How to recover
Files Using Volume Shadow Copies
from Windows

Hello, I accidentally lost all of my files due to ransomware attack. The malicious virus encrypted all of my files and I can no longer open them. I heard that Windows computers provide Volume Shadow Copy service that allows recovering previous versions of data, but I am not sure how to use this service. Can you provide a tutorial on how to recover encrypted files using Volume Shadow Copies?

Volume Shadow Copy is a technology presented by Microsoft Windows, and it allows creating automatic or manual data backups every once in a while. This feature takes snapshots of current state of files and saves them (even the files are in use). Shadow copies can be formed on local or external volumes.

These copies usually come in handy when the user unexpectedly loses or corrupts some data stored on its computer. This feature is extremely useful when dealing with a ransomware attack - it can help to restore damaged files with ease in case the victim has no physical backup stored on an external data storage device such as DVD or USB. This feature doesn’t only help to restore files corrupted by ransomware, but also allows recovering a previously saved game point, accidentally overwritten file, and so on. The guide given below explains how to recover files and folders using Volume Shadow Copies.

Easy Ways to Recover Files Using Volume Shadow Copies

Recover overwritten or encrypted files using Volume Shadow Copies

First of all, go to the folder that contains the file that you want to restore.
Locate the file that you want to recover and right-click it. Choose Properties and then go to Previous Versions tab.
In the list of available options, find the preferable variant of the file that you want to restore. Use “Date Modified” section for guidance. Once you decide which version you’d prefer to recover, click on it and select either Copy… or Restore… option. The first option allows copying the desired file version to a specified location, and the second option just overwrites the existing file copy.
TIP: We recommend choosing the Copy… option because once you overwrite an existing file copy, the change cannot be undone.

Recover a deleted file

1. Find the folder that stored the file that was deleted.
2. Right-click on the folder and select Restore Previous Versions.
3. Find the file that you want to recover, select it and hit Restore…
4. Click OK and then OK again.

Recover a deleted folder

1. Right-click on a blank space in the folder that has to be recovered. Go to Properties > Previous Versions.
2. Select the preferred version of folder and click Copy… or Restore… We suggest choosing the Copy… option as this way you can test if the selected version is the one that you need.
3. Simply choose the location to save the copy and click Copy.

Alternative method: Recover files or folders using ShadowExplorer software

Shadow Explorer is an excellent tool that is meant to identify and restore files using Volume Shadow Copies automatically. You can download ShadowExplorer here.

1. Install the program by following steps provided by Shadow Explorer Setup Wizard.
2. Launch the program and then choose the location that contained the file/folder that you want to recover.
3. Choose the preferred date when the Shadow Volume Copies were created, and then find the folder/file you want to recover.
4. Right-click it and select Export… Again, choose the location to transfer the file to and click OK.