Manually Restoring Encrypted Files Parent topic

You may need to manually restore files encrypted by a ransomware threat if the OfficeScan agent is unable to automatically restore the files for you. The OfficeScan agent may be unable to restore encrypted files if the file becomes locked for any reason.

Procedure

  1. Open the backup file location on your endpoint.
    The OfficeScan agent stores backed up files in the following folder:
    <Agent_installation_folder>\CCSF\module\DRE\data\Backup
  2. Locate the necessary file(s) based on the original file name(s).
    The OfficeScan agent retains the original file name but changes the extension by appending a time stamp.
    For example, if the original file name was test_1.doc, the backed up file name may appear as test_1.doc00120160822074710336_2.
  3. Change the file extension back to the original file extension.
  4. Copy the file and replace the file in the original file location.
  5. Attempt to open the file and check that the content of the file is correct and viewable.