How to Restore Files from a Backup in Windows 7/8/10/11

We recommend using Safe Mode with a command prompt to perform a recovery of your files safely. You will have to reboot your computer, so you better save this instruction.

1. Reboot computer

Windows 7 users:You need to reboot your system and before its loaded constantly press “F8” button until you see boot options.

Windows 8/10/11 users: Press the “Power” button from Windows login screen or Settings. Hold the Shift key on your keyboard and click on “Restart“

2. Start Windows in Safe Mode

After your computer reboots – Click on “Troubleshoot” – press “Advanced options” – “Startup Settings“

Click the “Restart” button, and your computer will reload again and show you the list with all options. You need to choose the “Safe Mode with Command Prompt“

3. Run “System Restore” tool

When your windows loads, enter the following line: cd restore and press Enter.

After that type rstrui.exe line and press Enter.

A recovery window will open before you. Click Next to proceed.

4. Select your restore point

In the next window, you must choose a Restore point. All files in protected drives will be recovered at the time when this point was created (prior to the infection with Budak). In the case when ransomware removes these backups, there will be no Restore points listed. Select a Restore point and click “Next”.

Click “Finish” in this window and confirm the recovery process by pressing “Yes“.

Video guide: Restore files after ransomware attack

---