantined file is safe before restoring it.

Here’s how you can restore quarantined files using Windows Security on Windows 10:

  1. Go to Search > Settings > Windows Security.
  2. Select Virus & threat protection and then click Protection history. virus and threat protection settings
  3. In the list of All recent items, filter on Quarantined Items.
  4. Select the item you wish to keep and take action, such as restoring it.
👀

If the detected item list is empty, it’s likely that Windows Defender has already removed the quarantined items. In such a situation, you can turn to another method to restore files removed by Windows Defender.

Method 2: Restore Quarantined Items With CMD

Another method to restore quarantined items is by using the Command Prompt. If you couldn’t find any quarantined items in Windows Security and are determined to get back the deleted file, run a command on CMD to restore the item deleted by Windows Defender.

Here’s how you can restore quarantined files with CMD on Windows 10:

  1. Type cmd in the search box.
  2. Right-click on Command Prompt from the list of results and select Run as Administrator.
  3. In the CMD window, type the following command to navigate to the Windows Defender folder: cd C:\Program Files\Windows Defender cmd command for restoring quarantined files
  4. Type in the following command and hit Enter again to list all the quarantined items in your system. mpcmdrun -restore -listall
  5. Now, type in the following command and press Enter to restore a quarantined item to its earlier destination successfully. MpCmdRun -Restore -Name ITEM-NAME Note: Remember to replace the “ITEM-NAME” with the name of the quarantined item you want to restore.

Insight: You can follow the same steps to recover deleted files on Windows 11 – be it due to accidental deletion or deletion by Windows Defender.

How to Stop Windows Defender from Quarantining Files?

While you can follow the methods mentioned above to restore files deleted by Windows Defender, there are ways for you to stop Windows Defender from deleting or quarantining files altogether. You can enable these settings or use these methods to prevent the deletion of some important files.

Let’s understand how to stop Windows Defender from deleting your files.

Method 1: Add Exclusions

You can add “exclusions” under Windows Security to prevent files with specific files, folders, or file types from being deleted by Windows Defender. These exclusions will stop your files from being deleted automatically if they’re perceived as threats.

Here’s how you can add Exclusions under Windows Security on Windows 10:

  1. Go to Search > Settings > Windows Security > Virus & threat protection.
  2. Now, go to Virus & threat protection settings and click Manage Settings.
  3. Scroll down to Exclusions and click Add or remove exclusions. applying exclusions in windows defender
  4. Click + Add an Exclusion and select File, Folder, File Type, or Process to specify the exact files or file types you don’t want Windows Defender to delete. adding file type exclusions
  5. Once you save the changes, all the files you’ve set as ‘Exclusions’ won’t be removed or deleted again.

Method 2: Disable Windows Defender Temporarily

Another way to stop Windows Defender from mistakenly quarantining a file is by temporarily disabling the Windows Defender. However, you can only disable it for a short while before it turns back on automatically.

Caution! – There is also a way to disable Windows Defender permanently, but we strongly recommend that you do not follow that path as it can make your system vulnerable to malware and virus attacks.

  1. Go to Search > Settings > Windows Security > Virus & threat protection.
  2. Now, go to Virus & threat protection settings and click Manage Settings.
  3. Find Real-time protection and turn off the toggle switch under it. enabling real time protection in windows security

FAQ

How to get back files deleted by Windows Defender?

Using data recovery software like Disk Drill, you can effortlessly get back files deleted by Windows Defender. Just follow these steps:

  1. Download and Install Disk Drill.
  2. Click Search for Lost Data to begin the scan.
  3. Preview the files you want to recover.
  4. Click Recover to restore your data and choose a recovery location.

Where does Windows Defender quarantine files?

Before deleting any suspicious file, Windows Defender always places it in quarantine. By default, the

Before deleting any suspicious file, Windows Defender always places it in quarantine. These files are stored in a secure folder to stop them from being used. You can navigate to quarantined files by following these steps:

  1. Go to Search > Settings > Windows Security.
  2. Select Virus & threat protection and then click Protection history.
  3. In the list of All recent items, filter on Quarantined Items.

However, we recommend you to interact with these quarantined files only through antivirus software to protect your system against threats. 

Why can't I restore quarantined files from Windows Defender?

If you cannot restore quarantined files from Windows Defender, perhaps it has already removed the quarantined items. In such a situation, you can turn to the CMD method to restore files removed by Windows Defender. Just follow these steps:

  1. Type cmd in the search box.
  2. Right-click on Command Prompt from the list of results and select Run as Administrator.
  3. In the CMD window, type the following command to navigate to the Windows Defender folder: cd C:\Program Files\Windows Defender
  4. Enter the following command to list all the quarantined items in your system. mpcmdrun -restore -listall
  5. Now, type in the following command and press Enter to restore a quarantined item to its earlier destination successfully. MpcmdRun -Restore -Name ITEM-NAME Note: Remember to replace the “ITEM-NAME” with the name of the quarantined item you want to restore.

How to remove quarantined threats in Windows Defender?

When an item is placed in Quarantine by Windows Defender, your system is protected. These quarantine items are stored in the Windows Defender quarantine folder location and will be removed automatically after a while. However, you may permanently delete your threats manually by following these steps:

  1. Go to Search > Settings > Windows Security.
  2. Select Virus & threat protection and then click Protection history.
  3. In the list of All recent items, filter on Quarantined Items.
  4. Select your files then click remove.

Conclusion

Windows Defender is an effective, built-in antivirus tool to protect your system against malware and virus threats. But sometimes, it can make mistakes and quarantine or delete harmless files.

You can recover these files using the methods mentioned in this article, including professional data recovery software to get back files removed by Windows Defender.

About article
Contributing Writer Joshua Solomon

This article was written by Joshua Solomon, a Contributing Writer at Handy Recovery Advisor. It was also verified for technical accuracy by Andrey Vasilyev, our editorial advisor.

Curious about our content creation process? Take a look at our Editor Guidelines.

How do you rate the article? Submitted: