Use ShadowExplorer to Recover Files or Restore Virus Encrypted Data

By Chona Esjay | Posted on May 14, 2015 | Updated on April 17, 2016

ShadowExplorer is a simple tool to recover any files or folders from Windows computer that is supported by System Restore or Previous Version. This tool is very helpful in recovering files accidentally deleted from your hard drive.

ShadowExplorer is presently being used to recover files that were locked by ransomware. It does not actually decrypt files; rather the tool will restore previous versions of files prior to ransomware infection.

So far, computer users are using this tool to restore and overwrite significant files encrypted by CTB Locker, Crypt0l0cker, CryptoDefense, BitCrypt, CryptorBit, HowDecrypt, and CryptoWall.

How Download and use ShadowExplorer

Disclaimer: By downloading and using this tool, you are considered to have read the owner’s disclaimer and agreed to terms and conditions as declared on the official web site.

1. Download the most recent version of ShadowExplorer from the link below.

Official Site:

2. Double-click on the file to install. It requires Administrative privilege in order to run installation process.


3. Next is about License Agreement. You must accept this term in to continue installing ShadowExplorer. Please select ‘I accept the agreement’ and click on Next to continue.


4. Please proceed with the process until the software is fully installed on your computer.

5. At the end of the installation procedure, you may choose to run ShadowExplorer automatically.

6. Once ShadowExplorer is opened or running, it maps ‘previous versions’ or ‘shadow copy’of files stored on your hard drive.

7. From the drop-down list, please select the drive where the files you wish to recovered are located.

8. Then, select the most recent point-in-time Shadow Copies.


9. ShadowExplorer will display list of folders or exact copy of drive you have selected.

10. You can choose any folder or the entire drive. Just right-click and click on Export.


11. ShadowExplorer will then prompt for the location where you want to save recovered filed. At this point, we advise to create a folder that distinctly labeled as you recovered files.

6 thoughts on “Use ShadowExplorer to Recover Files or Restore Virus Encrypted Data

  1. Jagjeet

    can we restore the files from drives other than C: like D or E.

    If yes then please tell me. My important xls files are infected by locky virus.


  2. Faizan Rizvi

    I have a same question. I was able to restore files resides in Drive C (Although some of them are still corrupted). However, my business critical files were stored in Drive D; is there any way I can restore them ?


  3. Bo.Rockstar

    This Software just restore your files from Windows System Restore (for those don’t want to do system restore) basically you need to enable system restore to export back your files, but if it is disabled, then you cannot recover your files.

  4. adel

    Thanks for the information. I tried the above solutions. I restored my system to get rid of this virus.

  5. Ko Phyo

    I am attacked by ransomeware virus (.bboo).
    Can you help me please?
    I want to decrypt my file, photo and video.

  6. Esau

    My computer was attacked by a virus called (.vawe), How can you help me because I have installed Operating System and now I can not restore my computer to the previous version.

Leave a Reply

Your email address will not be published. Required fields are marked *