Recover deleted files from Quarantine

[alex66556]

Hello, I deleted files from Avast Quaratine, how can I recover that deleted files which were quarantined. Thank you.

[avastuser3249]

Hi,

It is, unfortunately, not possible to do so using Avast.

[alex66556]

So is gone forever?

[DavidR]

@alex66556 post:3

So is gone forever?

Afraid so, there should never be a rush to delete items in the virus chest (unless you have huge numbers and space is a issue) as they can do no harm there and you have a chance to restore them (via the Avast Virus Chest) in the future.

Even if you were to use a recovery program to recover deleted files before they are overwritten it is likely to fail.

Files sent to the virus chest are protected whilst in the virus chest. The actual file name is changed if viewed outside of the virus chest and the files are also encrypted.
So even if by chance one such remnant were found, 1. I don’t know how you would determine what it was and 2. Given it was encrypted, decryption without the encryption method/key would be almost impossible.

[alex66556]

Thank you for your answer. Where are located those files? I mean, where was … Maybe if I try to recover and put it back, maybe I will be able to see in Avast Quarantine again?

[alex66556]

And at least can I see a log with what files was inside Quaratine? Thanks

[DavidR]

@alex66556 post:5

Thank you for your answer. Where are located those files? I mean, where was … Maybe if I try to recover and put it back, maybe I will be able to see in Avast Quarantine again?

I’m afraid even that would be of little help but her it is - C:\ProgramData\AVAST Software\Avast\chest
As mentioned the file names would have been changed and the files encrypted.

Even if you somehow managed to overcome those hurdles, the Virus Chest for obvious reasons is is protected so you couldn’t just place them there.

@alex66556 post:6

And at least can I see a log with what files was inside Quaratine? Thanks

The only logs would be contained in the detection reports depending on how they were detected (e.g. what shield or scan made the detections).
C:\ProgramData\AVAST Software\Avast\report

I know this isn’t what you want to hear, but that is effectively what r@vast said, but in more detail.

@r@vast post:2

Hi,

It is, unfortunately, not possible to do so using Avast.

[alex66556]

Hello again, thanks for reply, in that logs I can`t find all files, to try to know and understand why and what Avast deleted files with false positive virus. I succeded recovered some encripted files from chest file. Maybe I will be able to put it back somehow

[DavidR]

@alex66556 post:8

Hello again, thanks for reply, in that logs I can`t find all files, to try to know and understand why and what Avast deleted files with false positive virus. I succeded recovered some encripted files from chest file. Maybe I will be able to put it back somehow

As I mentioned.

Even if you somehow managed to overcome those hurdles, the Virus Chest for obvious reasons is is protected so you couldn't just place them there.

I don’t know:

1. How you recovered them and how successful that might have been.
2. How you know they came from the virus chest.

If you know what these files/programs, etc., that were sent to the chest, I would have thought it might be easier to find copies of the original (program, version and file name) from an unencrypted source.

So you couldn’t simply place files there and subsequently simply extract them as the current virus chest has no information in relation to them, having previously deleted them. The original file information name and location and I don’t know about decryption, again by not having any previous information on the initial encryption.

I’m afraid it is a case of delete in haste repent at leisure, I don’t recommend deleting files in the chest as they can do no harm there and can be subsequently restored if it proves to be a false positive.