How to Safely Test Recovered Files in a Sandbox Before You Trust Them

Recovering your files feels like a win. The photos are back, the documents are back, and the folder names look right. But a recovered file is not automatically a safe file.

Drives fail for many reasons, and sometimes they fail while malware is still on them. A recovered program, script, or document can carry the same infection that was there before the recovery. Opening it straight away on your main PC can undo all your hard work in seconds.

A sandbox solves this problem. It gives you a clean, throwaway space where you can open and test recovered files first. If something bad happens inside the sandbox, you close it, and the damage disappears with it.

Quick Answer

Copy your recovered files into Windows Sandbox or a virtual machine that has no network connection and no shared folders to your real drives. Open and scan the files only inside that isolated space, and watch how they behave. Move a file to your main PC only after it opens normally, passes an antivirus scan, and shows no strange behaviour. Never open recovered executables directly on your main PC.

What a Sandbox Actually Is

A sandbox is a sealed test area that runs on your computer but stays separate from it. Programs inside the sandbox cannot see your real files, your browser passwords, or your other drives unless you give them access.

Windows Sandbox is built into Windows 10 and Windows 11 Pro, Enterprise, and Education editions. Every time you open it, you get a fresh, clean copy of Windows. Every time you close it, everything inside it is deleted forever.

A virtual machine, such as one made with VirtualBox or Hyper-V, works in a similar way. It is a full computer inside a window. It takes longer to set up, but you can keep it, restart it, and take snapshots of it before each test.

Either tool is fine for this job. Windows Sandbox is faster for a quick check. A virtual machine is better when you need to install a program and watch it over several restarts.

What You Need Before You Start

• A PC with virtualisation turned on in the BIOS or UEFI settings
• Windows Sandbox enabled, or VirtualBox or Hyper-V installed
• Your recovered files stored on a separate drive or folder, still untouched
• An up-to-date antivirus program on your main PC
• Enough free space, ideally 20 GB or more, for the test environment

Keep the recovered drive disconnected from the network during testing. If the drive came from a PC that was infected, do not plug it into a computer that is connected to your home or office network until you have checked it.

Step-by-Step: Test Recovered Files in Windows Sandbox

1. Turn on Windows Sandbox. Open the Start menu, search for “Turn Windows features on or off”, tick the box next to Windows Sandbox, click OK, and restart your PC if asked.
2. Scan the recovered files first. Before copying anything, run a full antivirus scan on the recovered folder from your main PC, but do not open any of the files yourself.
3. Disconnect from the network. Turn off Wi-Fi and unplug the Ethernet cable. Windows Sandbox can be started with networking disabled, and for recovered programs this is the safer choice.
4. Start Windows Sandbox from the Start menu and wait for the clean desktop to appear.
5. Copy in only a few files at a time. Copy and paste a small batch of recovered files onto the sandbox desktop. Start with documents and photos, not programs.
6. Open each file and watch closely. A photo should just open. A document should not ask you to enable macros, run scripts, or download anything.
7. Check the file details. Right-click a file and look at its size, type, and date. A “photo” that is really an .exe or .scr file is not a photo at all and should be deleted.
8. Close the sandbox when you finish a batch. Everything inside is wiped, so any program that tried to run leaves nothing behind.
9. Move only the clean files out. Files that opened normally and passed the scan can be copied back to a new, clean folder on your main PC.

For a deeper official walkthrough of how the isolation works, read the Microsoft Windows Sandbox documentation before your first test session.

Files That Need Extra Care

Programs and installers

Recovered .exe, .msi, and .bat files carry the highest risk. A recovered program may be damaged, and a damaged program can behave in strange ways even without malware. Wherever possible, download a fresh copy of the program from its official website instead of reusing the recovered one. Test a recovered installer in the sandbox only when there is no fresh copy available anywhere.

Office documents

Word and Excel files can carry harmful macros. Open them in the sandbox first, and never click “Enable Content” on a recovered document on your main PC. If a document truly needs macros for your work, ask yourself whether you still trust its source. In most cases, you can copy the plain text and tables into a brand new document and leave the old file behind.

PDFs, photos, and archives

These look harmless but still deserve a check. A PDF can contain a malicious link or script. A ZIP file can hide a program with a fake document icon. If a recovered file came from a drive that also held infected shortcuts, our guide on how to recover files hidden by the shortcut virus explains how those fake shortcuts spread and how to spot them.

Signs a Recovered File Is Not Safe

• The file asks for admin permission when it should not need it
• Opening it starts a command window, a download, or a new program
• The file icon and the file type do not match
• Your antivirus warns about the file inside the sandbox
• The sandbox slows down, or new files appear on its desktop by themselves
• A document demands that you enable macros to “view the content”

If you see any of these signs, close the sandbox at once. Do not copy that file, or any file from the same batch, to your main PC. Delete the file from the recovered set and scan the rest again.

Using a Virtual Machine Instead

A virtual machine gives you one extra safety tool: snapshots. Take a snapshot of the clean machine before you copy any recovered files in. If a test goes wrong, you roll back to the snapshot and the machine is clean again.

Keep the virtual machine’s network adapter switched off in its settings. Turn off shared folders and shared clipboard too, unless you need them for a single, careful transfer. These small settings are what keep the test area truly separate from your real computer.

Common Mistakes to Avoid

• Opening recovered programs “just to check” on the main PC. One double-click is all malware needs. There is no safe quick peek.
• Testing while connected to the network. Some malware spreads to other devices or downloads more harmful files the moment it runs.
• Trusting a file because its name looks familiar. Attackers copy real file names. Check the file type and size, not just the name.
• Skipping the first antivirus scan. Scanning before the sandbox test catches the known threats early and makes the manual test much safer.
• Copying everything back at once. Move files in small, tested batches so one bad file cannot hide among hundreds of good ones.
• Using your everyday accounts inside the sandbox. Never sign in to email or banking inside a test environment that holds suspect files.

Conclusion

A sandbox turns a risky guess into a safe test. Scan the recovered files first, keep the network off, open a few files at a time inside Windows Sandbox or a virtual machine, and watch how they behave. Only clean, normal files earn a place back on your main PC. The extra twenty minutes of testing is far cheaper than cleaning an infection that spreads to your fresh system.

Frequently Asked Questions

Is Windows Sandbox available on Windows Home?

No. Windows Sandbox is included with Pro, Enterprise, and Education editions. If you use Windows Home, a free virtual machine program such as VirtualBox gives you the same kind of isolated test space.

Can malware escape from a sandbox to my real PC?

Escapes are very rare, and Windows Sandbox is designed so that closing it deletes everything inside. Your risk stays low if you keep networking off, avoid shared folders, and never copy untested files back to your main drives.

Should I test photos and music files too?

Yes, at least with a scan. Real photo and music files are low risk, but a file can pretend to be a photo while actually being a program. Check the true file type in the sandbox before trusting it.

What should I do with a file that fails the test?

Delete it and do not try to repair it. If you truly need its contents, open it only inside the sandbox, copy out plain text or screenshots of what you need, and leave the original file behind.

How long should I watch a program inside the sandbox?

A few minutes of normal use is enough for most checks. Install it, open it, use its basic features, and watch for pop-ups, downloads, or slowdowns. If it behaves normally and scans clean, it is reasonably safe to use.