How to Recover Files from a Virus-Infected Android Phone Safely

Updated by Boey Wong / September 16, 2026 09:05

The most common way a virus "steals" files on Android does not involve encryption or deletion at all. The virus hides your real files and replaces them with shortcuts, so it looks like every document and photo on your SD card has become a useless .lnk file. The files are usually still there, just hidden, and with the right steps you can both remove the virus and get your files back.

In this guide I walk through the full recovery flow for a virus-infected Android phone: confirming what happened, removing the virus safely in Safe Mode, unhiding your files, and extracting anything that is genuinely damaged with a data recovery tool.

Guide List

• Part 1. What Does a Virus Do to Your Android Files?
• Part 2. Remove the Virus in Safe Mode First
• Part 3. Recover Files Turned into Shortcuts with attrib Command
• Part 4. Extract Files from an Infected Android Phone with FoneLab Android Data Recovery
• Part 5. FAQs about Recovering Files from a Virus-Infected Android Phone

Part 1. What Does a Virus Do to Your Android Files?

Knowing the enemy helps you pick the right fix. On Android, most file-hiding malware works like this:

1. It hides your real files. The virus sets the hidden attribute on your photos, documents, and videos, so the phone's file manager no longer shows them.
2. It drops shortcut files. For every hidden file, it creates a shortcut with a similar name, which is why you suddenly see a folder full of .lnk files.
3. It keeps running in the background. The malicious app stays active, re-hiding files and re-creating shortcuts even after you clean up once.

The important takeaway: in this common scenario, your files are not deleted, they are hidden. That is why unhiding them is usually enough, and why you should not format the SD card or factory reset the phone before reading this guide.

There are, of course, nastier variants. Some malware really does delete or encrypt files, and some hides everything inside a fake folder that only contains shortcuts, tricking you into thinking the folder is full of broken links. In those cases you still follow the same order: stop the virus first, then unhide what is hidden, then scan for what is truly gone. The steps below cover all three stages, and the earlier you stop using the phone, the more data you will save.

You might also notice your phone running hot, showing pop-up ads, or using data in the background. Those are signs the malware is active, and they are another reason to move quickly through the removal steps before touching your files.

Part 2. Remove the Virus in Safe Mode First

Before you touch the files, you need to stop the virus from fighting back. Booting into Safe Mode disables third-party apps, including the malware, so it cannot re-hide your files while you work.

Step 1Press and hold the Power button until the power menu appears, then press and hold Power off and tap OK when asked to reboot into Safe Mode.

Step 2In Safe Mode, open Settings > Apps and uninstall any app you do not recognize, especially ones installed around the time the files disappeared.

Step 3Restart the phone normally and check that the shortcut files stop coming back.

While you are in Safe Mode, also check the phone's own virus scan in the security app or Google Play Protect, and run it once to catch anything that remains. Do not uninstall system apps; focus only on the suspicious third-party ones.

If you cannot identify the malicious app by name, look for clues: apps you never opened, apps with generic icons, apps that requested storage or accessibility permissions, and apps installed on the day the trouble started. When in doubt, uninstall the ones you do not remember installing, one at a time, and reboot to normal mode between uninstalls to see whether the shortcuts stop reappearing.

If the phone behaves normally in Safe Mode but the problem returns in normal mode, the virus is definitely a third-party app and it is still installed. That makes Safe Mode the perfect environment for both the cleanup and a quick check of your files before you restore them.

Part 3. Recover Files Turned into Shortcuts with attrib Command

With the virus out of the way, you can unhide the real files. The classic way is the attrib command on a computer, which clears the hidden and system attributes in one pass.

Step 1Connect your Android phone to a computer with a USB cable and choose File Transfer mode.

Step 2Note the drive letter of your phone or SD card, then open a command prompt and run:

attrib -h -s -r -a /s /d X:*.* (replace X with your drive letter)

Step 3Wait for the command to finish, then check your folders again. Your photos, documents, and videos should be visible, and the shortcut files can be deleted.

If the files were hidden on the internal storage, use a file manager app that can show hidden files instead, or connect via USB as described. On some phones, the file system makes the command-line route easier for SD cards; for internal storage, enable Show hidden files in the Files app after removing the virus.

A Windows computer makes the attrib step straightforward, but if you only have a Mac, the same job is done with a terminal command that clears the hidden flag on the mounted volume, or with a file manager that has a "show hidden files" toggle. The important part is the same: after the virus is removed, your files are still physically on the storage and simply need their attributes reset.

Once the files are visible again, copy them to the computer first, then delete the leftover shortcuts and re-format the SD card if you want a fully clean start. Copying first guarantees that a mistake during cleanup cannot cost you the files a second time.

Part 4. Extract Files from an Infected Android Phone with FoneLab Android Data Recovery

If unhiding does not bring everything back, or if the virus deleted or damaged some files, FoneLab Android Data Recovery is the tool I use to scan the phone's storage and pull out whatever is still recoverable. It reads the storage directly and lets you preview and export files to your computer, where they are safe from the infection.

FoneLab Android Data Recovery

With FoneLab Android Data Recovery, you will be able to recover lost/deleted data including photos, videos, audios, messages, contacts, call logs, WhatsApp data and more from Android devices.

• Recover photos, videos, messages, contacts, WhatsApp and more.
• Preview data before recovery.
• Support most Android phones and tablets.

Free Download Free Download Learn more

Here is how to recover files from a virus-infected Android phone with it:

Step 1Install and launch FoneLab Android Data Recovery on your computer, then choose Recover Data from Phone.

Step 2Connect your phone, enable File Transfer and USB debugging when asked, and let the tool detect the device.

Step 3Start the scan, then preview the photos, documents, and other files it finds.

Step 4Tick the files you need and click Recover to save them to your computer, then delete the shortcut files on the phone.

Recovering to the computer keeps the rescued files away from the infected storage, so the virus cannot touch them again. After that, scan the phone with a good antivirus app and consider backing up your data, since a clean phone is only half the job. For more Android recovery help, see recovering data from an Android that will not turn on or recovering files from a water-damaged Android.

If the phone itself is damaged or will not boot at all because of the infection, FoneLab Android Data Recovery also supports extracting data from phones that cannot start normally, which is why it is the tool I recommend for the "files are actually gone" cases rather than just the hidden-file cases. Run it while the phone still has any chance of connecting, and export everything important before you do anything more drastic.

FoneLab Android Data Recovery

With FoneLab Android Data Recovery, you will be able to recover lost/deleted data including photos, videos, audios, messages, contacts, call logs, WhatsApp data and more from Android devices.

• Recover photos, videos, messages, contacts, WhatsApp and more.
• Preview data before recovery.
• Support most Android phones and tablets.

Free Download Free Download Learn more

Part 5. FAQs about Recovering Files from a Virus-Infected Android Phone

A virus-infected Android phone looks terrifying, but the shortcut virus is one of the most recoverable situations there is. Remove the virus in Safe Mode, unhide your files with the attrib command, and use FoneLab Android Data Recovery for anything that was genuinely lost. For more help, read how to factory reset an Android phone safely or how to back up your Android device.

And when it is all over, the best antivirus is a backup habit. Copy your photos and documents to a computer or cloud drive regularly, keep your phone's security updates current, and stick to trusted app stores. Then even the worst malware becomes a minor inconvenience instead of a data disaster.

One last reminder: the steps in this guide apply to any Android phone, not just one model, and they work whether the infection hit the internal storage or an SD card. Take your time, work through the parts in order, and you will almost always come out with your files and a clean phone.

FoneLab Android Data Recovery

With FoneLab Android Data Recovery, you will be able to recover lost/deleted data including photos, videos, audios, messages, contacts, call logs, WhatsApp data and more from Android devices.

• Recover photos, videos, messages, contacts, WhatsApp and more.
• Preview data before recovery.
• Support most Android phones and tablets.

Free Download Free Download Learn more