Disclosed is a file recovery method, comprising: receiving a recovery command sent by a control center, wherein the recovery command carries an index number and a corresponding MD5 feature of a changed file monitored by the control center; determining a local to-be-recovered file range according to the index number and the corresponding MD5 feature carried by the recovery command; searching and acquiring file data for substituting the changed file from other client according to the MD5 feature of the file in the local to-be-recovered file range, and reporting the recovery result to the control center after substituting. Moreover, further disclosed is a file recovery device. By adopting the method, the file infected by viruses can be quickly processed, and the office capability can be restored; only a file feature library is needed, instead of a huge backup space; and equipment load is reduced by monitoring management of the background.