Restoring encrypted files after CryptoLocker Ransomware infection
NEWS ADVISORY:Learn how Trend Micro protects you against the latest WCRY (WannaCry) Ransomware Attack. Click here.
This article shows you how to retrieve the files that were encrypted by the CryptoLocker Ransomware.
For more information about ransomware, refer to our Threat Encyclopedia: Ransomware.
Recover a deleted file or folder
- Open the directory where the file is located.
- Right-click in the directory, then select Properties.
- The Properties window will appear, click the Previous Versions tab.
- A list of available snapshots for the file or folder will appear. Select the snapshot with the last known good copy of your file or directory, then click View.
- A new window displaying the content of the snapshot will appear.
- Locate the file or folder that you wish to restore.
- Do either of the following:
- Open the file and save it to the correct location.
- If you have multiple files or a folder, drag the files or folders to their correct locations.
Restore a Previous Version of the File (or Folder)
BEFORE YOU PROCEED:
Restoring the file will overwrite the current copy. Any data saved in the current copy will be overwritten with the older file.
- Locate the directory where the file is stored.
- Right-click the file, then select Properties.
- Click the Previous Versions tab when the Properties window opens.
If you don't see the Previous Versions tab, you need to install the client.
You can speak with your support team to get the correct client installed.
- A list of available snapshots for the file will appear.
- Select the snapshot that represents the last known good version of the file.
- Click View and verify if it is the correct version of the file.
- Once you find the correct file, do any of the following:
- View: View the recovered file directly and then save it by clicking File > Save As.
- Copy: Create a copy of the recovered file in the same directory as the original file. You will now have both copies available.
- Restore: This will restore the recovered file and will replace the current file.
Last Updated: Sep. 15, 2017 6:02 PM (PST)
Solution ID: 1099221