Manually Restoring Encrypted Files Parent topic

You may need to manually restore files encrypted by a ransomware threat if the Security Agent is unable to automatically restore the files for you. The Security Agent may be unable to restore encrypted files if the file becomes locked for any reason.

Procedure

  1. Open the backup file location on your endpoint.
    The Security Agent stores backed up files in the following folder:
    <Agent_installation_folder>\CCSF\module\DRE\data\Backup
  2. Locate the necessary file(s) based on the original file name(s).
    The Security Agent retains the original file name but changes the extension by appending a time stamp.
    For example, if the original file name was test_1.doc, the backed up file name may appear as test_1.doc00120160822074710336_2.
  3. Change the file extension back to the original file extension.
  4. Copy the file and replace the file in the original file location.
  5. Attempt to open the file and check that the content of the file is correct and viewable.