If you need to back up files from an infected Windows PC, keep your last good backup disconnected. From a clean device, check which photos, documents and projects you already have. Rescue only the missing files to a separate drive, scan a working copy, and check that you can actually read it before erasing Windows.
Suppose your offline backup contains last term’s schoolwork, but the only copy of this term’s thesis is on the laptop. Leave that backup where it is. The job is to recover the thesis and its source material. The old browser profile, Office installer and everything else you can download again can stay behind.
First decide whether to touch the disk
If files are changing names, gaining unfamiliar extensions or becoming unreadable while you watch, stop. Disconnect Ethernet and Wi-Fi. Leave USB drives and network shares disconnected. An infection that can still write to files could damage the copy you attach. For a work or school device, call IT from another device before copying, restarting or wiping anything. On a home PC with the only copy of important files, seek recovery help before experimenting.
On a clean device, check the dates and contents of any older offline backup or cloud version history. A sync service may already have copied damaged files. Download a known-good earlier version to a separate location and leave sync paused on the affected machine. If a readable copy contains everything you need, you can skip rescuing files from the suspect disk.
Choose what goes on the rescue drive
- Copy the files you made and cannot replace. Start with camera originals, family videos, plain-text notes, school papers and project source material. Choose recognizable files from named folders. A familiar extension helps sort them, but cannot establish that the contents are safe.
- Set aside files that can do more than display data. A spreadsheet ending in
.xlsmcan contain macros. An archive can contain both your thesis and the installer that started the incident. Keep irreplaceable items like these in a separate “Review later” folder. If an archive is password-protected, a scanner may be unable to inspect its contents until it is unlocked. - Download replaceable software afresh. Leave behind installers, shortcuts, scripts you did not write, unknown downloads, browser extensions and entire application profiles. Install the applications from their official sources on the rebuilt machine. If you need a unique project database or game save, identify that specific data file instead of restoring the whole profile.
For example, copy Thesis.docx and the photos used in it. Set aside Survey-results.xlsm for review. Leave OfficeSetup.exe behind. Turn on file-name extensions in File Explorer so that a shortcut or executable with a name like Thesis.docx.exe is visible for what it is.
Copy without starting the infected Windows installation
- Prepare a dedicated empty rescue drive. Keep it separate from both your regular backup drive and any USB used to install Windows. Creating installation media can erase the selected USB.
- Have the PC read the suspect disk from a trusted recovery environment prepared on a clean machine. Keep the source read-only when the environment supports it. If you cannot confidently identify the source and destination, ask a technician to copy the specified folders without starting Windows from that disk. A BitLocker-encrypted volume may require its recovery key. Obtain it privately from your account or IT before wiping anything.
- Copy the selected folders without launching files or installers. Preserve folder names and note what you copied, any read errors and any folders you could not unlock. Disconnect and label the rescue drive. A whole-disk image can preserve material for professional recovery, but restoring the suspect operating system from that image would also restore its software and settings.
Scan the copy, then check what you actually recovered
Use a clean, updated PC with active antivirus protection. Disable AutoPlay for removable drives and avoid Explorer’s preview pane while sorting unreviewed files. Keep the rescue copy intact and place a working copy in a separate local folder outside your synced folders.
When Microsoft Defender Antivirus is the active provider, right-click the working folder, choose Show more options if necessary, then Scan with Microsoft Defender. With another antivirus provider, use its folder scan. Check the result before opening anything. If a file is flagged, record its name and detection, let protection quarantine the working copy, and look for an earlier version. Leave exclusions and protection settings alone.
Even after a scan finds nothing, open familiar documents with updated applications and leave active content disabled. If a workbook shows its numbers but a button asks you to enable a macro, you can stop there and recover the values you need. Get an independently verified copy of any essential macro before trusting its code. For an archive you must retain, inspect and scan its extracted contents separately before opening them.
Before you wipe: compare the folder list, file counts and sizes with your notes. Open a few scanned photos at full size and check the final pages of important documents, especially the newest version of your work. A successful copy or a clean scan does not tell you whether a ransomware-damaged file is readable. If a critical file is missing, encrypted or corrupt, keep the original disk intact and reconsider recovery before proceeding.
Restore personal files in small batches
Once you have verified the rescue, decide whether a factory reset is sufficient or prepare a clean Windows installation USB. Update Windows and your applications, confirm protection is active, then restore the checked files one folder at a time. Reconnect sync only after you have checked which versions it will bring back.
If an alert returns immediately after one batch, stop there and note the file path and detection time. If the warning persists even with the rescue drive disconnected, check recently installed software and synced extensions. A separate scan with Gridinsoft Anti-Malware can help check for active malware or unwanted software on the rebuilt PC. Keep the independent backup until your most important files have been opened and verified.
References
- Cybersecurity and Infrastructure Security Agency and partners. #StopRansomware Guide. Containment and recovery checklist. Accessed November 10, 2026.
- Microsoft. Scan an item with Windows Security. Microsoft Support. Accessed November 10, 2026.
- Microsoft. Enable or disable macros in Microsoft 365 files. Microsoft Support. Accessed November 10, 2026.
