Short answer: in most cases your documents and photos are not what the malware was after, and they survive a clean-up untouched. The risk is not the virus — it is the order of operations. Copy first, clean second.
What a careful clean-up does, in order
- Image the drive before changing anything. An image is a byte-for-byte copy. If the clean goes wrong, the machine can be returned to exactly where it started, and nothing is lost by trying.
- Copy out what cannot be replaced — photos, documents, saved work — to a separate drive.
- Remove the infection from the running system, or from the image if the machine will not boot.
- Verify with a second, different scanner, and by checking startup items and accounts rather than trusting one green tick.
- Restore the files you need, scanning them as they go back.
Nothing in that sequence requires deleting your files. A technician who starts by reinstalling Windows has skipped steps 1 and 2, and that is where data gets lost.
The three real risks to your files
1. Ransomware. This is the one that actually destroys access — it encrypts files and holds them. Cleaning the machine does not decrypt them, which is why the first job is to stop the machine and preserve the encrypted originals intact. They are the only thing that makes recovery possible later.
2. A clean that removes infected files. Some malware attaches itself to documents, or replaces them. A thorough clean will remove those files, because keeping them means keeping the infection. Copy them out first and you can decide what to do with them afterwards.
3. The wrong drive. The most common data loss in repairs is not malware at all: it is the wrong disk being wiped, or a “reset” chosen when the user meant “clean”. An image taken first makes that survivable.
What to do before you hand the machine over
- Copy your irreplaceable files to an external drive or a cloud account you can reach from another device.
- Write down any passwords you keep only in the browser — those can disappear with the profile.
- Tell them plainly whether the machine is used for work, and whether it holds client, patient or financial data. That changes the procedure, and it is better said before anything is touched.
- Ask whether they image the drive first. If the answer is no, ask why.
What “clean” should mean when you get it back
The behaviour you noticed has stopped; a second scanner agrees; nothing unfamiliar remains in startup items, browser extensions or user accounts; and the way in has been closed with updates. If any of those is missing, the machine is not clean — it is quiet.
Questions people ask
Will I get my files back? Usually yes, because they were never the target. Where they are encrypted, recovery depends on backups or on whether that ransomware family can be decrypted at all.
Should I format and start again? Sometimes that is the right answer for a badly compromised machine — but copy first, always. Formatting is irreversible; copying is not.
Is my backup safe? Only if it was disconnected while the machine was infected. Ransomware encrypts connected drives, including network shares and external disks that were plugged in at the time.