How to Restore Files Safely After Ransomware or a Virus

If a virus or ransomware has hit your computer, laptop, phone or tablet, the order you do things in decides whether you get your files back cleanly or bring the infection back with them. Disconnect the device from every network first, wired, wireless or mobile, then deal with the device itself, and only then restore your files from the last known good backup¹. The National Cyber Security Centre is blunt about the trade-off: you will lose any data that was not backed up, but trying to rescue data while the device is still infected risks carrying the infection through after wiping and reinstalling².

On a PC or laptop, run a full scan with your antivirus software and follow its instructions¹. If it cannot clean the device, you will have to wipe it entirely and reinstall everything, starting with the operating system, and you may need expert help to do that². On a phone or tablet, antivirus products do not work in the same way, and the safest solution is a factory reset, usually found in Settings².

Ransomware is a kind of malware that locks you out of your data or systems and only allows access once money is paid³. Paying is not a reliable way back: there is no guarantee that you will get access to your data or computer¹. The recovery route that works is a clean device plus a backup you trust.

Disconnect the infected device before you restore anything

The first instruction from the NCSC for a ransomware attack is to immediately disconnect the infected computers, laptops or tablets from all network connections, whether wired, wireless or mobile phone based¹. Do this before you open a backup, plug in a drive or start a scan. An infected machine that stays connected can spread to other devices on your home network and can reach your backups.

The same logic applies to the drives you keep your copies on. The NCSC warns that ransomware and other types of malware can move to attached media, which means your backup would also be infected, and advises disconnecting removable media when not in use⁵. If an external hard drive or USB stick was plugged in while the infection was active, treat it as suspect until you have checked it.

Once the device is off the network, work out what you are dealing with. In a ransomware attack you will not be able to access your device or the data stored on it because the files are encrypted¹. Other malware may leave the device working but compromised. Either way, the next step is the same: recover the device before you put any data back on it.

Recover the device first, following NCSC guidance

Recovery means getting the device back to a known clean state, not deleting a few suspicious files. The NCSC's sequence for an infected device starts with your antivirus: open it and run a full scan, then follow any instructions it gives⁶. For phones and tablets, the NCSC says the safest solution is a factory reset, usually found in Settings⁷.

What happens next depends on the device.

On a phone, the reset is usually in Settings and may be labelled "Erase all content"; the NCSC advises referring to the device manufacturer's website for the exact steps⁴. Before you reset, there is one rule that matters more than any other.

If you are unsure whether a reset is the right move for your phone, the guidance on whether to factory reset an infected phone sets out the cases. For the wider picture of what malware does and how it is removed, see malware on a computer or phone.

What can go wrong when restoring after ransomware

The restore itself is where most households undo their good work. The common failures are predictable.

• Restoring from a backup made after the infection started. Use the last known good backup, not the most recent one². If you are not sure when the infection began, go further back.
• Leaving the backup drive connected. Ransomware can move to attached media, so a drive that was plugged in during the attack may itself be encrypted or infected⁵.
• Trying to rescue files from the infected machine. The NCSC says this risks carrying the infection through after wiping and reinstalling². Accept the loss of anything not backed up.
• Assuming a synced folder is a backup. A backup is a copy of your important data stored in a separate safe location, usually cloud storage or removable media such as a USB stick, SD card or external hard drive⁵. A folder that mirrors your device in real time is not separate enough on its own.
• Paying and expecting everything back. There is no guarantee that you will get access to your data or computer¹, and a parliamentary committee reported in December 2023 that even if the ransom is paid, the victim may not regain access to all their files⁷.

Before you restore, check the backup contains what you need. The NCSC advises checking that it holds all your important data, such as recently taken photos or recently created files and folders⁵. Then restore onto the cleaned or rebuilt device, and only reconnect the network once the device is clean and updated.

Protect your accounts once your files are back

Getting your files back is only half the job. If malware was on the device, anything you logged into while it was there may have been exposed. The NCSC advises that if you have logged into any accounts or apps since installing the malware, you must change the password for that account, as it may have been stolen, and update any other accounts that used the same password⁴.

The full sequence for securing accounts is:

1. Change the password for any account that has been hacked, and also for any accounts that use the same password⁸.
2. Force all devices and apps to log out, usually from the Settings menus of the app or website, so anyone attempting to use the account is prompted to supply the new password⁸.
3. Set up 2-step verification (2SV), also known as two-factor authentication or 2FA, which usually works by sending a PIN or code, often via SMS or email, to prove it is really you⁸.
4. Check your email filters and forwarding rules, because cyber criminals set up forwarding rules to receive copies of all emails sent to your account, which could allow them to reset your passwords⁹.
5. Apply updates to your apps and device software as soon as they are available, as updates include protection from viruses⁸.

The NCSC calls turning on 2SV the first and most important step, because even if a criminal knows your password, they will not be able to access your accounts protected by it¹⁰. Set it up on all your important accounts, email, social media and the rest, even if you already have a strong password¹¹. If you use a password manager, switch on 2SV on that account too, so a criminal who knows the primary password still cannot get in¹⁰.

For step-by-step help, see how to turn on 2-step verification and which accounts to protect with 2-step verification. If an account itself has been taken over, the guidance on what to do if an online account is hacked covers recovery, and how to check for forwarding rules set by hackers deals with the email settings criminals leave behind.

Where to get help and report the attack

You do not have to work this out alone, and reporting helps others as well as you. If you have lost money, the NCSC advises telling your bank straight away and reporting it to Action Fraud, or in Scotland contacting Police Scotland⁷. Action Fraud is the UK's national reporting centre for fraud and cyber crime, and you should report fraud if you have been scammed, defrauded or experienced cyber crime¹². The same centre appears in NHS emergency planning guidance as the place to report cyber crime, with the note that Scotland is excepted¹³.

If the infection happened on a work laptop or phone, contact your IT department and tell them what has happened¹⁴. UK-based organisations that have experienced a cyber incident can report it at gov.uk/report-cyber¹⁵.

For households, the practical sources of help are:

• The NCSC's own recovery guidance, which covers infected devices, hacked accounts and data breaches, and is worth reading before you need it so you know what to do if you experience an incident¹⁶.
• Your bank, first and immediately, if money has gone⁷.
• Action Fraud for reporting fraud and cyber crime across the UK, or Police Scotland where you are in Scotland⁷.
• Microsoft 365, which publishes step-by-step guides for account recovery scenarios if that is the service you use¹⁶.

If you suspect one of your accounts has been fraudulently accessed, the NCSC refers you to its actions to take to recover a hacked account¹⁷. The signs include no longer being able to access your accounts, or activity you do not recognise such as changes to security settings or password reset messages¹⁶.

Once the device is clean and your accounts are secured, the priority shifts to making sure this is easier next time. A recent offline backup of your most important files and data is the single measure the NCSC's annual review singles out for ransomware¹⁸. Our guide to backing up files and photos at home explains how to set one up, and how to protect your backups from ransomware covers keeping it out of reach. For the wider context, start with ransomware: what it is and how it affects households and the after fixing an infected device checklist.