How to fix files corrupted by malware and recover your data

When an important document, a work folder, or your vacation photos suddenly stop opening and the system tells you the file is corrupted or unreadable , it's normal to get nervous. If you also suspect it might be due to a virus or malware, the worry skyrockets: Have I lost everything forever? Can I recover anything without making the situation worse?

The good news is that in many cases, it's possible to repair corrupted files or at least recover some of their content, even when the problem was caused by malware, a sudden shutdown, or a disk failure. In this guide, you'll find solutions for Windows, USB drives, and external hard drives, online tools, free programs, and also when it's best to call in professionals.

What is a corrupted file and why can malware damage it?

A file is considered corrupt when its internal structure is no longer coherent for the program trying to open it . The icon is still there, it occupies disk space, but the system or application cannot interpret the data correctly and throws errors or hangs.

This corruption can be minor, like a Word document displaying strange characters at the end, or severe, when the file becomes completely inaccessible and no application can open it . Malware-related cases are usually on the more serious side: the virus can modify headers, encrypt content, or alter permissions and attributes.

Typical causes of corruption include interruptions during saving, power outages, software errors, hard drive failures, USB flash drives or SD card malfunctions, and even compatibility issues when opening files with inappropriate programs or versions . Viruses and ransomware add another layer of risk: they encrypt files, rename them, replace them with shortcuts, or manipulate their attributes to hide them.

In extreme scenarios, such as ransomware that encrypts videos, databases, or entire virtual machines on a server, the files are still there but locked or their content has been altered . In these cases, if there is no backup or decryption key, the only reasonable solution is usually to recover data from previous backups or snapshots.

Common causes of file corruption (including malware)

Before you start repairing anything, it's worth understanding where the problem comes from, because the cause determines both the recovery method and subsequent prevention measures.

One of the most common reasons is unexpected computer shutdowns or power outages just as a file is being saved or data is being written to disk. If the process is interrupted, the file structure is left incomplete, and the program then doesn't know how to interpret it.

Software errors during saving are also very common . A sudden crash of Word, Excel, a video editor, or any app working with files can leave incomplete files, corrupt headers, or junk data inserted in the middle of a document.

In the field of security, the role of malware is key: many viruses, Trojans and adware modify system files, Office documents or multimedia files , either to hide themselves, to prevent the normal functioning of the computer or to blackmail the user by encrypting their information (ransomware).

Physical defects in hard drives, SSDs, or USB flash drives shouldn't be overlooked . Bad sectors, damaged chips, or controller problems can render parts of a file unreadable, effectively corrupting it. In these cases, the symptoms are usually strange noises from the drive, extreme slowness, or it disappearing and reappearing from the system.

Finally, a silent source of corruption is compatibility issues and poor usage practices . Opening files with very old versions of a program, using unreliable software to edit documents, or abruptly closing applications from the Task Manager or unplugging an external drive without ejecting it are all perfect recipes for corrupted files. If you want to learn more about how to resolve compatibility problems in Office environments, there are specific guides that can help you avoid these situations.

How to detect and clean malware before repairing files

If you suspect the corruption is caused by a virus (for example, because strange ads appear, processes are running at 100%, or unusual windows open on startup ), the first step is not to repair, but to disinfect. Otherwise, any files you recover may become corrupted again.

Windows includes Windows Defender/Windows Security , which you should at least use with a "Quick Scan" to look for active threats. To do this, simply open the Start menu, type "Windows Security", go to "Virus & threat protection", and run the scan.

Furthermore, it is highly recommended to combine it with specialized tools such as AdwCleaner, Malwarebytes, HitmanPro, or Microsoft Safety Scanner . These utilities are designed to locate and remove adware, PUPs (potentially unwanted programs), spyware, and other malware that sometimes goes undetected by the main antivirus software.

Always download these tools from their official websites or trusted sources, and read carefully during installation to avoid unwanted additional software . After running them and cleaning up any detected items, it's a good time to restart your computer and check if CPU, memory, and disk usage return to normal.

On computers severely damaged by malware, performing a clean boot of Windows can be helpful . This involves disabling third-party services and programs to isolate conflicts. Microsoft documents this process in its official support documentation, which helps boot the system with the bare minimum and determine if files remain inaccessible due to a virus or actual corruption.

First aid: what to do right after detecting corrupt files

Once the active malware has been ruled out or removed, it's time to proceed calmly. The most important thing is to stop using the affected drive as much as possible . Every new write operation can overwrite recoverable data, especially if it's a disk that has lost files or a problematic USB drive.

Ideally, before doing anything, you should back up the entire drive or at least the damaged files . This way, if a repair tool modifies the original file and makes it worse, you can always revert to the initial backup to try other methods.

If you can physically access the disk, a good advanced practice is to connect it to another computer as a secondary drive or boot from a live Linux system to copy the data safely, avoiding using your main Windows installation if you suspect serious infections.

In parallel, it's advisable to scan the system using the utilities included in Windows to rule out general errors: error checking from disk properties, the chkdsk command, or the system file checker sfc /scannow . If the core (the file system) is corrupted, the chances of recovering complete files are greatly reduced.

Another point that many overlook is RAM . Microsoft includes the "Windows Memory Diagnostic" tool, which allows you to check for faulty modules, something that can also cause random file corruption and unexplained crashes.

Repairing a damaged disk or file system in Windows

If the problem doesn't seem to be just in an isolated file, but in an entire folder, drive, or even the system itself, it's best to start by verifying and repairing the disk and system files before focusing on specific documents.

The first resource is the Windows error-checking tool. From File Explorer (Windows + E) , right-click on the affected drive, go to "Properties," and on the "Tools" tab, click on "Check" within the "Error checking" section so that Windows can check the file system.

You can also get more specific with the command `chkdsk /f driveletter`, run from the Command Prompt with administrator privileges. This utility analyzes the drive, locates bad sectors, and attempts to repair them or move the data to healthy areas. It's very useful for internal hard drives, USB drives, and SD cards.

Secondly, there's the `sfc /scannow` command , which scans essential Windows files and replaces them if it detects corruption. This won't fix a corrupted Excel file, but it can resolve general stability issues and errors when opening certain types of system files.

After these checks, if physical errors persist or the disk reports reassigned sectors, it is advisable to consider replacing the hardware, especially if it is an HDD that makes strange noises or an SSD with many read/write errors.

Repair individual files using built-in tools and manually

Once the system and disk appear stable, it's time to focus on the specific files that won't open. The strategy varies depending on the type of document, but it's always worth starting with the built-in repair tools before resorting to external programs.

For Microsoft Office documents (Word, Excel, PowerPoint), the applications themselves include an "Open and Repair" option . From the File > Open menu, select the file, click the arrow next to the "Open" button, and choose that option. If the corruption is not too severe, the program can reconstruct tables, text, and much of the content.

Sometimes, even if a file appears partially corrupted, it's possible to recover information manually. For example, with simple text documents or partially readable files, you can open the file, copy what's legible, and paste it into a new document . It's not elegant, but for reports, notes, or other documents, it can be a lifesaver.

When a corrupted file has a copy stored elsewhere (for example, on a company server, another computer, or in the cloud), the simplest option is to copy the original, working file back . However, first check that the original file isn't also damaged or infected, because you could be replicating the same problem.

If you use Google Drive, a clever trick is to upload the document to the cloud and open it from Google Docs, Sheets, or Slides . Sometimes, a file that's difficult to open in the desktop version of Word or Excel opens without problems in the online version, allowing you to recover the content and download it again in a clean format.

Online tools to repair files damaged by malware or errors

When built-in repair functions fall short, online tools come into play, especially useful if you're in a hurry or don't want to install heavy programs on your work computer.

Services like OnlineFile.Repair allow you to upload damaged files (Office documents, PDFs, JPG images , etc.) and download a repaired version. The great advantage is that the process is very simple: upload, wait, and download. The free version usually has size limits, such as 100 MB per file, but this is more than enough for standard documents.

Another similar option is OfficeRecovery Online , which is primarily geared towards Microsoft Office files (Word, Excel, PowerPoint, Access, Outlook), although it also supports Photoshop projects , PNG, and other formats. They usually offer a preview of the recovered files before you pay, allowing you to decide if the full version is worthwhile.

If the problem centers on PDF documents that were partially downloaded, cut off during upload, or fail to open after a malware attack, tools like iLovePDF include fully online PDF repair functions, which are very practical when the file was left half-saved or suffered a one-off error.

Other suites like the web-based Repair Toolbox offer specific utilities depending on the file type: Word, Excel, Photoshop, Illustrator, RAR, ZIP, etc. They usually offer a limited free demo and, while they don't always work miracles, they can recover files that other services can't open.

Free desktop programs to recover and repair files

If the corruption is accompanied by deleted files, missing partitions, or drives that require formatting, it's time to move on to more powerful data recovery solutions installed on the PC.

One of the classic options is Recuva , specifically designed for Windows. It allows you to scan hard drives, USB drives, and SD cards to recover files accidentally deleted or lost due to system errors, including Office documents, photos, and videos.

For more complex problems with partitions, corrupted boot files, or disks that suddenly become unrecognized, tools like TestDisk come into play. It's designed for more advanced users, but it's very effective at recovering partitions and disk structures.

Complementing TestDisk, PhotoRec focuses on recovering all types of files, even from camera memory cards or heavily damaged drives. It ignores the file system and looks for known data patterns , making it useful even when the partition table is severely corrupted.

In more user-friendly environments, Disk Drill offers a very intuitive graphical interface, with quick and deep scan options and compatibility with both Windows and Mac. The free version recovers up to a certain number of MB, enough for critical documents, and supports a wide variety of formats.

For very specific Office documents, solutions like Stellar File Repair Toolkit offer limited free versions that allow you to repair Word, Excel, PowerPoint, and Outlook files. These often include a preview of the recovered files, which helps you decide whether it's worth purchasing the full version for large volumes of data.

Special cases: ransomware, servers, and professional environments

When malware not only corrupts individual files but also encrypts massive amounts of data on servers, databases, or entire virtual machines , the situation becomes serious. In these types of attacks, ransomware typically appends unusual file extensions and displays ransom notes demanding money in exchange for the decryption key.

In this context, the first thing to do is not to pay the ransom . There's no guarantee you'll recover anything, and it only encourages the attackers. The priority should be to isolate the system, shut down affected machines to prevent further spread, and contact your IT team or a cybersecurity and recovery specialist.

Professionals can work directly with the disks (e.g., NVMe SSDs in Dell servers, RAID arrays, or VMware environments ) to locate damaged virtual machines, SQL databases of hundreds of GB, and recent snapshots that allow them to rebuild the environment, even if a configuration error left the system unable to boot.

In these complex scenarios, often the only realistic way to recover is to use backups, external backups, or existing Disaster Recovery solutions. When these are unavailable, recovery can be partial, very expensive, and not always satisfactory.

Specialized companies offer housing, data center, remote backup and disaster recovery services , including options for users who do not have their data hosted in their data center but need a robust backup and restoration system in case of viruses or serious failures.

Recover infected or damaged files in Windows using backups and previous versions

If you work on Windows 10 or 11 and had options such as system backups or File History enabled, it is very possible that you can recover previous versions of documents that are now corrupted or encrypted by malware.

One way is through the "Backup and Restore" section in the Control Panel . From there, you can use the "Restore My Files" wizard to search by name, folder, or type and restore individual documents or entire folders to a previous state, also choosing where to restore them.

Another very practical option is to use "Previous Versions" of folders and files . In File Explorer, right-click on a folder or document, select "Restore previous versions," and choose from the automatic save points that Windows has generated based on your system settings.

If you had File History enabled , you can access it from Explorer (using the "History" option in the bar) and navigate through different temporary backups, selecting the versions you want to recover and clicking the green restore button.

However, all these options depend on the original copy not already being corrupted . If the file was corrupted before the backup was made, restoring that copy won't fix anything. Hence the importance of combining frequent backups with good habits for closing programs and shutting down the computer.

Recover files from damaged or infected USB drives and external disks

USB flash drives and external hard drives are a favorite breeding ground for many viruses, especially those that hide your real files and replace them with shortcuts . Furthermore, they are very susceptible to sudden disconnections, which can leave the file system in shambles.

When a USB drive appears empty but you know it contained data, or when all items are converted into shortcuts, a classic tactic is to use the Command Prompt (cmd) with chkdsk and the attrib command to recover the visible content.

Connect your device, open the command prompt (Win+R, type cmd, press Enter), and run chkdsk X: /f, replacing X with your actual drive letter. This will attempt to repair basic drive errors. Afterward, you can use a command like X:>attrib -h -r -s /s /d *.* to remove hidden and read-only attributes that many malware programs set on your files.

This procedure, widely used against infections like the notorious "recycler" virus, doesn't remove the virus itself, but it does restore the visibility of your original files . Therefore, it should always be followed by a thorough antivirus and antimalware scan on the host computer.

If commands are not enough, specific data recovery programs come into play, capable of scanning the USB drive or external disk for deleted files, lost partitions, or structures damaged by malware or physical failures of the unit.

File formats, compatibility, and conversion to prevent corruption

Not all corruption stems from physical failures or viruses. Often, the problem arises from opening files with unsuitable programs or in unstable formats , which are easily corrupted when converted or edited with third-party tools.

If a file won't open or displays errors, one of the first things to check is whether the format is compatible with the application and version you're using . A modern .docx file might fail in older versions of Word, just as certain PDFs with advanced features might produce errors in very outdated readers.

When you notice that a particular format is causing problems, a good strategy is to convert it to a more standard or robust format . For example, save Word documents as read-only PDFs once they're finished, or export databases to open formats before making significant changes. For multimedia files, it's advisable to check the audio files and their formats before converting them to avoid losing compatibility.

There are both online and desktop tools available for converting between formats (documents, images, audio, video), reducing the risk of incompatibility leading to apparent corruption . However, it's essential to always convert from a copy, not the original.

In the case of highly sensitive files, such as complex projects, databases, or professional photo collections, it may even be worthwhile to keep several copies in different formats , in order to ensure that there will always be at least one version that will open correctly in the future.

Best practices and prevention to avoid losing files again

No matter how many tricks and tools exist, the only truly effective strategy is prevention. And that means adopting good habits when using computers and storage devices.

The first thing is to always shut down your computer properly , without pulling the cable or using the power button except in emergencies. The same applies to closing programs: save your files, close the application from its menus, and avoid forcing it to close from the Task Manager unless there is no other option.

On external hard drives and USB flash drives, it's crucial to always use the "Eject" or "Safely Remove Hardware" option before physically disconnecting the device. Otherwise, you could interrupt ongoing read or write processes and unknowingly cause data corruption.

Another key pillar is backups. Maintaining regular backups on external drives, NAS, or in the cloud minimizes the impact of any incident: if ransomware attacks, if a drive fails, or if you accidentally delete a folder, you'll always have a point to revert to.

Don't neglect disk maintenance. Tools like CrystalDiskInfo allow you to monitor the health of your HDD and SSD (temperatures, reallocated sectors, usage hours). If you start seeing alerts or abnormal values, it's time to clone the disk and replace it before it fails completely.

Finally, avoid overloading your storage drives . Leaving at least 10-15% free space helps the operating system and applications manage temporary files, defragment, and work without generating errors due to lack of space, which also reduces the likelihood of corruption.

Having a combination of reliable backups, a system protected against malware, and good disk and file management habits means that, when something goes wrong, you have many more options to recover your data without having to resort to extreme measures or emergency services.