Author Topic: Recover deleted files from Quarantine  (Read 1683 times)

0 Members and 1 Guest are viewing this topic.

Offline alex66556

  • Newbie
  • *
  • Posts: 5
Recover deleted files from Quarantine
« on: June 24, 2021, 11:19:05 AM »
Hello, I deleted files from Avast Quaratine, how can I recover that deleted files which were quarantined. Thank you.

Offline r@vast

  • Avast team
  • Massive Poster
  • *
  • Posts: 2761
Re: Recover deleted files from Quarantine
« Reply #1 on: June 24, 2021, 12:36:17 PM »
Hi,

It is, unfortunately, not possible to do so using Avast.

Offline alex66556

  • Newbie
  • *
  • Posts: 5
Re: Recover deleted files from Quarantine
« Reply #2 on: June 24, 2021, 05:34:21 PM »
So is gone forever? :(

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Recover deleted files from Quarantine
« Reply #3 on: June 24, 2021, 05:47:58 PM »
So is gone forever? :(

Afraid so, there should never be a rush to delete items in the virus chest (unless you have huge numbers and space is a issue) as they can do no harm there and you have a chance to restore them (via the Avast Virus Chest) in the future.

Even if you were to use a recovery program to recover deleted files before they are overwritten it is likely to fail. 

Files sent to the virus chest are protected whilst in the virus chest.  The actual file name is changed if viewed outside of the virus chest and the files are also encrypted. 
So even if by chance one such remnant were found, 1. I don't know how you would determine what it was and 2. Given it was encrypted, decryption without the encryption method/key would be almost impossible.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline alex66556

  • Newbie
  • *
  • Posts: 5
Re: Recover deleted files from Quarantine
« Reply #4 on: June 24, 2021, 05:57:46 PM »
Thank you for your answer. Where are located those files? I mean, where was ... Maybe if I try to recover and put it back, maybe I will be able to see in Avast Quarantine again?

Offline alex66556

  • Newbie
  • *
  • Posts: 5
Re: Recover deleted files from Quarantine
« Reply #5 on: June 24, 2021, 06:42:21 PM »
And at least can I see a log with what files was inside Quaratine? Thanks

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Recover deleted files from Quarantine
« Reply #6 on: June 24, 2021, 07:13:15 PM »
Thank you for your answer. Where are located those files? I mean, where was ... Maybe if I try to recover and put it back, maybe I will be able to see in Avast Quarantine again?

I'm afraid even that would be of little help but her it is - C:\ProgramData\AVAST Software\Avast\chest
As mentioned the file names would have been changed and the files encrypted.

Even if you somehow managed to overcome those hurdles, the Virus Chest for obvious reasons is is protected so you couldn't just place them there.

And at least can I see a log with what files was inside Quaratine? Thanks

The only logs would be contained in the detection reports depending on how they were detected (e.g. what shield or scan made the detections).
C:\ProgramData\AVAST Software\Avast\report

I know this isn't what you want to hear, but that is effectively what r@vast said, but in more detail.

Hi,

It is, unfortunately, not possible to do so using Avast.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline alex66556

  • Newbie
  • *
  • Posts: 5
Re: Recover deleted files from Quarantine
« Reply #7 on: June 27, 2021, 03:52:46 PM »
Hello again, thanks for reply, in that logs I can`t find all files, to try to know and understand why and what Avast deleted files with false positive virus. I succeded recovered some encripted files from chest file. Maybe I will be able to put it back somehow :)

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Recover deleted files from Quarantine
« Reply #8 on: June 27, 2021, 09:53:53 PM »
Hello again, thanks for reply, in that logs I can`t find all files, to try to know and understand why and what Avast deleted files with false positive virus. I succeded recovered some encripted files from chest file. Maybe I will be able to put it back somehow :)

As I mentioned.
Quote from: DavidR
Even if you somehow managed to overcome those hurdles, the Virus Chest for obvious reasons is is protected so you couldn't just place them there.

I don't know:
1.  How you recovered them and how successful that might have been.
2.  How you know they came from the virus chest.

If you know what these files/programs, etc., that were sent to the chest, I would have thought it might be easier to find copies of the original (program, version and file name) from an unencrypted source.

So you couldn't simply place files there and subsequently simply extract them as the current virus chest has no information in relation to them, having previously deleted them.  The original file information name and location and I don't know about decryption, again by not having any previous information on the initial encryption.

I'm afraid it is a case of delete in haste repent at leisure, I don't recommend deleting files in the chest as they can do no harm there and can be subsequently restored if it proves to be a false positive.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security