Hi Ajoy,

Quick Heal Backup and Restore Tool helps to restore the important data such as documents, spreadsheets etc. in the case of ransomware or any other malware encrypts, corrupts or deletes them.
The backup is stored on a drive where the maximum amount of free disk space is available. The backup folder is created with the random name.
e.g. 'cfrbackup-ORALEBLG’
Backup folder is also protected by Self Protection so that backup files remain intact and won't get encrypt, corrupt or delete by any malware activity.

Before proceeding with date restore, make sure:

• Quick Heal must be present in the system before the file incident occurred, so that Quick Heal would have backed-up those files.
• Quick Heal is installed, updated and in working state.

There are two ways to restore data:
i. We could restore the complete backup.
Ii. We could restore the single file.
You want to restore entire backup then follow below steps:
Find the folder name “cfrbackup-<random_alpha-numeric string>” on hard disk
e.g. D:\cfrbackup-ORALEBLG

• Click on Windows Start Menu and type CMD in Search windows.
• Right click on the Search result for CMD and click on Run As Administrator.
• You will get a black command prompt windows as below:

• Type 'cd \' and hit Enter.
• You will be now redirected to root of the drive as below:

• Now navigate the Quick Heal installation directory.

E.g. If Quick Heal is installed in “C:\Program Files\Quick Heal\Quick Heal Total Security” then type below syntax in command prompt window as mentioned in below screen-shot:
“cd<space>C:\Program Files\Quick Heal\Quick Heal Total Security”

• Hit Enter and you will be now redirected to Quick Heal installation directory as below:

• Type cfrutil.exe /restore <backup folder modification date> <Path_to_restore_data>

Here, folder’s date of modification is 6/1/2017 12:32 PM, means 01-June-2017, 12:32 PM.
We may also have the second option for time stamp factor.
In most of the cases, Ransomware creates an information TXT,HTML,BMP files on the same location where it has encrypted the files as mentioned in below screen-shots.
We can use these files date of modification for restoring data.





* Time input can be accepted only in 24 Hrs. format.
E.g. If the folder modification date is 6 June 2017,3:20 PM, so it must be enter as ‘060620171520’.
So, the command syntax is to proceed is as below:
cfrutil.exe /restore 010620171232 D:\QH_Restore.
D:\QH_Restore is nothing but the location where backup has to be restored.

Hit Enter and you will see restore is in progress.
Restoring backup…

Files will start getting restored in selected folder with drive-name folder and sub-folders in the hierarchical format as below:



You want to restore single file then follow below steps:
Follow steps 1 to 7.
Type command in below syntax as mentioned below:
cfrutil.exe /restorefile <Original_file_path> <Path_to_restore_file>
E.g. cfrutil.exe /restorefile D:\ONLINENT\Onlinent_Final_.rtf D:\QH_Restore

Hit Enter and you will see the files restored is completed:

You can see restored file on selected path.



I hope this helps.

Regards,
Lokesh