How to restore files cleaned up with SafeClean functionality

  • Article ID: 119981
  • Rating:
  • 2 customers rated this article 1.0 out of 6
  • Updated: 05 Mar 2015

It is possible to recover files that have recently been cleaned up by Sophos Anti-Virus if the product installed contains our SafeClean functionality.  Files can be restored on the local computer using the scc.exe command utility as explained below.

Note: An overview of SafeClean, including which products contain the functionality, can be found in article 119988.

Applies to the following Sophos product(s) and version(s)
Sophos Virus Removal Tool

What To Do

Note: If possible ensure a file of the same name is not present in the original folder it was cleaned up from before following the steps below.  Otherwise the restore process will fail.

On the local computer where the scan was run:

  1. Download the file to the Desktop of the computer and extract the scc.exe file to the folder where Sophos Anti-Virus is installed (e.g. c:\Program Files (x86)\Sophos\Sophos Anti-Virus) or the SVRT engine folder (e.g. c:\Program Files (x86)\Sophos\Sophos Virus Removal Tool\engine).
  2. Open a command prompt (Start | Run | Type: cmd.exe | Press return).
  3. Change directory (cd) to the folder containing the scc.exe program (e.g. cd c:\Program Files (x86)\Sophos\Sophos Anti-Virus).
  4. List all items stored in the bin with the following command:

    scc.exe list

  5. Record the ‘RecordID’ and ‘ItemType’ values of the file you want to restore.
  6. Run the following command (replacing <RecordID> and <ItemType> with the corresponding value shown in step 4):

    scc.exe restore -recordid=<RecordID> -itemtype=<ItemType>

    The command prompt will display Return value: 0x00000000 indicating that the file has been successfully restored to its original state and location.

    If you see an error make sure a file with the same name does not exist in the folder the scc.exe program is attempting to restore to and try again.

Further Information

Note: A full list of available switches for the scc.exe program can be viewed by running scc.exe -h

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent