Ransomware alo Mass Deletion le Vodada me le Google Drive, OneDrive, alo Dropbox dzi Faɛl Gblẽwo ƒe Ðekawɔwɔ Ðe Mɔ̃wo Katã Ŋu (Ŋkeke 30 ƒe Version History kple Vault Rewind)¶

Ne èkpɔ sync icon si le wò Windows taskbar alo macOS menu bar me la, etrɔna kabakaba esime asitsatsa ŋuti nuŋlɔɖi akpe geɖe, adzɔxexe ŋuti nuŋlɔɖiwo, ƒomea ƒe fotowo, kple source code files le eme Google Drive for Desktop, . Microsoft OneDrive, . Dropbox, alo iCloud Drive wotsɔa ransomware ( ..locked, . .bianlian, . .akira, . .play, . .lockbit) alo wotutui ɖa to amesi womeɖo nyuie o dzi rsync --delete, agbalẽdzraɖoƒe ƒe hehe kple dada le vo me, alo ŋɔŋlɔdzesi alakpatɔe nye nyatakakawo ƒe afɔku si zɔna kabakaba ŋutɔ. Elabena wotrɔ asi le alilikpo me kplɔ̃dziɖoɖo ƒe asisiwo ŋu hena mɔ eve dzi wɔwɔ le ɣeyiɣi ŋutɔŋutɔ me (inotify le Linux dzi la, . FSEvents le macOS dzi, eye ReadDirectoryChangesW / Cloud Filter API le Windows dzi), ransomware binary alo esi dzɔ le vo me Shift + Delete le kɔmpiuta ɖeka si ŋu dɔlélea le dzi la, wokakanɛ enumake yia alilikpo me dɔwɔƒea eye wotuae ɖe anyi yia kɔmpiutadziɖoɖo, kɔmpiutadziɖoɖo, kple ƒuƒoƒo ƒe agbalẽdzraɖoƒe bubu ɖesiaɖe si do ƒome kple akɔnta ma le sɛkɛnd ʋɛ aɖewo ko me.

Ke hã, cloud sync engines nye menye raw disk overwrites: le megbe, . Microsoft OneDrive, . Dropbox, . Google Drive, kple Box lé nudzraɖoƒe si metrɔna o si le server-side me ɖe asi kple ŋkeke 30 va ɖo ŋkeke 180 ƒe ɣeyiɣi ƒe ɣeyiɣi ƒe Version Histories, Second-Stage Recycle Bins, kple akɔntabubu bliboa ƒe rollback dɔwɔnuwo (OneDrive Restore Your OneDrive kple ** .Dropbox Rewind**). Zi alesi nètso kɔmpiuta si ŋu dɔlélea le la ɖa enumake le kɔmpiutadziɖoɖoa dzi, tɔ te sync le mɔ̃ evelia dzi be nàŋe teƒea ƒe cache siwo mele Internet dzi o, eye nèƒo asa na mɔ̃ si wua ame si nye be nàgbugbɔ ada faɛl siwo wotsɔ nya ɣaɣlawo ɖo ɖe wò version history quota dzi ko la, àte ŋu agbugbɔ wò cloud drive bliboa atrɔ ayi aɖabaƒoƒo si tututu do ŋgɔ na encryption alo etutu gɔme evɔ màxe cent ɖeka pɛ hã ɖe tafe ta o. Ne èdi be yeakpɔ mɔ̃ vɔ̃ɖi siwo le mia gbɔ kple filesystem carving la, kpɔ míaƒe mɔfiamewo le ransomware kple malware ƒe ŋuɖoɖo, . faɛl tutu le vo me kple ʋu si woɖo ɖe ɖoɖo nu gbugbɔgaxɔ, kple kɔmpiuta dzi nyatakakawo: 3-2-1 ƒe aɖaŋu kple afɔkuwo gbɔ kpɔkpɔ. Ne ransomware ƒe amedzidzedze aɖe dze kɔdzi, atikewɔƒe, alo amedɔdɔ kpata ƒe nyatakakadzraɖoƒe aɖe la, wɔ dɔ enumake le dɔdaƒe ƒe dɔmawɔmawɔ ƒe ɖoɖo siwo mele Internet dzi o eye nàƒo ka na wò nutoa me xexlẽdzesi kpata (911 le United States kple Canada, . 112 le Europa Dukɔwo ƒe Habɔbɔa katã me la, . 999 le United Kingdom) alo nàlé ŋku ɖe míaƒe nyatakakadzraɖoƒe si nye xexlẽdzesi siwo wozãna kpata.

Wɔ esia fifia¶

1. Ðe Ethernet ka la ɖa eye nàtsi Wi-Fi le kɔmpiuta si dzi nètso la dzi ENUMAME (hafi nàtu dɔwɔnuwo alo azi naneke dzi):
2. Nukatae ne ètso network la naa wò cloud vault la nɔa agbe ɖo: Sɛkɛnd ɖesiaɖe si kɔmpiuta si ŋu dɔlélea le alo esi le etutum la gakpɔtɔ le Internet dzi la, desktop sync client (OneDrive.exe, . GoogleDriveFS.exe, . Dropbox.exe) tsɔa faɛl ƒe dɔwɔwɔ 50 va ɖo 200 bubu siwo wotsɔ nya ɣaɣlawo ŋlɔ alo esiwo wotutu ɖa la dana ɖe alilikpo me API la me le sɛkɛnd ɖeka me. Wi-Fi kple Ethernet ɖeɖeɖa nana alilikpo me nyatakakawo ɖoɖo ɖe fli me tsia tsikpe le eƒe mɔwo dzi.
3. Zɔ yi laptop, desktop, tablet, kple telefon BUBU ÐEKASI si do ƒome kple cloud account ɖeka ma ke gbɔ eye nàtsi woƒe Wi-Fi / Ethernet HAFI nànyɔ woƒe screens:
4. Wò evelia offline laptop nye pristine ɣeyiɣi capsule: Ne wò aƒeme kplɔ̃ alo evelia MacBook dɔ alɔ̃ le wò akplo me tso etsɔ, eƒe nutoa me OneDrive, . Dropbox, alo Google Drive (Mirror files / Always keep on this device) ƒe agbalẽdzraɖoƒea gakpɔtɔ léa wò faɛlwo ƒe kɔpi 100 le alafa me siwo wometsɔ nya ɣaɣlawo ŋlɔ o, siwo ŋu womeka asi o.
5. Ne ènyɔ kɔmpiutadziɖoɖo evelia ma esime Wi-Fi le dɔ wɔm la, cloud sync daemon la doa ka enumake, eɖea mass deletion alo ransomware ciphertexts la tso server la dzi, eye wòtsrɔ̃a local copy ma si mekɔ o la le sɛkɛnd 60 teti me. Tsi wò aƒeme Wi-Fi router (ɖe eƒe elektrikkaƒomɔ̃ ɖa) hafi nyɔ kɔmpiuta evelia ɖesiaɖe, emegbe nàwɔ teƒea ƒe agbalẽdzraɖoƒewo ƒe kɔpi ɖe gota USB-mɔ̃ dzi esime mèle Internet dzi o.
6. Ne Ransomware gbɔe wòtso la, he elektrikka la (alo nàzi Power ƒe dzesi dzi sɛkɛnd 10) le PC si ŋu dɔlélea le la dzi; ne nusi gbɔ wòtsoe nye Vodada Tutu le SSD dzi la, gblẽe ɖe vovo eye nàɖe/tɔ te sync daemon:
7. Ransomware: Ŋusẽ hehe tsia nya ɣaɣlawo ƒe kaawo nu (AES / ChaCha20 dɔwɔlawo) tso agbalẽdzraɖoƒe susɔe siwo wometsɔ nya ɣaɣlawo ɣla o la ɣla ɖe wò nutoa me ʋu dzi eye wòkpɔa RAM safui siwo metrɔna o ta ne ehiã be woaku nu me le ʋɔnudrɔ̃ƒe ƒe ŋkuɖodzinu ŋu.
8. Tɔtrɔ le vo me: Amewuwu OneDrive.exe / Dropbox.exe / GoogleDriveFS.exe le Dɔdzikpɔla (Ctrl + Shift + Esc) alo Dɔwɔnawo Dzikpɔla enumake ale be nutoa me asisi la nadzudzɔ fli me nɔnɔ DELETE API yɔyɔwo.
9. MÈGAtsɔ asi atutu faɛl siwo wotsɔ ransomware encrypted la ɖa o (.locked) le alilikpo me web ƒe ŋgɔdonya me ne malware la trɔ ŋkɔ na faɛl ƒe kpeɖeŋutɔawo:
10. Se alesi ransomware wɔa dɔ kple cloud storage gɔme:
    • Nudzɔdzɔ A: In-Place Overwrite (Filename ɖeka): Wotsɔ nya ɣaɣlawo ɣla ɖe tafevɔsa la dzi Tax_2025.xlsx eye wòdzra payload si wotsɔ nya ɣaɣlawo ŋlɔ la ɖo ɖe ŋkɔ ma ke tututu te Tax_2025.xlsx. Le afisia la, alilikpo me dɔwɔƒea wɔa nu ɖe faɛl si wotsɔ nya ɣaɣlawo ŋlɔ la ŋu abe Version 2 ene, esime wò faɛl gbãtɔ dzadzɛa nɔa ete dedie abe Version 1 le Version History.
    • Nya B: Trɔ Ŋkɔ + Tsɔ Gbãtɔ Tutu (Tax_2025.xlsx.lockbit): Egbegbe ransomware akpa gãtɔ xlẽna Tax_2025.xlsx, ŋlɔa faɛl yeye si ŋkɔe nye Tax_2025.xlsx.lockbit, eye tutu gbãtɔa ɖa Tax_2025.xlsx. Afisiae, wò gbãtɔ dzadzɛa Tax_2025.xlsx le anyinɔƒe le Alilikpo Gbeɖuɖɔ / Gbugbɔgazã Bin (kple point-in-time akɔnta rollback) me.
11. Ge ɖe alilikpo me nyatakakadzraɖoƒea (onedrive.live.com, . dropbox.com, . drive.google.com, . icloud.com) tso mɔ̃ si le DZADZƆ, si me NUSIWO ME DƆA LE O (abe asitelefon si le asitelefon dzi nyatakakawo dzi alo kɔmpiuta si ɖe eɖokui ɖe aga ene):
12. Mègatrɔ yi wò alilikpo me akɔnta me tso kɔmpiuta si dzi ransomware le la dzi gbeɖe o, eye enumake te fli ɖe kɔmpiuta si ŋu dɔlékuia le ƒe OAuth device session le wò Google, Microsoft, alo Dropbox Account Security ƒe axaa te ale be PC si ŋu dɔlélea le la nagadze egɔme awɔ ɖeka ne ame aɖe gaʋui ake o.
13. Zã Point-in-Time ƒe Akɔntabubu ƒe Trɔtrɔ (Restore your OneDrive alo Dropbox Rewind) le esi teƒe be woagbugbɔ faɛl 50,000 aɖo ɖekaɖeka:
14. Microsoft OneDrive kple Dropbox siaa ƒe ɣeyiɣi ƒe mɔ̃ si wɔa dɔ le eɖokui si si wɔa dɔ le akɔntabubu bliboa me si ƒoa agbalẽdzraɖoƒe ɖesiaɖe, faɛl ƒe tɔtrɔ, kple nusi wotutu ɖa le wò ʋu bliboa dzi trɔna yia ɣeyiɣi ƒe dzesi aɖe koŋ dzi (1 hour ago, . Yesterday at 11:00 PM, alo vaseɖe 30 to 180 days ago) le server-side dɔwɔwɔ ɖeka me.

--- .

Nyametsotso ƒe ati: alilikpo ƒe ɖekawɔwɔ ƒe afɔku ƒe mɔxexeɖedɔléle nu kple ɣeyiɣi aɖe ƒe hayahaya¶

Wɔ dɔwɔwɔ kpata sia be nàtɔ te cross-device sync kaka eye nàgbugbɔ wò alilikpo ƒe nɔnɔme dzadzɛ la aɖo te:

flowchart TD
    Start["Ransomware Encryption ALOO Vodadatɔe Mass Deletion Syncing To Cloud Drive"] --> CutNet["ATA 1: Ðe Ethernet & Tsi Wi-Fi le Source Kɔmpiutaa dzi Enumake (Alo Ðe Wi-Fi Router Power Cord la ɖa)"]

    CutNet --> SaveSecondaries["ATA 2: Na Secondary Laptops/PCs Katã Nanɔ Internet Dzi (Yameʋu ƒe Nɔnɔme) -> Kpɔ Woƒe Local 'OneDrive / Dropbox / Google Drive' Cache Folders ƒe Kɔpi ɖe External USB Drive dzi"]

    SaveSecondaries --> RevokeSession["ATA 3: Tso Telefon/Browser Dzadzɛ me, Ʋu Akɔntabubu ƒe Dedienɔnɔ (Google / Microsoft / Dropbox) -> Te fli ɖe PC si ŋu Dɔlékui Le ƒe Desktop Sync Session la ɖa / Ðe kadodo ɖa"]

    RevokeSession --> WhichCloud{"Alilikpo me Nudzraɖoƒe Kae Woƒo?"}

    WhichCloud -->|"Microsoft OneDrive / SharePoint (Ame ŋutɔ tɔ alo Microsoft 365) ."| OneDriveRestore["Zã 'Ðoɖowo -> Tiatia -> Gbugbɔ wò OneDrive' (Trɔ asi le Trɔtrɔwo, Ŋkɔwo Trɔtrɔ, & Tsɔtsrɔ̃wo Katã Ŋu Le Akɔntabuƒe Bliboa Dzi Vaseɖe Ŋkeke 30) + Kpɔ 1st & 2nd-Stage Recycle Bin"]

    WhichCloud -->|"Dropbox (Plus, Ƒome, Dɔnyala, Asitsatsa, alo Gɔmeɖose)"| DropboxRestore["Zã ‘Dropbox Rewind’ le Root Folder (Trɔ Akɔntabuƒe Bliboa ɖe Aɖabaƒoƒo Pitɔ Hafi Amedzidzedze) ALOO Zã ‘Deleted files’ + ‘Events’ Log (Ŋkeke 30 va ɖo 180)"]

    WhichCloud -->|"Google Drive (Ame ŋutɔ ƒe Gmail alo Google Dɔwɔƒe) ."| GDriveRestore["1. Ðo ‘Trash’ ɖe ‘Trashed date’ nu ɖe Bulk-Restore Deleted Originals me. 2. Na Faɛl Siwo Woŋlɔ Ðe Edzi: Zi Nuɖusi dzi -> 'Fail ŋuti nyatakakawo -> Dzra tɔtrɔwo dzi' ALOO nàwɔ Google Drive API v3 Bulk Revision Rollback Script"]

    WhichCloud -->|"Apple ƒe iCloud Ʋukuku"| iCloudRestore["Ge ɖe 'iCloud.com/recovery' me -> Zi 'Gbugbɔ Faɛlwo' (Gbua Faɛl Siwo Wotutu Le Ŋkeke 30 Mamlɛawo Me, Ne Woƒu Kloe Tso Wo Tutu Nyitsɔ Laa Me Gbɔgbɔ)"]

--- .

Akpa 1: Alesi cloud sync engines wɔa dɔ tso ransomware ŋu vs. mass deletion (Afisi wò faɛl dzadzɛwo le ŋutɔŋutɔ)¶

Hafi nàzi restore buttons dzi le vɔvɔ̃ me la, lé ŋku ɖe alesi wotrɔ wò faɛlwo le cloud web portal (drive.google.com, . onedrive.live.com, alo dropbox.com). Alilikpo ƒe ɖekawɔwɔ ƒe nudzɔdzɔ ɖesiaɖe dzena ɖe mɔ̃ɖaŋununya ƒe ɖoɖo etɔ̃ dometɔ ɖeka me:

--- .

Akpa 2: Nuƒolanɔƒe ɖesiaɖe ƒe alilikpo rollback kple bulk version gbugbɔgaxɔ¶

Wɔ ɖe wò alilikpo me dɔwɔƒea ƒe hayahaya ƒe ɖoɖo tututu dzi tso browser si le dzadzɛ, si me dɔlékui mele o.

1. Microsoft OneDrive & SharePoint le Internet dzi (Restore Your OneDrive & 2-Afɔɖeɖe Gbugbɔgazã ƒe Bin)¶

Microsoft trɔ asi le OneDrive ŋu koŋ be wòatsi agbe le ransomware encryption kple mass sync ɖeɖeɖa me:

1. Mɔnu A: Akɔntabubu Bliboa ƒe Point-le-Time Rollback (Restore your OneDrive):
2. Woate ŋu akpɔe le Microsoft 365 Ame ŋutɔ, Ƒome, Asitsaha, Kple Dɔwɔƒe (SharePoint Online nuŋlɔɖiwo ƒe agbalẽdzraɖoƒewo):
3. De asi ete onedrive.live.com (alo wò Microsoft 365 OneDrive nyatakakadzraɖoƒe) le kɔmpiuta dzadzɛ dzi.
4. Zi Settings Gear ƒe dzesi (le etame le ɖusime) -> tia ** .Options** -> zi ** dzi.Restore your OneDrive** le miame ƒe mɔfiame ƒe akpaa dzi (le SharePoint ƒuƒoƒo ƒe nyatakakadzraɖoƒewo la, zi ** dziSettings Gear -> Restore this library**).
5. Le ** te.Select a date, tia ** .Yesterday (alo Custom date and time).
6. Kpɔ Dɔwɔwɔ ƒe Histogram Bar Chart: àkpɔ dzidziɖedzi gã aɖe le ɣeyiɣi ƒe ɖoɖoa dzi si de dzesi aɖabaƒoƒo si tututu tafevɔsa ƒe nya ɣaɣla alo etutu le agbɔsɔsɔ gã me dze egɔme.
7. He ɣeyiɣikɔntabubu ƒe ʋuƒoa yi spike ma ƒe miame (ale be woalé ŋku ɖe faɛl vɔ̃ɖi ɖesiaɖe si wowɔ ƒe ŋkɔ, ŋɔŋlɔ ɖe edzi, kple etutu si wowɔ le miniti ma megbe ŋu be wogbugbɔe ɖa hã).
8. Zi ** dzi.Restore**. Microsoft ƒe dɔwɔƒewo agbugbɔ faɛl ƒe tɔtrɔ ɖesiaɖe ɖa le wo ɖokui si, atutu ransomware yeye si wowɔ la ɖa .locked faɛlwo, eye nàgbugbɔ faɛl gbãtɔ siwo katã wotutu ɖa la aɖo woƒe agbalẽdzraɖoƒe ƒe ɖoɖo si tututu wowɔ tso do ŋgɔ na nudzɔdzɔa me.
9. Mɔnu B: "Second-Stage Recycle Bin" si Woɣla (Ne woɖe Recycle Bin si sɔ la ƒuƒlu):
10. Ke ne amedzidzela aɖe (alo script si wowɔ le eɖokui si) ge ɖe wò OneDrive/SharePoint web interface me eye wòzi ** dzi ya ɖe.Empty recycle bin**?
11. Le OneDrive for Business / SharePoint Online (kple Microsoft 365 ƒe akɔntabubuwo) dzi la, Recycle Bin gbãtɔa kɔklɔ metutua wò faɛlwo o. Ke boŋ eʋua wo yia Afɔɖeɖe Evelia ƒe Nudzraɖoƒe (Site Collection Recycle Bin) afisi wokpɔa wo ta le vaseɖe ŋkeke 93 le wo katã me:
    1. Ʋu ** .Recycle bin** le OneDrive ƒe miame.
    2. Yi axaa ƒe gɔmedzedze ke eye nàzi kadodo sue si xlẽ be: Can't find what you're looking for? Check the Second-stage recycle bin.
    3. Tia faɛlwo katã eye nàzi ** dzi.Restore**.

2. Dropbox (Dropbox Rewind, . Events Rollback, kple Deleted Files) .¶

1. Mɔnu A: Zãzã Dropbox Rewind be nàgbugbɔ Agbalẽdzraɖoƒe Bliboa Alo Wò Akɔntabubu Bliboa Agbugbɔe:
2. Woate ŋu akpɔe le Dropbox Plus, Ƒome, Dɔnyala, kple Asitsatsa ƒe ɖoɖowo dzi (30 days yi 180 days ŋkuléle ɖe megbe ŋu):
3. De asi ete dropbox.com le web-browser si le dzadzɛ dzi.
4. Be nàgbugbɔ wò Dropbox akɔnta bliboa atrɔ zi ɖeka la, tsɔ asi ɖo ** .All files** tanya (alo zi ** dzi .... (Nuwɔna bubuwo)** menu le ɖusime nuwɔna ƒe akpaa dzi ne wometia agbalẽdzraɖoƒe aɖeke koŋ o) eye nàzi ** .Rewind this folder** (alo Rewind Dropbox).
5. Zi ** dzi.Get started** -> kpɔ gbesiagbe dɔwɔnawo ƒe nɔnɔmetata be nàkpɔ spike esime ransomware alo etutu dzɔ -> zi ŋkeke ma dzi be nàdzi gaƒoƒo ɖesiaɖe / miniti ɖesiaɖe ƒe ɣeyiɣikɔntabubu ɖe edzi.
6. Ðo fli blɔ si le tsitrenu la ɖe teƒe si hafi nudzɔdzɔ gbegblẽa nadze egɔme, te ** .Continue, eye nàzi ** dzi.Rewind.
7. Dropbox atrɔ faɛl siwo katã woŋlɔ ɖe edzi, akɔ ransomware ƒe nuŋlɔɖi yeye siwo wotsɔ kpe ɖe eŋu la ɖa, eye wòafɔ agbalẽdzraɖoƒe siwo katã wotutu ɖa la ɖe te.
8. Mɔnu B: Ke ne èle Free dzi ya ɖe Dropbox Basic akɔntabubu (afisi Dropbox Rewind nye nusi wotu)?
9. Vevietɔ: Le femaxee gɔ̃ hã dzi Dropbox Basic (2 GB) akɔnta, Dropbox gakpɔtɔ lé ŋkeke 30 bliboa ɖe asi Version History kple ŋkeke 30 ƒe Deleted Files gbugbɔgaxɔ na faɛl ɖekaɖeka ɖesiaɖe le woƒe dɔwɔƒewo.
10. Tiatia 1 (Aɖaŋuɖoɖo Femaxee): Zi ** dzi.Deleted files** le miame ƒe axadzinuŋɔŋlɔ ƒe dropbox.com be woatsɔ ŋkeke si dzi woakɔ wo me eye woagbugbɔ gbãtɔ siwo woɖe ɖa la aɖo wo teƒe le agbɔsɔsɔ gã me; alo nàzi ** dzi.... -> Activity -> Version history** le faɛl ɖesiaɖe si woŋlɔ ɖe edzi dzi be woagbugbɔ asitɔtrɔ dzadzɛ si wowɔ va yi la aɖo.
11. Tiatia 2 (Enumake Dropbox Plus Upgrade Unlock): Esi Dropbox ŋlɔa nudzɔdzɔ ƒe nuŋlɔɖi si le ete la ɖe akɔntawo katã me eɖanye tier ka kee o, ewɔa ŋgɔyiyi a Dropbox Basic akɔntabubu na Dropbox Plus ($11.99 hena ɣleti 1) le nudzɔdzɔ aɖe megbe la, eʋu ** .Dropbox Rewind** UI le ŋkeke 30 siwo va yi me le faɛl nudzɔdzɔ siwo woŋlɔ ɖi xoxo.

3. Google Drive & Google Dɔwɔƒe (Trash, . Manage Versions, . Admin Console 25-Day Post-Trash Recovery, kple Bulk API Rollback) .¶

To vovo na OneDrive kple Dropbox la, Google Drive mekpɔa "Rewind Entire Drive" ƒe dzesi ɖeka pɛ hã le nuƒlela ƒe UI me o, eyata ele be nàzã gbugbɔgaxɔmɔnu nyuitɔ le nenye be **wotutu faɛlawo ** alo ŋlɔ wo ɖe wo nɔƒe nu:

1. Gbugbɔgaxɔ Gbãtɔ Siwo Wotutu Tso Google Drive Trash (Na Trɔ Ŋkɔ+Tutu Ransomware alo Mass Deletion):
2. Ʋu ** .drive.google.com/drive/trash** le kɔmpiuta dzi nyatakakadzraɖoƒe.
3. Zi ** dzi.Trashed date** kɔlam ƒe ta be nàtsɔ aɖo faɛl siwo wotutu nyitsɔ laa la ɖe etame.
4. Zi faɛl dzadzɛ gbãtɔ si ransomware/afɔkua tutu la dzi, ʋu yi anyime, lé ** ɖe asi .Shift + zi** faɛl mamlɛtɔ si le batch la me dzi, zi ɖusi dzi, eye nàtia ** .Restore** (Ctrl + Z alo Gaƒoɖokui ƒe dzesi si nye Restore). Fail ɖesiaɖe trɔna yia eƒe dzila ƒe agbalẽdzraɖoƒe gbãtɔ si wotsɔ atɔ ɖo la me tẽ.
5. Ke ne Google Drive la ya ɖe Trash nye Emptied xoxoa? (Google One Support & . Google Workspace Admin 25-Day Rescue):
6. Google Dɔwɔƒe (Asitsatsa, Dɔwɔƒe, Sukudede, Viɖemakpɔmakpɔ): Ne zãla aɖe te ** vɔ gɔ̃ hã.Empty trash -> Delete forever, Google ƒe dɔwɔƒewo léa faɛl siwo ŋu wokɔ la ɖe te hena ŋkeke 25 bubu. Ge ɖe eme ** .admin.google.com abe Super Admin ene -> yi ** .Directory -> Users** -> zi zãla si ŋu wòku ɖo la dzi -> yi anyime yi ** .More options** (alo zi miame ƒe akpa si le zãla ƒe kpukpui te) -> zi ** dzi .Restore data** -> tia Ŋkeke ƒe didime (vaseɖe ŋkeke 25 megbe), tia Drive abe dɔwɔnua ene, eye nàzi ** dzi .Restore**.
7. Ame ŋutɔ ƒe Gmail / Google One ƒe Akɔntabubu: Ne wò ŋutɔ wò Google Drive Gbeɖuɖɔ ƒuƒlu le ŋkeke 25 siwo va yi me la, mègaŋlɔ nyatakaka yeyewo ɖe ʋua me o; ʋu enumake ** .support.google.com/drive/gethelp* (alo Google One ƒe kpekpeɖeŋu dzeɖoɖo) eye nàbia Administrative Drive Deleted File Recovery. Google ƒe kpekpeɖeŋunadɔwɔnu ate ŋu aʋã ŋkeke 25 ƒe gbeɖuɖɔ megbe megbenyawo gbugbɔgaɖoanyi ma ke tututu na nuƒlelawo ƒe akɔntabubuwo.
8. Bulk-Gbugbɔgaɖoanyi Faɛl Siwo Woŋlɔ Ðe Dzi Zãzã Manage Versions alo Google Drive API (rclone / Python):
9. Ne èdi Google Docs, Sheets, kple Slides: Ʋu faɛl la -> zi ** dzi .File -> Version history -> See version history** (Ctrl + Alt + Shift + H) eye nàgbugbɔ etsɔ ƒe ɣeyiɣi ƒe dzesi la aɖo anyi.
10. Le binary faɛlwo gome la (PDF, . DOCX, . XLSX, . JPG, . ZIP) si woŋlɔ ɖe teƒea: Zi faɛl la dzi kple ɖusi le Google Drive -> File information -> Manage versions, afisi Google léa xoxoawo ɖe asi hena ŋkeke 30 (alo tɔtrɔ 100).
11. Ne woŋlɔ binary file akpe geɖe ɖe teƒea: Mègazi edzi o Manage versions zi gbɔ zi 10,000 kple asi. Zã ** .rclone** alo Google Apps Script / Ʋukuku API v3 revisions.list + revisions.delete ŋɔŋlɔdzesi:
    • Le Google Drive API v3 me la, ne woŋlɔ faɛl si li xoxo ɖe edzi kple tɔtrɔ yeye gbegblẽ (Revision N), yɔyɔ be ** .Drive.Revisions.remove(fileId, latestRevisionId)** tutua top revision vɔ̃ɖi si wowɔ egbea ko, doa etsɔ ƒe Revision dzadzɛ la ɖe ŋgɔ le eɖokui si N - 1 trɔ yi megbe be wòanye faɛl si le dɔ wɔm fifia le agbalẽdzraɖoƒewo katã me:

      // Run inside script.google.com (with Advanced Drive Service v3 enabled) to roll back files modified after cutoffTime
      function rollbackOverwrittenFiles() {
        const cutoff = new Date("2026-11-01T00:00:00Z"); // Set to 5 minutes BEFORE the ransomware started
        const files = DriveApp.searchFiles('modifiedDate > "2026-11-01T00:00:00" and trashed = false');
        while (files.hasNext()) {
          const file = files.next();
          const revs = Drive.Revisions.list(file.getId()).revisions;
          if (revs && revs.length > 1) {
            const latest = revs[revs.length - 1];
            if (new Date(latest.modifiedTime) > cutoff) {
              Drive.Revisions.remove(file.getId(), latest.id);
            }
          }
        }
      }
      

12. Akɔɖu iCloud Drive (iCloud.com/recovery Ŋkeke 30 ƒe Nyatakakawo Gbugbɔgaxɔ):
13. Ne woɖe faɛlwo ɖa le iCloud Drive eye woɖe wo ɖa le... Recently Deleted agbalẽdzraɖoƒe si le wò Mac alo iPhone dzi la, ge ɖe ** .icloud.com/recovery** le nyatakakadzraɖoƒe aɖe me:
14. Zi ** dzi.Restore Files** -> ɖakpɔ ** .Select All** (alo nàɖe ŋkeke si dzi wotutu ɖa) eye nàzi ** dzi.Restore**. Apple ƒe megbenyawo ƒe dɔwɔƒea léa ŋkeke 30 ƒe nuwo gbugbɔgaxɔ ƒe nudzraɖoƒe si le vovo si gbugbɔa iCloud Drive ƒe nuŋlɔɖi siwo wotutu, Desktop/Documents ƒe agbalẽdzraɖoƒewo, Bookmarks, Contacts, kple Calendars ɖoa te.

--- .

Akpa 3: Nuŋeŋe nutoa me offline caches tso evelia mɔ̃wo kple Google DriveFS / Windows Shadow Copies¶

Hafi nàgatsɔ kɔmpiuta aɖe aƒo ka na internet la, kpɔe ɖa be wò faɛlwo ƒe kɔpi siwo megblẽ o gakpɔtɔ le wò hard drive siwo le mia gbɔ la me hã:

--- .

Akpa 4: Safe reconnection protocol (Alesi woawɔ agbugbɔ kɔmpiuta siwo ŋu wokɔ aɖo Internet dzi evɔ màgagblẽ alilikpoa ake o)¶

Vodada siwo bɔ wu le alilikpo gbugbɔgaxɔ me dometɔ ɖeka dzɔna ne nègbugbɔ wò faɛlwo ɖo dzidzedzetɔe le alilikpo ƒe nyatakakadzraɖoƒe ƒe ŋgɔdonya me vɔ megbe: zãla la gaʋu woƒe kɔmpiutadziɖoɖoa ake, nutoa me ƒe sync client la nyɔ, ekpɔ 20,000 .locked ransomware faɛlwo (alo agbalẽdzraɖoƒe ƒuƒluwo) siwo bɔbɔ nɔ teƒea ƒe hard drive dzi, eye ewɔa nu gbegblẽa ɖe ɖoɖo nu yia cloud drive si wogbugbɔ ɖo te yeyee la gbɔ.

Wɔ ɖe kadodo yeye ƒe ɖaseɖigbalẽ sia dzi: 1. Le kɔmpiuta si he nudzɔdzɔa vɛ dzi (Ransomware alo Accidental Script): - Ne Ransomware ƒoe: Mègagbugbɔ OS-ɖoɖo ma do ka kple wò alilikpo me akɔnta gbeɖe o. Ne èwɔ nɔnɔmetata na ʋua hena ʋɔnudrɔ̃nyawo alo xɔ na teƒea ɖeɖeko ƒe faɛl ɖesiaɖe si womewɔ kɔpi na o vɔ la, tutu SSD la keŋkeŋ (Secure Erase / tutu mamaawo katã ɖa) eye nàkɔ Windows alo macOS ɖe USB-ɖoɖomɔ̃ nyui si wonya si wotu ɖe kɔmpiuta si le vovo dzi la me. - Trɔ wò Google, Microsoft, Dropbox, kple Apple akɔnta ƒe nyagbewo eye nàlé ŋku ɖe Account Security -> Devices kple ** .Third-Party App Permissions** be nàɖo kpe edzi be infostealer session cookies aɖeke megale dɔ wɔm o. 2. Le kɔmpiuta evelia dzi hafi nàgaʋu Wi-Fi ake: - Ne ègbugbɔ cloud drive la ɖo nɔnɔme dzadzɛ me xoxo to Restore your OneDrive alo Dropbox Rewind: 1. Dze kɔmpiuta evelia gɔme kple Wi-Fi si gakpɔtɔ le OFF. 2. Nuwɔametɔe OneDrive / Dropbox / Google Drive le Gɔmedzedze Dɔwɔɖoɖowo (Task Manager -> Startup apps) eyata sync daemon mateŋu adze egɔme le eɖokui si o. 3. Trɔ ŋkɔ na nutoa me tɔ C:\Users\<Name>\OneDrive (alo Dropbox) ƒe agbalẽdzraɖoƒe yi OneDrive_OLD_LOCAL_BACKUP. 4. Gaʋu Wi-Fi, ʋu cloud sync app la, na wòaɖe kadodoa ɖa eye wòagaɖo kadodoa me dzadzɛ, eye nàɖe mɔ nɛ wòaɖe alilikpo dzadzɛ ƒe nɔnɔme si wogbugbɔ ɖo yeyee la ɖe agbalẽdzraɖoƒe yeye aɖe ŋutɔ.

3. Windows Gbugbɔgaɖoanyi Volume Shadow Copies (Previous Versions) kple macOS APFS Nutoa me ƒe Nɔnɔmetatawo le Source PC la dzi¶

Ke ne woɖe agbalẽdzraɖoƒe si wotsɔ nya ɣaɣlawo ŋlɔ alo tutu ɖa le alilikpo ƒe wɔwɔ ɖekae me (abe nutoa me tɔ ene ya ɖe Desktop folder alo faɛl si lolo wu sync limit), alo cloud sync client la mewu kwasiɖa si va yi ƒe ɖɔɖɔɖowo dada nu hafi wòdze anyi o? 1. Le Windows 10 / 11 dzi (ShadowExplorer & . vssadmin): - Togbɔ be ransomware ƒome geɖe dzea agbagba be yewoaƒu du hã vssadmin.exe delete shadows /all /quiet, Zãla ƒe Akɔntabubu Dzikpɔkpɔ (UAC), Nuwuƒe Detekpɔ Kple Ŋuɖoɖo (EDR), alo non-admin execution xea mɔ na vɔvɔli ƒe kɔpi tutu enuenu. - Wɔ Sedede ƒe Nyabiase abe Dɔdzikpɔla ene le mɔ̃ si woɖe ɖe aga la dzi eye nàŋlɔ:

vssadmin list shadows

--- .

Nya siwo wobiaa amewo enuenu¶

Ðe susu le ransomware gbevuha la ƒe decryptor tafe xexe ne wotsɔ nye faɛlwo wɔ ɖeka kple OneDrive, Dropbox, alo Google Drive?¶

Gbeɖe kloe o. To vovo na nutoa me hard drive si le eɖokui si si womewɔa kɔpi na o la, alilikpo me nudzraɖoƒedɔwɔƒewo (OneDrive ƒe ʋu, . Dropbox ƒe aɖaka, . Google Drive ƒe ʋukuku, . Aɖaka, kple iCloud Ʋukuku) dzraa faɛlwo ɖo ɖe nusiwo wodzrana ɖo ƒe megbenya siwo womate ŋu atrɔ o dzi afisi tɔtrɔ ɖesiaɖe wɔa nu yeye ƒe tɔtrɔ eye tutu ɖesiaɖe tsɔa nu la yia ŋkeke 30 (alo ŋkeke 93 va ɖo 180) gbeɖuɖɔgoe me. Eɖanye be ransomware la ŋlɔ wò faɛlwo ɖe teƒea alo wɔ yeyewo o .wotu wo faɛlwo me eye wotutu gbãtɔawo ɖa, . Wò faɛl gbãtɔ siwo wometsɔ nya ɣaɣlawo ɣla o ƒe alafa memama 100 gakpɔtɔ le alilikpo me dɔwɔƒea ƒe dɔwɔƒewo le Version History alo Trash me. Zãzã Gbugbɔ wò OneDrive la ɖo anyi, . Dropbox ƒe megbedede, alo Google Drive Trash and Revision recovery gbugbɔa wò faɛl siwo tututu nèwɔ do ŋgɔ na amedzidzedzea la ɖoa anyi femaxee eye afɔku aɖeke mele ransomware decryptors siwo gblẽ ŋu o.

Nukatae ransomware si le nye Windows PC dzi te ŋu tsɔ nya ɣaɣlawo ɣla nye Google Drive alo OneDrive le gɔmedzedzea me? Ðe alilikpoa mekpɔa ame ta tso kɔmpiutadziɖoɖo vɔ̃ɖiwo me oa?¶

Be alilikpo me faɛlwo nawɔ dɔ kple kɔmpiutadziɖoɖowo abe Microsoft Word, Excel, Photoshop, kple AutoCAD ene la, desktop sync clients (Google Drive na Dɔwɔɖoɖo, . OneDrive.exe ƒe agbalẽ, . Dropbox.exe ƒe agbalẽ) do wò alilikpo me nudzraɖoƒe abe a nutoa me ƒe agbalẽdzraɖoƒe alo virtual drive ƒe ŋɔŋlɔdzesi (G:\ alo C: \ Zãlawo \ Ŋkɔ \ OneDrive) . le wò Windows zãla ƒe mɔɖeɖewo te. Ne ransomware le dɔ wɔm le wò Windows zãla ƒe akɔnta te la, mɔɖeɖe siwo nèwɔna tsɔ trɔa asi le faɛlwo ŋu la kee tututu le esi: ezɔa ʋu ƒe ŋɔŋlɔdzesi ɖesiaɖe si woda ɖe edzi (C:\ ., . D:\ ., . G:\) kple zãla ƒe agbalẽdzraɖoƒe, nàxlẽ faɛl ɖesiaɖe, atsɔ nya ɣaɣlawo aɣlae, eye nàdzrae ɖo. Fail siwo woɖo ɖe... "Internet-Ko / Stream Faɛlwo" (Failwo le Nudidi Nu) . get automatically downloaded ("hydrated") on the fly by Windows ɣesiaɣi si ransomware ƒe dɔwɔwɔ ʋu faɛl ƒe asiléƒea be wòaxlẽe. Esia tae network la ƒe elektrikŋusẽ ɖeɖeɖa enumake le vevie ŋutɔ: egblẽa alilikpo me faɛl siwo le Internet dzi ɖeɖeko ƒe tsi ƒe kɔpi si wobia tso ame si la me hafi ransomware la te ŋu xlẽa wo.

Ke ne metutu Shared Folder gã aɖe si le Google Drive alo Dropbox me le vo me, eye ƒuƒoƒoa me tɔ bubuwo tɔe faɛl siwo le eme la dometɔ aɖewo ya ɖe?¶

Le Dropbox ƒe aɖaka, hamevi ɖesiaɖe si si mɔɖeɖe le be wòatrɔ asi le eŋu ate ŋu azã Faɛl siwo wotutu ɖa alo Dropbox ƒe megbedede le agbalẽdzraɖoƒe si woama la dzi be woagbugbɔ agbalẽdzraɖoƒe ƒe ɖoɖo bliboa aɖo anyi na ƒuƒoƒo bliboa. Le Google Drive ƒe ʋukuku, aƒetɔ ƒe xɔtuɖaŋu le etɔxɛ: ne ètutu agbalẽdzraɖoƒe sue aɖe le ame bubu ƒe Agbalẽdzraɖoƒe si Woma (afisi... wo nye Aƒetɔ eye nènye Nuŋlɔla), si ɖea faɛl la ɖa le agbalẽdzraɖoƒe si woama la me tsyɔ̃eviwo faɛl la tsɔ wu be nàtsɔe aƒu gbe ɖe gbeɖuɖɔ me na etɔ, alo aʋuʋu faɛlawo ɖeɖeko wò own into wò Gbeɖuɖɔ (drive.google.com/ʋukuku/gbeɖuɖɔ) esime faɛl siwo le wò dɔwɔhati si la gena ɖe eme woƒe Gbeɖuɖɔ (alo zu tsyɔ̃eviwo le woƒe ke Drive searchable via nye:nutɔ:nye si mewɔ ɖoɖo o le Google Drive ƒe didiƒekpɔmɔ̃a me).

Ðe ransomware ate ŋu atutu nye Cloud Version History alo akɔ nye OneDrive / Google Drive Recycle Bin le eɖokui sia?¶

Fail-ɖoɖo ƒe ransomware binaries siwo wozãna ɖaa (LockBit ƒe dɔwɔwɔ, . Akira ƒe ŋkɔ, . BlackCat ƒe ŋkɔ, . Fefe, . Phobos ƒe ŋkɔ) wɔa dɔ to Windows faɛlɖoɖo ƒe API siwo le teƒea dzi ko (WɔFileW, . Ŋlɔ Faɛl, . DeleteFileW ɖa) kple mate ŋui o wɔ nu kple web-only Version ƒe Ŋutinya, . Afɔɖeɖe Evelia ƒe Nudzraɖoƒe, alo Google Dɔwɔƒe ƒe Dɔwɔƒedzikpɔla ƒe Nudzraɖoƒe. Gake ne amedzidzela la hã de dɔ aɖe nyatakakafifila ( .Lumma ƒe ŋkɔ, . DzĩLine) . alo Remote Desktop (RDP ƒe dɔwɔwɔ / AnyDesk) yi wò web browser si le ʋuʋu ɖi dzi la, woate ŋu atsɔ asi aʋu wò web browser la eye woazi edzi Gbeɖuɖɔ Ƒuƒluwo. Ne wowɔe hã la, ɖo ŋku megbetɔ eve siwo koŋ dzi woatɔ ɖo la dzi: (1) On OneDrive / Mamã ƒe Point, nu ƒuƒluwo yia Afɔɖeɖe Evelia ƒe Nudzraɖoƒe hena ŋkeke 93 sɔŋ; kple (2) Le Google Drive / Google ƒe Dɔwɔƒe, Gbeɖuɖɔ me nu ƒuƒluwo gakpɔtɔ nye esiwo Dɔwɔƒe ƒe Dɔdzikpɔla alo Google One ƒe Kpekpeɖeŋunala ate ŋu axɔ Ŋkeke 25 le etutu tegbee megbe.

--- .

Mɔfiame siwo do ƒome kplii¶

• Ransomware kple malware: wo ɖeɖe ɖe aga enumake kple wo gbugbɔgaxɔ
• Fail tutu le vo me, ʋu si woɖo ɖe ɖoɖo nu, kple fotowo gbugbɔgaxɔ
• Word, Excel, PDF, alo nyatakakadzraɖoƒe ƒe faɛl si gblẽ kple nuŋlɔɖi siwo womedzra ɖo o gbugbɔgaxɔ
• Kɔmpiuta dzi nyatakakawo: 3-2-1 ƒe aɖaŋu kple afɔkuwo gbɔ kpɔkpɔ
• Session cookie hijacking, infostealer malware, kple passkey ɖeɖeɖa
• Xexlẽdzesi siwo woxɔna kpata le dukɔwo nu

--- .

Dzɔtsoƒewo kple dziɖuɖumegãwo ƒe mɔfiame¶

• Microsoft ƒe Dziɖuɖua ƒe Kpekpeɖeŋunana (support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15): Gbugbɔ Wò OneDrive (Ŋkeke 30-Ŋkeke-le-Ɣeyiɣi Rollback Histogram, Ransomware Detection Nuxlɔ̃amewo, kple Gbãtɔ / Afɔɖeɖe Evelia SharePoint Gbugbɔgazã Bin Gbugbɔgaxɔ).
• Dropbox Dziɖuɖua ƒe Kpekpeɖeŋunaƒe (help.dropbox.com/delete-restore/rewind & . recover-older-versions): Dropbox Rewind Zazã atsɔ Aɖe Ransomware alo Mass Deletions, Ŋkeke 30 va ɖo 180 ƒe Version History, kple .dropbox.cache Nuƒolanɔƒe.
• Google Workspace Admin Kpekpeɖeŋu & Google Drive Dziɖuɖua ƒe Nuŋlɔɖiwo (support.google.com/a/answer/6052340 & . developers.google.com/drive/api/reference/rest/v3/revisions): Google Drive Nyatakaka Siwo Wotutu Tegbee Gbugbɔgaɖo Le Ŋkeke 25 Me to Admin Console kple Drive API v3 dzi revisions Dɔdzikpɔkpɔ.
• Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA / StopRansomware.gov): Alilikpo me Nudzraɖoƒe Sync Ðokuisi kple Post-Ransomware Version Rollback Nuwɔna Nyuitɔwo.