USB recovery steps · September 2026

How to Recover Files from the Virus Infected USB Drive?

A virus may hide files, replace folders with shortcuts, corrupt the file system, or delete directory records. The right recovery route depends on whether the USB is stable, visible, plus physically intact.

By Beginrescueend Notes Editorial Team Published · Updated
Quick answer

Stop opening or saving files on the infected USB. Create a byte-to-byte image with Disk Drill, scan the image, then restore results to a separate clean drive. Scan every recovered file before opening it.

!

Do not format, repair, or run CHKDSK on the USB before recovery. Those actions can change file-system data. Also avoid recovering files back onto the same USB, since new writes may overwrite missing content.

Jump to methods Compare methods
★ Editorial pick ★ 4.4 / 5

Recover From a USB Image → Disk Drill

Creates a byte-to-byte backup · Scans lost file records plus file signatures · Available for Windows & Mac

✓ Windows & Mac ✓ File preview available ✓ Byte-to-byte backup
Try the scan →

Choose a Recovery Method for a Virus-Infected USB Drive

Start with the least destructive option that fits the drive's condition.

Method Best for Time Success rate
1. Recover the USB Through a Disk Drill Image TRY FIRST Deleted, hidden, RAW, or inaccessible files ~20–60 min ● 85%
2. Reveal Files Hidden by USB Malware Folders hidden by shortcut malware ~5 min ● 90%
3. Quarantine the USB Threat With Microsoft Defender Visible files with active malware alerts ~10–45 min ● 75%
4. Restore Clean Copies From a Backup Files backed up before infection ~10–30 min ● 95%
5. Send the USB to a Recovery Lab Physical failure or an undetected device ~3–14 days ● 70%

When Not to Scan a Virus-Infected USB at Home

Stop DIY work if the USB heats up, disconnects during light use, has a loose connector, or appears only occasionally. Repeated scans can push failing hardware past the point where software can read it.

Also pause if the files hold irreplaceable business records or regulated information. A professional lab costs more, though it reduces the chance of an improvised fix making the situation worse.

Top 5 Ways to Recover Files From a Virus-Infected USB Drive

01

Recover the USB Through a Disk Drill Image

Best first move when missing files matter more than repairing the drive

~20–60 min
Difficulty Easy
You need Disk Drill plus a healthy drive
Works for Windows, Mac

Use this route if files vanished, shortcuts replaced folders, or the USB now looks empty. Disk Drill can create a byte-to-byte image, then scan that copy so recovery work does not keep stressing the original device.

  1. Disconnect the USB, then install Disk Drill on the computer's internal drive or another healthy disk.
  2. Reconnect the USB without opening any files. If Windows displays a repair or format request, click Cancel.
  3. Open Disk Drill, choose Byte-to-byte Backup, then save the image to a healthy drive with enough free space.
  4. Load the completed image in Disk Drill, select it, then click Search for lost data.
  5. Filter the results by file type or date. Preview several important files before selecting them.
  6. Click Recover, then save the recovered files to a different drive, never the infected USB.
Disk Drill Review ↗
i Scan recovered files with updated security software before opening them, even when their names look normal.
Visit the official Disk Drill website
02

Reveal Files Hidden by USB Malware

Quick fix when storage is occupied but folders appear missing

~5 min
Difficulty Easy
You need File Explorer or Terminal
Works for Windows, Mac

Some USB malware hides legitimate folders instead of deleting them. Check for hidden content only after making an image or deciding the files are replaceable.

  1. Open File Explorer, select View, open Show, then enable Hidden items.
  2. Look for your original folders without opening unfamiliar shortcuts, scripts, or executable files.
  3. On Windows, open Command Prompt, note the USB drive letter, then switch to that drive.
  4. Run attrib -h -r -s /s /d *.* to remove hidden, read-only, plus system attributes from content on the selected drive.
  5. Copy visible personal files to a clean destination, then scan that destination before opening anything.
i Verify the drive letter carefully. Running the command on the wrong volume can change attributes across unrelated files.
03

Quarantine the USB Threat With Microsoft Defender

Useful when files remain visible but the drive keeps creating shortcuts or warnings

~10–45 min
Difficulty Easy
You need Windows Security
Works for Windows 10, Windows 11

An updated antivirus scan may quarantine the malicious component while leaving clean documents or photos in place. Recover critical data first if the USB is unstable, since cleanup can alter infected content.

  1. Open Windows Security, select Virus & threat protection, then install current protection updates.
  2. Connect the USB without opening it in File Explorer.
  3. Right-click the USB drive, choose Show more options if needed, then select Scan with Microsoft Defender.
  4. Review every detection in Protection history. Quarantine confirmed threats rather than allowing them.
  5. Run a full computer scan if the USB was previously opened. Use Microsoft Defender Offline if warnings return after a restart.
  6. Copy clean files to another drive, then scan the copied folder once more.
i Do not restore quarantined executable files merely because their original filenames seem familiar.
Read Microsoft's item-scanning instructions
04

Restore Clean Copies From a Backup

Safest option when OneDrive, File History, or another backup holds older versions

~10–30 min
Difficulty Easy
You need A backup made before infection
Works for Windows, Mac, cloud storage

A pre-infection backup avoids bringing suspicious USB content back onto the computer. This method also preserves filenames plus folder structure better than raw recovery in many cases.

  1. Disconnect the infected USB before opening your backup service or backup disk.
  2. Find a backup dated before the first strange shortcut, missing folder, or antivirus alert appeared.
  3. Restore a small sample of documents, photos, or videos to a new folder on the computer.
  4. Scan the restored sample, then open a few files to confirm they are complete.
  5. Restore the remaining folders only after the sample passes both checks.
  6. Replace the USB or erase it fully after your important files have been verified elsewhere.
i A synchronized folder is not always a true backup. Malware changes may have synced to every connected copy.
05

Send the USB to a Recovery Lab

Last resort for a disconnecting, overheated, cracked, or undetected drive

~3–14 days
Difficulty Easy to request
You need A reputable recovery lab
Works for Physically damaged USB drives

Software cannot fix a broken connector, failed controller, or damaged memory chip. A lab may read the flash memory directly, though cost can exceed the value of ordinary replaceable files.

  1. Unplug the USB if it becomes hot, disconnects repeatedly, appears with the wrong capacity, or is not detected consistently.
  2. Do not bend the connector, open the casing, freeze the drive, or keep reconnecting it for another test.
  3. Write down what happened, including malware warnings, physical damage, formatting attempts, plus software already used.
  4. Contact two established recovery labs, then ask about evaluation fees, confidentiality, expected turnaround, plus payment rules when recovery fails.
  5. Ship the drive in an antistatic bag inside a rigid padded box.
  6. Review the lab's recoverable-file list before approving expensive work, if that option is offered.
i Sensitive business, medical, legal, or client data deserves a lab with clear privacy terms plus secure handling procedures.

Which Virus-Infected USB Recovery Method Should You Use?

Creating an image, then scanning it with Disk Drill is the sensible first move when important files are missing but the USB still appears on the computer. If the folders are merely hidden, the attribute fix may bring them back in minutes. Use a clean backup whenever one exists, while unstable or physically damaged hardware belongs with a recovery lab.

Top pick Disk Drill
Recover to a separate disk, scan the results, then open a few copies before erasing or replacing the infected USB.

Virus-Infected USB Recovery Questions

How do I recover files from a virus infected USB drive without spreading the infection?
Do not open files directly from the USB drive. Plug it in with AutoPlay turned off, copy the files you need to a clean folder on your computer, then scan both the copied files plus the USB drive with updated antivirus software.
What should I do first when a USB drive shows hidden files after a virus attack?
Disconnect the drive right away, then enable hidden file viewing on a clean computer. Look for files with strange names, double extensions, or shortcut files that pretend to be folders, since those are common signs of malware.
Can I recover deleted files from an infected USB drive after removing the virus?
Yes, sometimes. If the files were deleted or hidden by malware, file recovery software may still find them as long as the data has not been overwritten, so stop using the drive until you try recovery.
Should I format a virus infected USB drive before trying to recover files?
No, not if the files still matter. Formatting can make recovery harder, so copy data off first if possible, then clean or format the drive only after you confirm the important files are safe.
Why does my USB drive open shortcuts instead of folders after a virus infection?
That usually means a shortcut virus has replaced the real folder links. Do not click the shortcuts, because they may launch more malware. Use antivirus cleanup plus hidden file recovery to restore the actual folders.
How can I tell if a file on the USB drive is safe to open?
Check the file type, size, then scan it before opening. Be extra cautious with executable files, scripts, or Office documents that ask you to enable macros, since those are common malware delivery methods.
What is the safest way to scan an infected USB drive for viruses?
Use a fully updated antivirus program on a clean computer, then run a custom scan on the USB drive only. If your security tool supports it, scan the drive before browsing its contents so nothing auto-runs.
Can Windows File Explorer help recover hidden files from a virus infected USB drive?
Yes, sometimes. Turn on hidden items in File Explorer, then check whether your missing files are merely hidden rather than deleted, but remember that this will not restore files that were actually removed.
What file recovery software works best for infected flash drives?
Choose a trusted recovery tool that can scan removable media and preview files before recovery. Avoid random free tools from shady sites, since a bad download can put another infection on your computer.
How do I recover photos from a USB stick after a malware infection?
First clean the USB drive or copy its contents from a safe machine. Then use recovery software to look for JPG, PNG, or RAW files, preview the images, then save recovered photos to your computer, not back onto the same drive.
What should I do if the USB drive asks me to format it before opening?
Do not format it right away. That message can mean file system damage or corruption from malware, so try the drive on another clean computer, then use recovery tools before deciding whether to reformat.
Is it possible to recover files from a USB drive that will not show up in File Explorer?
Yes, if the drive still appears in Disk Management or Device Manager. Assigning a drive letter or fixing file system issues may make it visible again, which can let you copy files off before doing deeper recovery.
How do I remove a virus from a USB drive after I recover my files?
After your files are safe, scan the drive with antivirus, delete suspicious shortcuts or autorun files, then format the drive if needed. A full format is usually the cleanest option when you want to reuse it.
Can an infected USB drive contaminate my computer even if I only copied one file?
Yes, if that file carried malware or triggered a script. That is why you should scan copied files before opening them, especially documents, archives, executables, or anything that came with a strange name.
What are the best alternatives to manual recovery for a virus infected USB drive?
If manual cleanup feels risky, use a reputable data recovery service or professional malware removal help. That is often the safer choice when the drive contains irreplaceable work files or family photos.
How much does it cost to recover files from an infected USB drive?
Software recovery can be free or low cost, while professional recovery usually costs more because it includes diagnosis plus cleanup. The final price depends on whether the issue is simple hiding, file corruption, or physical damage.
How can I prevent this from happening again after I recover my files?
Keep AutoPlay off, scan every USB drive before opening it, then back up important files somewhere besides removable media. It also helps to use one clean folder for transfers so suspicious files are easier to spot.