How to fix files corrupted by malware and recover your data

When suddenly an important document, a work folder, or your vacation photos... They stop opening and the system tells you that the file is damaged or unreadableIt's normal to get nervous. If you also suspect it might have been caused by a virus or malware, the worry skyrockets: Have I lost everything forever? Can I recover anything without making the situation worse?

The good news is that, in many cases, It is possible to repair corrupted files or at least recover some of its contents, even when the problem was caused by malware, a sudden shutdown, or a disk failure. In this guide, you'll find solutions for Windows, USB drives, and external hard drives, online tools, free programs, and also when it's best to call in professionals.

What is a corrupted file and why can malware damage it?

A file is considered corrupt when Its internal structure ceases to be coherent for the program that attempts to open it.The icon is still there, taking up disk space, but the system or application cannot interpret the data correctly and throws errors or freezes.

This corruption can be minor, such as a Word document showing strange characters at the end, or severe, when The file is completely inaccessible and no application can open it.Malware-related cases are usually on the complicated side: the virus can modify headers, encrypt content, or alter permissions and attributes.

Typical causes of corruption include interruptions during saving, power outages, software errors, hard drive failures, USB drives or SD cards, and even compatibility problems when opening files with inappropriate programs or versionsViruses and ransomware add another layer of risk: they encrypt files, rename them, replace them with shortcuts, or They manipulate their attributes to hide them..

In extreme scenarios, such as ransomware that encrypts videos, databases, or entire virtual machines on a server, The files are there but locked or their content has been altered.In such cases, if there is no backup or decryption keys, the only reasonable solution is usually to recover data from previous backups or snapshots.

Common causes of file corruption (including malware)

Before you start repairing anything, it's worth understanding where the problem is coming from, because The cause determines both the recovery method and subsequent prevention measures..

One of the most common reasons is the unexpected equipment shutdowns or power outages This happens precisely when a file is being saved or data is being written to disk. If the process is interrupted midway, the file structure is left incomplete, and the program then doesn't know how to interpret it.

Also very common are software errors during savingA sudden crash of Word, Excel, a video editor, or any app that works with files can leave incomplete files, corrupt headers, or junk data inserted in the middle of a document.

In the field of security, the role of malware is key: Many viruses, Trojans, and adware modify system files, Office documents, or multimedia files., whether to hide itself, to prevent the normal functioning of the equipment or to blackmail the user by encrypting their information (ransomware).

Do not forget the physical defects in hard drives, SSDs or USB drivesBad sectors, damaged chips, or controller problems can render parts of a file unreadable, effectively corrupting it. In these cases, the symptoms are usually strange noises from the drive, extreme slowness, or it disappearing and reappearing from the system.

Finally, a silent source of corruption is the compatibility issues and poor usage practicesOpening files with very old versions of a program, using unreliable software to edit documents, abruptly closing applications from the Task Manager, or unplugging an external drive without ejecting it are all surefire ways to corrupt files. If you want to learn more about how to fix this, see the relevant section. compatibility problems In Office environments, there are specific guides that help avoid these situations.

How to detect and clean malware before repairing files

If you suspect that corruption comes from a virus (for example, because Strange ads appear, processes run at 100%, or strange windows open when starting up.The first step is not to repair, but to disinfect. Otherwise, any file you recover may become corrupted again.

In Windows you have your own Windows Defender / Windows SecurityIt's advisable to use at least a "Quick Scan" to look for active threats. To do this, simply open the Start menu, type "Windows Security", go to "Virus & threat protection", and run the scan.

Furthermore, it is highly recommended to combine it with specialized tools such as AdwCleaner, Malwarebytes, HitmanPro or Microsoft Safety ScannerThese utilities are designed to locate and remove adware, PUPs (potentially unwanted programs), spyware, and other malware that sometimes goes unnoticed by the main antivirus.

Always download these tools from their official websites or trusted sources, and Read carefully during installation to avoid unwanted additional software.After running them and cleaning up what they detect, it's a good time to restart your computer and check if CPU, memory, and disk usage return to normal values.

On systems heavily damaged by malware, it can be useful to perform a Windows clean bootThis involves disabling third-party services and programs to isolate conflicts. Microsoft documents this process in its official support materials, and it helps to boot the system with the bare minimum and see if the files remain inaccessible due to a virus or actual corruption.

First aid: what to do right after detecting corrupt files

Once the active malware has been ruled out or removed, it's time to proceed calmly. The most important thing is Stop using the affected unit as much as possible.Each new write operation can overwrite recoverable data, especially if it's a disk that has lost files or a problematic USB drive.

Ideally, before touching anything, you should do a back up the entire drive or at least the damaged filesThis way, if a repair tool modifies the original file and damages it further, you can always revert to the initial copy to try other methods.

If you can physically access the drive, a good advanced practice is to connect it to another computer as a secondary drive or booting from a live Linux system to copy your data safely, avoiding using your main Windows installation if you suspect serious infections.

In parallel, it is advisable to check the system with the utilities included in Windows to rule out general errors: Error checking from disk properties, the chkdsk command, or the system file checker sfc / scannowIf the base (the file system) is broken, the chances of recovering complete files are greatly reduced.

Another point that many overlook is the RAMMicrosoft includes the "Windows Memory Diagnostic" tool that allows you to check for faulty memory modules, which can also cause random file corruption and unexplained crashes.

Repairing a damaged disk or file system in Windows

If the problem doesn't seem to be limited to a single file, but affects an entire folder, drive, or even the system itself, it's best to start by Verify and repair the disk and system files before focusing on specific documents.

The first resource is the Windows error-checking tool. From the File Explorer (Windows + E)Right-click on the affected drive, go to "Properties" and in the "Tools" tab click on "Check" within the "Error checking" section so that Windows checks the file system.

You can also get more to the point with the command chkdsk /f driveLetter: Run from the Command Prompt with administrator privileges. This utility analyzes the drive, locates bad sectors, and attempts to repair them or move the data to healthy areas. It is very useful for internal hard drives, USB drives, and SD cards.

Secondly, there is the command sfc / scannowThis checks essential Windows files and replaces them if it detects corruption. This won't fix a damaged Excel file, but Yes, it can fix general stability problems and errors when opening certain types of system files..

After these checks, if physical errors persist or the disk reports reassigned sectors, it is advisable to consider replacing the hardware, especially if it is an HDD that makes strange noises or an SSD with many read/write errors.

Repair individual files using built-in tools and manually

Once the system and disk appear stable, it's time to focus on the specific files that won't open. The strategy varies depending on the document type, but It's always worth starting with the built-in repair tools. before messing with external programs.

In the case of Microsoft Office documents (Word, Excel, PowerPoint), the applications themselves include an option to "Open and repair"From the File > Open menu, select the file, click the arrow next to the "Open" button, and choose that option. If the corruption is not too severe, the program can reconstruct tables, text, and much of the content.

Sometimes, even if the file appears partially corrupted, it's possible to recover information manually. For example, in simple text documents or partially readable files, you can Open the file, copy what is legible, and paste it into a new document.It's not elegant, but for reports, notes, or memos, it can save the day.

When the corrupted file has a copy in another location (for example, on a company server, another computer, or a cloud), the simplest option is copy the original file again, the one that works.However, first check that the original file isn't also damaged or infected, because you could be cloning the same problem.

If you use Google Drive, a surprise letter is to upload the document to the cloud and open it from there. Google Docs, Sheets or SlidesSometimes, a file that resists opening in the desktop version of Word or Excel opens without problems in the online version, allowing you to recover the content and download it again in a clean format.

Online tools to repair files damaged by malware or errors

When built-in repair functions fall short, online tools come into play, especially useful if are you in a hurry or don't want to install heavy programs? in your work team.

Services like OnlineFile.Repair They allow uploading damaged files (Office documents, PDFs, JPG imagesetc.) and download a repaired version, with the great advantage that the process is very simple: upload, wait, and download. The free version usually has size limits, such as 100 MB per file, but for normal documents, this is more than enough.

Another similar option is Office Recovery Online, primarily geared towards Microsoft Office suite files (Word, Excel, PowerPoint, Access, Outlook), although it also supports Photoshop projectsPNG and other formats. They usually offer a preview of the recovered files before you pay, allowing you to assess whether the full version is worthwhile.

If the problem centers on PDF documents that were partially downloaded, cut off during upload, or fail to open after a malware attack, tools like iLovePDF They include fully online PDF repair functions, very practical when the file is left half-saved or suffers some occasional error.

Other suites such as Repair Toolbox web version They offer specific utilities depending on the file type: Word, Excel, Photoshop, Illustrator, RAR, ZIP, etc. They usually offer a limited free demo and, although they don't always work miracles, they can recover files that other services can't open.

Free desktop programs to recover and repair files

If the corruption is accompanied by deleted files, missing partitions, or drives that require formatting, it's time to move on to more powerful data recovery solutions installed on the PC.

One of the classics is Recuva, especially geared towards Windows. It allows you to scan hard drives, USB drives, and SD cards to recover files accidentally deleted or lost due to system errors, including Office documents. photos and videos.

For more complex problems with partitions, corrupted boot drives, or disks that suddenly become unrecognized, tools like TestDisk come into play. It's designed for slightly more advanced users, but it's very effective at recovering partitions and disk structures.

Complementing TestDisk, PhotoRec It focuses on the recovery of all types of files, even on camera memory cards or heavily damaged drives. It ignores the file system and looks for known data patterns., which makes it useful even when the partition table is badly damaged.

In more friendly environments, Disk Drill It offers a very user-friendly graphical interface, with quick and deep scanning options and compatibility with both Windows and Mac. The free version recovers up to a certain amount of MB, enough for critical documents, and supports a wide variety of formats.

For very specific Office documents, solutions such as Stellar File Repair Toolkit They offer limited free versions that allow you to repair Word, Excel, PowerPoint, and Outlook files. These often include a preview of the recovered files, which helps you decide whether it's worth purchasing the full version for large volumes of data.

Special cases: ransomware, servers, and professional environments

When malware not only corrupts individual files, but encrypts massive amounts of data on servers, databases, or entire virtual machinesThe situation becomes serious. In these types of attacks, ransomware usually adds strange extensions to files and displays ransom notes demanding money in exchange for the key.

In this context, the first thing is not pay the ransomThere's no guarantee you'll recover anything, and it actually encourages attackers. The priority should be isolating the system, shutting down affected machines to prevent further spread, and contacting the IT team or a cybersecurity and recovery provider.

Professionals can work directly with the disks (for example, NVMe SSDs in Dell servers, RAID arrays, or VMware environments) to locate damaged virtual machines, SQL databases of hundreds of GB and recent snapshots that allow the environment to be rebuilt, even if a configuration error left the system unable to boot.

In these complex scenarios, often the only realistic path to recovery is Use backups, external backups, or Disaster Recovery solutions already in place. When they are not, recovery can be partial, very costly, and not always satisfactory.

Specialized companies offer services of Housing, Data Center, remote backup systems and disaster recoveryincluding options for users who do not have their data hosted in their data center but need a robust backup and restore system in case of viruses or serious failures.

Recover infected or damaged files in Windows using backups and previous versions

If you work in Windows 10 or 11 and had options such as system backups or File History enabled, it is very possible that You can recover previous versions of documents that are now corrupted or encrypted by malware.

A road is the section of “Backup and Restore” in the Control PanelFrom there you can use the "Restore my files" wizard to search by name, folder or type and return individual documents or entire folders to a previous state, also choosing where they are restored.

Another very practical option is to use the “Previous versions” of folders and filesIn File Explorer, right-click on a folder or document, select "Restore previous versions," and choose from the automatic save points that Windows has generated based on your system settings.

If you had the File HistoryYou can access it from the Explorer (using the "History" option in the bar) and navigate between different temporary backups, selecting the versions you want to recover and clicking the green restore button.

However, all these options depend on whether the original copy was not already damagedIf the file became corrupted before the backup was made, restoring that copy won't fix anything. That's why it's so important to combine frequent backups with good habits for closing programs and shutting down the computer.

Recover files from damaged or infected USB drives and external disks

USB flash drives and external hard drives are the favorite playground of many viruses, especially those that They hide your real files and replace them with shortcuts.Furthermore, they are very sensitive to sudden disconnections that can leave the file system in a mess.

When a USB drive appears empty but you know it contained data, or when all the items are converted into shortcuts, a classic tactic is to use the Command Prompt (cmd) using chkdsk and the attrib command to recover visible content.

Connect the device, open the command window (Win+R, type cmd, Enter) and run chkdsk X: / f replacing X with the actual drive letter. This will attempt to repair basic drive errors. After that, you can use a command like X:>attrib -h -r -s /s /d *.* to remove hidden and read-only attributes that many malware programs set on your files.

This procedure, widely used against infections such as the notorious "recycler" virus, It doesn't clean the virus itself, but it restores the visibility of your original files.That's why it should always be accompanied by a good antivirus and antimalware scan on the host computer.

If commands are not enough, specific data recovery programs come into play, capable of scanning the USB drive or external disk for deleted files, lost partitions, or structures damaged by malware or physical failures of the unit.

File formats, compatibility, and conversion to prevent corruption

Not all corruption stems from physical failures or viruses. Often, the origin lies in opening files with unsuitable programs or in unstable formatswhich break easily when converting or editing with third-party tools.

If a file does not open or shows errors, one of the first checks should be Verify that the format is compatible with the application and version you are using.A modern .docx file can fail in older versions of Word, just as certain PDFs with advanced features produce errors in very outdated readers.

When you detect that a particular format is causing problems, a good strategy is to convert it to a more standard or robust formatFor example, saving Word documents as read-only PDFs when they are finished, or exporting databases to open formats before making significant changes. For multimedia files, it is advisable to pay attention to the audio files and their formats before converting them, avoiding loss of compatibility.

There are both online and desktop tools available for converting between formats (documents, images, audio, video), reducing the risk of an incompatibility may end up leading to apparent corruptionHowever, it must always be done from a copy, not from the original.

In the case of highly sensitive files, such as complex projects, databases, or professional photo collections, it may even be worthwhile. maintain multiple copies in different formats, in order to ensure that there will always be at least one version that opens correctly in the future.

Best practices and prevention to avoid losing files again

No matter how many tricks and tools exist, the only truly effective strategy is prevention. And that involves adopting good habits in the use of computers and storage devices.

The first is Always turn off the equipment properly.Avoid unplugging or using the power button except in emergencies. The same applies to closing programs: save files, close applications from their menus, and avoid force-closing from the Task Manager unless absolutely necessary.

On external hard drives and USB flash drives, it is essential Always use the "Eject" or "Safely Remove Hardware" option before physically disconnecting the device. Otherwise, you may interrupt ongoing read or write processes and unknowingly cause corruption.

Another key pillar is backups. Maintaining regular backups to external drives, NAS or the cloud It minimizes the impact of any incident: if ransomware attacks, if a disk dies, or if you accidentally delete a folder, you'll always have a point to return to.

Don't neglect the maintenance of the hard drive itself. Tools such as CrystalDiskInfo They allow you to monitor the health of HDDs and SSDs (temperatures, reallocated sectors, usage hours). If you start seeing alerts or abnormal values, it's time to clone that drive and replace it before it fails completely.

Finally, try do not overload the storage unitsLeaving at least 10-15% free space helps the operating system and applications manage temporary files, defragment, and work without generating errors due to lack of space, which also reduces the likelihood of corruption.

Having a combination of reliable backups, a malware-protected system, and good disk and file management habits means that when something goes wrong, you'll have a backup plan. Many more options to recover your data without having to resort to extreme measures or emergency services.