How to Restore Quarantined Files in Windows 10

Windows Defender is an anti-malware component of every Microsoft operating system starting with Windows XP. It’s a built-in, convenient way to protect your files from being infected and your data from being stolen. Also, by reporting or encountering malicious files, you’re helping update Microsoft’s virus database. However, not all detected files are malicious and false positives are common. That’s why quarantine exists, allowing you to prevent a file from wreaking havoc but remain accessible if it turns out to be harmless. That’s our topic for the day. Here’s how to restore quarantined files in Windows 10.

1. Restore quarantined files in Windows 10 via Protection History

We’ll start with the built-in functionality, and how Microsoft intended you to do it. Follow these steps to recover Windows 10 quarantined files using Protection History:

1. Open the Start menu.
2. Click on Settings (cogwheel icon in the left sidebar).
3. Select Update & Security.
4. Select Windows Security in the left sidebar.
5. Click on Virus & threat protection.
6. Click on Protection history under Current threats.
7. Now, browse the list of All recent items.
8. Click on the file you want to restore.
9. Select Restore, and the file will be returned to its original location.
10. Tip. You can also click on See full history to see all quarantined files.

2. Restoring quarantined files in Windows 10 via Command Prompt

The method above is convenient for restoring recent files. But what if there are multiple (or all) files that are quarantined, and you know they’re safe? Also, what about a file whose name you know, but are too lazy to scroll and search for? The following method to restore quarantined files in Windows 10 solves those problems:

1. Open the Start menu and start typing “command prompt”.
2. When Command Prompt gets highlighted, click on Run as administrator.
3. Once the window opens, enter this before pressing Enter:
   cd “%ProgramFiles%\Windows Defender”

Now, you can run one of the following commands:

• MpCmdRun.exe -restore -listall | List all quarantined files.
• MpCmdRun.exe -restore -all | Restore all quarantined files. Useful, but potentially
• dangerous.
• MpCmdRun.exe -restore -name “Filename” | Exchange Filename with the actual name of the file, including extensions, but without removing quotation marks.
• MpCmdRun.exe -restore -name virus-name | Use the detected virus name instead of the file name, for example, “MpCmdRun.exe -restore -name Trojan:Win32/Peals.F!cl)”
• MpCmdRun.exe -? or -h | displays all available options, including those for defining a file path for restoration, checking file paths that are excluded, etc.

3. Access the Quarantine folder in Windows Explorer

The technique above works for most users. But there’s a decent portion that’s afraid of executing commands. To help that part of the Windows user base, we present a simple, beginner-friendly option. First, make sure you can see hidden files and folders. To do that, follow instructions in our Pen drive file recovery guide, specifically those under a headline titled Recovering hidden files using Windows File Explorer Options. Finished? Good. Open Windows Explorer, and paste this into the address bar:

C:\ProgramData\Microsoft\Windows Defender\Quarantine

You can now see all of the files in the quarantine, and drag-and-drop them individually or all at once.

4. Windows 10 quarantined files recovery via third-party software

Whether you clicked on Remove instead of Restore in the first method or previously deleted them by accident, it’s a fact that quarantined files can go missing. No worries, though. We outlined a few methods to get them back in our “recover a deleted folder in Windows 10” guide. You can also use a Windows data recovery software of your choice, and input the scan to the file path mentioned above to save on time.