ʻO Ransomware a i ʻole ka hoʻopau ʻana i ka lehulehu ma Google Drive, OneDrive, a i ʻole Dropbox e hoʻopili ana i nā faila hewa i nā mea āpau (30-Day Version History and Vault Rewind)¶

Ke nānā nei i ka ikona sync ma kāu Windows taskbar a i ʻole macOS menu bar e wili wikiwiki me nā kaukani o nā palapala ʻoihana, nā moʻolelo ʻauhau, nā kiʻi ʻohana, a me nā faila kumu i loko. Google Drive for Desktop, Microsoft OneDrive, Dropbox, a i ʻole iCloud Drive ua hoʻopili ʻia e ransomware (.locked, .bianlian, .akira, .play, .lockbit) a i ʻole holoi ʻia e kahi kuhi hewa rsync --delete, ʻo ka hoʻokuʻu ʻana a me ka hoʻokuʻu ʻana i ka waihona, a i ʻole ka palapala rogue kahi pōʻino ʻikepili wikiwiki loa. No ka mea, ua hana ʻia nā mea kūʻai aku ʻo cloud desktop sync no ka replication bidirectional manawa maoli (inotify ma Linux, FSEvents ma macOS, a ReadDirectoryChangesW / Cloud Filter API ma Windows), he ransomware binary a i ʻole ka pōʻino Shift + Delete ma hoʻokahi kamepiula maʻi maʻi hoʻolaha koke ʻia i ke kikowaena kapuaʻi a hoʻokuʻu ʻia i lalo i ** i kēlā me kēia papapihi, kamepiula, a me ka waihona hui like i pili i kēlā moʻokāki** i loko o kekona.

Eia nō naʻe, ʻaʻole ** kākau ʻia nā ʻenekini cloud sync: ma hope o nā hiʻohiʻona, Microsoft OneDrive, Dropbox, Google Drive, a Box E mālama pono i ka waiho ʻana o nā mea ʻaoʻao server me 30-lā a hiki i 180-lā mau moʻolelo moʻolelo kiko-i-manawa, Second-Stage Recycle Bins, a me nā mea hana rollback moʻokāki holoʻokoʻa (OneDrive Restore Your OneDrive a me Dropbox Rewind). I ka wā e hoʻokaʻawale koke ai ʻoe i ka kamepiula i hoʻopili ʻia mai ka pūnaewele, hoʻomaha i ka sync ma nā mīkini lua e ʻohi i nā huna huna kūloko, a pale i ka pahele make o ka hoʻouka hou ʻana i nā faila i hoʻopaʻa ʻia ma luna o kāu quota mōʻaukala mana, hiki iā ʻoe ke hoʻohuli i kāu kaʻa kapuaʻi holoʻokoʻa i ka minuke pololei ma mua o ka hoʻomaka ʻana o ka hoʻopili ʻana a i ʻole ka holoi ʻana me ka uku ʻole ʻana i kahi pānaʻi. No ka hoʻopaʻa ʻana i nā polokalamu polokalamu kamepiula kūloko a me ke kālai ʻana i nā faila, e ʻimi i kā mākou alakaʻi ransomware a me ka pane malware, ka holoi ʻia ʻana o ka faila a me ka hoʻihoʻi ʻana i ka drive formatted, a hoʻopaʻa kamepiula: 3-2-1 hoʻolālā a me ka hoʻihoʻi pōʻino. Inā hoʻouka ʻia kahi ransomware i kahi haukapila, keʻena kino, a i ʻole ka pūnaewele hoʻouna pilikia, e hoʻāla koke i nā kaʻina hana hoʻomaha ma waho a kelepona i kāu helu pilikia kūloko (911 ma ʻAmelika Hui Pū ʻIa a me Kanada, 112 ma waena o ka European Union, 999 ma United Kingdom) a i ʻole e nānā i kā mākou papa kuhikuhi o helu pilikia.

E hana i kēia i kēia manawa¶

1. Wehe i ke kaula Ethernet a hoʻopau i ka Wi-Fi ma ke kamepiula kumu KOKE (ma mua o ka pani ʻana i nā polokalamu a i ʻole ke kaomi ʻana i kekahi mea):
2. No ke aha ke ʻoki ʻana i ka ʻupena e mālama ai i kāu waihona kapuaʻi: ʻO kēlā me kēia kekona ka mea i maʻi ʻia a holoi ʻia paha ka kamepiula ma ka pūnaewele, ʻo ka mea kūʻai aku hoʻonohonoho papapihi (OneDrive.exe, GoogleDriveFS.exe, Dropbox.exe) e hoʻouka hou i 50 a 200 i hoʻopili ʻia a holoi ʻia paha nā hana faila i kēlā me kēia kekona i ka API kapua. ʻO ka ʻoki ʻana i ka Wi-Fi a me ka Ethernet e hoʻokuʻu i ka laina hoʻouka ao ma kāna mau ala.
3. E hele i KĀNĀ ʻEkahi kamepiula, papapihi, papa, a me ke kelepona i hoʻopili ʻia i ka waihona kapuaʻi like a hoʻopau i kā lākou Wi-Fi / Ethernet ma mua o ka hoʻāla ʻana i kā lākou mau pale:
4. ** ʻO kāu kamepiula paʻa waho lua he pahu manawa maʻemaʻe **: Inā ua hiamoe kāu papapihi home a i ʻole MacBook lua i loko o kāu ʻeke mai nehinei, kona wahi OneDrive, Dropbox, a i ʻole Google Drive (Mirror files / Always keep on this device) paʻa i ka 100 pakeneka i hoʻopili ʻole ʻia, kope ʻole ʻia o kāu mau faila.
5. Inā hoʻāla ʻoe i kēlā kamepiula lua ʻoiai ʻo Wi-Fi, hoʻopili koke ka daemon sync cloud, hoʻoiho i ka holoi ʻana a i ʻole ransomware ciphertexts mai ke kikowaena, a luku i kēlā kope kūloko kūloko ma lalo o 60 kekona. E hoʻopau i kāu kelepona Wi-Fi home (e wehe i kāna kaula mana) ma mua o ka hoʻāla ʻana i kekahi kamepiula lua, a laila kope i nā waihona kūloko ma kahi kaʻa USB waho ma waho.
6. **Inā ʻo Ransomware ke kumu, e huki i ke kaula mana (a i ʻole e hoʻopaʻa ikaika i ke pihi Mana no 10 kekona) ma ka PC maʻi; inā ʻo ke kumu ʻo ka hoʻopau ʻana i kahi SSD, waiho i kahi kaʻawale a wehe a hoʻōki i ka daemon sync **:
7. Ransomware: ʻO ka huki ʻana i ka mana e hoʻōki i nā kaula hoʻopili (AES / ChaCha20 nā limahana) mai ka hoʻopili ʻana i nā waihona i hoʻopili ʻole ʻia ma kāu kaʻa kūloko a mālama i nā kī RAM volatile inā pono ka nānā ʻana i ka hoʻomanaʻo forensic.
8. ** Holoi ʻAkaʻole **: Pepehi OneDrive.exe / Dropbox.exe / GoogleDriveFS.exe ma ka Luna Hana (Ctrl + Shift + Esc) a i ʻole ka nānā ʻana i ka hana no laila oki ka mea kūʻai kūloko i ka pila DELETE Kāhea API.
9. ** MAI holoi lima lima i nā faila i hoʻopili ʻia e ransomware (.locked) i loko o ke ao pūnaewele inā hoʻololi ka polokalamu kino i nā hoʻonui faila**:
10. E hoʻomaopopo i ka pili ʻana o ransomware me ka mālama ʻana i ke ao:
    • Mahi A: Hoʻololi ʻia i loko o kahi (Inoa Kōnae Hoʻokahi): Hoʻopili ʻia ka ransomware Tax_2025.xlsx a mālama i ka ukana i hoʻopili ʻia ma lalo o ka inoa like Tax_2025.xlsx. Ma ʻaneʻi, mālama ka lawelawe kapuaʻi i ka faila i hoʻopili ʻia e like me Version 2, ʻoiai e noho maluhia ana kāu faila kumu maʻemaʻe ma lalo e like me Version 1 i loko. Version History.
    • Mahi B: Hoʻololi i ka inoa + Holoi Kumu (Tax_2025.xlsx.lockbit): Heluhelu ʻia ka hapa nui o nā ransomware hou Tax_2025.xlsx, kākau i kahi faila hou i kapa ʻia Tax_2025.xlsx.lockbit, a ** holoi** i ka mea kumu Tax_2025.xlsx. Eia kāu kumu maʻemaʻe Tax_2025.xlsx ke noho nei i loko o ka Cloud Trash / Recycle Bin (a me ka hoʻihoʻi ʻana i ka moʻokāki helu-i-manawa).
11. E ʻeʻe i loko o ka puka pūnaewele kapuaʻi (onedrive.live.com, dropbox.com, drive.google.com, icloud.com) mai kahi mea hoʻomaʻemaʻe, UNNFECTED (e like me ka atamai ma ka ʻikepili kelepona a i ʻole kamepiula kaʻawale):
12. Mai hoʻopaʻa hou i kāu moʻokāki kapua mai ka kamepiula i hoʻopaʻa ʻia i ka ransomware, a e hoʻihoʻi koke i ke kau ʻana o ka polokalamu OAuth o ka lolouila maʻi ma lalo o kāu ʻaoʻao Google, Microsoft, a i ʻole Dropbox no laila ʻaʻole hiki i ka PC maʻi ke hoʻomaka hou i ka syncing inā hoʻihoʻi kekahi iā ia.
13. E hoʻohana i ka hoʻihoʻi ʻana i ka moʻokāki ma ka manawa (Restore your OneDrive a i ʻole Dropbox Rewind) ma kahi o ka hoʻihoʻi ʻana i nā faila 50,000 i kēlā me kēia:
14. Loaʻa iā Microsoft OneDrive a me Dropbox kahi mīkini manawa moʻokāki holoʻokoʻa holoʻokoʻa e ʻōwili i kēlā me kēia waihona, ka faila faila, a me ka mea i holoi ʻia ma kāu kaʻa holoʻokoʻa a hoʻi i kahi timestamp kikoʻī (1 hour ago, Yesterday at 11:00 PM, a hiki i 30 to 180 days ago) ma kahi hana ʻaoʻao kikowaena hoʻokahi.

lāʻau hoʻoholo: hoʻopaʻa ʻia i ka pōʻino a me ka hoʻihoʻi ʻana i ka manawa¶

E hoʻokō i kēia kaʻina hana ulia pōpilikia e hoʻōki i ka hoʻolaha ʻana i ka hoʻopono ʻana i nā hāmeʻa a hoʻihoʻi hou i kou kūlana ao maʻemaʻe:

flowchart TD
    Start["Hoʻopili ʻia ʻo Ransomware a i ʻole ka hoʻopau ʻia ʻana o ka lehulehu ma ke ao holoʻokoʻa"] --> CutNet["KAHIKI 1: Wehe i ka Ethernet a hoʻopau i ka Wi-Fi ma ke kamepiula kumu (a i ʻole e wehe i ke kaula uila Wi-Fi)"]

    CutNet --> SaveSecondaries["KaʻAnuʻu Hana 2: E mālama i nā kamepiula ʻē aʻe a pau a me nā PC ma waho pūnaewele (Airplane Mode) -> E kope i kā lākou 'OneDrive / Dropbox / Google Drive' Cache Folders i kahi USB Drive waho."]

    SaveSecondaries --> RevokeSession["KANAWAI 3: Mai kahi kelepona maʻemaʻe / mea nānā, wehe i ka palekana moʻokāki (Google / Microsoft / Dropbox) -> Hoʻopau / wehe i ka hui ʻana o ka PC i hoʻopili ʻia."]

    RevokeSession --> WhichCloud{"ʻO wai ka Cloud Storage Platform i pā?"}

    WhichCloud -->|"Microsoft OneDrive / SharePoint (Personal a i ʻole Microsoft 365)"| OneDriveRestore["E hoʻohana i ka 'Settings -> Options -> Restore your OneDrive' (Rolls Back All Edits, Renames, & Deletions Across Entre Account a hiki i 30 lā) + E nānā i ka 1st & 2nd-Stage Recycle Bin"]

    WhichCloud -->|"Dropbox (Plus, Family, Professional, Business, or Basic)"| DropboxRestore["E hoʻohana i ka 'Dropbox Rewind' ma ka Root Folder (Hoʻihoʻi hou i ka moʻokāki holoʻokoʻa e pololei i ka minuke ma mua o ka hoʻouka ʻana) A i ʻole e hoʻohana i nā faila 'Deleted' + 'Events' Log (30 a 180 mau lā)"]

    WhichCloud -->|"Google Drive (Gmail pilikino a i ʻole Google Workspace)"| GDriveRestore["1. E hoʻokaʻawale i ka 'ʻōpala' ma ka 'lā ʻōpala' a hoʻihoʻi nui i nā kumu kumu i holoi ʻia. 2. No nā faila i kākau hou ʻia: kaomi ʻākau -> 'ʻike waihona -> hoʻokele i nā mana' a i ʻole holo Google Drive API v3 Bulk Revision Rollback Script"]

    WhichCloud -->|"Apple iCloud Drive"| iCloudRestore["E komo i loko o 'iCloud.com/recovery' -> Kaomi 'Hoʻihoʻi i nā faila' (Hoʻihoʻi i nā faila i holoi ʻia i loko o nā lā 30 i hala, ʻoiai inā ua haʻalele ʻia mai ka holoi ʻana i kēia manawa)"]

Māhele 1: Pehea ka hana ʻana o nā ʻenekini cloud sync i ka ransomware vs.¶

Ma mua o ke kaomi ʻana i nā pihi hoʻihoʻi me ka makaʻu, e nānā pehea i hoʻololi ʻia ai kāu mau faila ma ka puka pūnaewele kapua (drive.google.com, onedrive.live.com, a i ʻole dropbox.com). Hāʻule kēlā me kēia hanana hoʻonohonoho kapuaʻi i hoʻokahi o ʻekolu kumu ʻenehana:

Māhele 2: ʻO ka hoʻihoʻi hou ʻana o ke ao platform-by-platform a me ka hoʻihoʻi hou ʻana i ka mana nui¶

E hahai i ke kaʻina hana hoʻihoʻi pololei no kāu mea hāʻawi kapua mai kahi maʻemaʻe, ʻike ʻole ʻia.

1. Microsoft OneDrive & SharePoint Online (Restore Your OneDrive & 2-ʻanuʻu Recycle Bin)¶

Ua ʻenehana ʻo Microsoft iā OneDrive e ola i ka hoʻopiʻi ransomware a me ka holoi ʻana i ka nui.

1. Meʻa A: Hoʻihoʻi hou ʻia ka helu helu-i-manawa holoʻokoʻa (Restore your OneDrive):
2. Loaʻa ma Microsoft 365 Personal, Family, Business, and Enterprise (SharePoint Online hale waihona puke):
3. E komo i loko o onedrive.live.com (a i ʻole kāu puka pūnaewele Microsoft 365 OneDrive) ma kahi kamepiula maʻemaʻe.
4. Kaomi i ka Settings Gear icon (luna ʻākau akau) -> koho Options -> kaomi Restore your OneDrive ma ka ʻaoʻao hema hema (ma nā pūnaewele hui SharePoint, kaomi Settings Gear -> Restore this library).
5. Ma lalo o Select a date, koho Yesterday (a i ʻole Custom date and time).
6. E nānā i ka Activity Histogram Bar Chart: e ʻike ʻoe i kahi spike nui ma ka timeline e hōʻailona ana i ka minuke pololei i hoʻomaka ai ka ransomware encryption a i ʻole ka holoi ʻana nui.
7. E kauo i ka mea paheʻe manawa i ka hema o kēlā spike (no laila, ʻo kēlā me kēia faila hewa e hoʻololi hou i ka inoa, hoʻopaʻi, a holoi ʻia i hana ʻia ma hope o kēlā minuke e nānā ʻia no ka wehe ʻana).
8. Kaomi Restore. Hoʻopau koke nā kikowaena o Microsoft i kēlā me kēia hoʻololi faila, holoi i ka ransomware i hana hou ʻia .locked nā faila, a hoʻihoʻi i nā faila kumu a pau i hoʻopau ʻia i kā lākou waihona kikoʻī ma mua o ka hanana.
9. Method B: ʻO ka "Second-Stage Recycle Bin" (I ka wā i hoʻopau ʻia ai ka Recycle Bin maʻamau):
10. He aha inā inā e komo ka mea hoʻouka (a i ʻole kahi palapala automated) i kāu interface pūnaewele OneDrive/SharePoint a kaomi Empty recycle bin?
11. Ma OneDrive for Business / SharePoint Online (a me Microsoft 365 moʻokāki), ʻo ka waiho ʻana i ka Recycle Bin mua ** ʻaʻole e holoi i kāu mau faila**. Akā, hoʻoneʻe ia iā lākou i loko o kahi Second-Stage Recycle Bin (Site Collection Recycle Bin) kahi i mālama ʻia ai lākou a hiki i ka 93 mau lā nui:
    1. Wehe Recycle bin ma ka ʻaoʻao ʻaoʻao hema o OneDrive.
    2. E kaomi a hiki i lalo o ka ʻaoʻao a kaomi i ka loulou liʻiliʻi e heluhelu ana: Can't find what you're looking for? Check the Second-stage recycle bin.
    3. E koho i nā faila a pau a kaomi Restore.

2. Dropbox (Dropbox Rewind, Events Rollback, a Deleted Files)¶

1. Mea A: Hoʻohana Dropbox Rewind e hoʻihoʻi i nā waihona a i ʻole kāu moʻokāki holoʻokoʻa:
2. Loaʻa ma Dropbox Plus, Family, Professional, and Business plans (30 days i 180 days nānā hope):
3. E komo i loko o dropbox.com ma kahi polokalamu kele pūnaewele maʻemaʻe.
4. No ka hoʻihoʻi hou ʻana i kāu moʻokāki Dropbox holoʻokoʻa i ka manawa hoʻokahi, e kau ma luna o ka All files poʻomanaʻo (a kaomi i ka ... (Nā hana hou aʻe) papa kuhikuhi ma ka ʻaoʻao ʻākau ʻākau ke koho ʻole ʻia kahi waihona kikoʻī) a kaomi Rewind this folder (a i ʻole Rewind Dropbox).
5. Kaomi Get started -> e nānā i ka pakuhi hana i kēlā me kēia lā e ʻike i ka spike i ka wā i loaʻa ai ka ransomware a i ʻole ka holoi ʻana -> kaomi i kēlā lā e hoʻonui i ka ** hola-ho-hola / minute-min-minuke timeline**.
6. E hoʻonoho i ka laina polū polū ma mua o ** ma mua o ka hoʻomaka ʻana o ka hanana ʻino, kaomi Continue, a kaomi Rewind.
7. E hoʻihoʻi ʻo Dropbox i nā faila i kākau ʻia, hoʻomaʻemaʻe i nā memo ransomware hou i hoʻohui ʻia, a hoʻāla hou i nā waihona i holoi ʻia ma kahi.
8. Method B: Pehea inā ʻoe ma kahi manuahi Dropbox Basic mooolelo (kahi Dropbox Rewind ua laka)?
9. Koʻikoʻi: ʻOiai ma kahi manuahi Dropbox Basic (2 GB) mooolelo, Ke paʻa mau nei ʻo Dropbox i 30 mau lā Version History a me 30-lā Deleted Files hoʻolaʻa no kēlā me kēia faila ma kā lākou mau kikowaena.
10. Koho 1 (Free Manual Recovery): Kaomi Deleted files ma ka ʻaoʻao ʻaoʻao hema o dropbox.com e kānana ma ka lā a hoʻihoʻi nui i nā mea kumu i holoi ʻia; a i ʻole kaomi ... -> Activity -> Version history ma kekahi faila i kākau ʻia e hoʻihoʻi i ka hoʻoponopono maʻemaʻe mua.
11. Koho 2 (Instant Dropbox Plus Hoʻohou Wehe): No ka mea, hoʻopaʻa ʻo Dropbox i ka log hanana kumu ma nā moʻokāki āpau me ka nānā ʻole i ka pae, hoʻonui i kahi Dropbox Basic mooolelo i Dropbox Plus ($11.99 no 1 mahina) ma hope o kahi hanana i wehe ai i ka Dropbox Rewind UI i nā lā he 30 i hala iho nei o nā hanana waihona i hoʻopaʻa ʻia.

3. Google Drive & Google Workspace (Trash, Manage Versions, Admin Console 25-Day Post-Trash Recovery, a me ka hoʻihoʻi hou ʻana o ka API nui)¶

ʻAʻole like me OneDrive a me Dropbox, ʻaʻohe kaomi hoʻokahi o Google Drive "Rewind Entire Drive" i ka UI o ka mea kūʻai aku, no laila pono ʻoe e hoʻohana i ke ala hoʻihoʻi kūpono ma muli o ka ** holoi ʻia ** a i ʻole ** kākau ʻia ma kahi **:

1. ** Hoʻihoʻi hou i nā mea kumu i holoi ʻia mai Google Drive Trash (No ka inoa hou + Holoi i ka Ransomware a i ʻole Holoi Nui)**:
2. Wehe drive.google.com/drive/trash ma kahi polokalamu kele pūnaewele.
3. Kaomi i ka Trashed date poʻomanaʻo kolamu e hoʻokaʻawale i nā faila i holoi ʻia i luna.
4. Kaomi i ka faila maʻemaʻe mua i hoʻopau ʻia e ka ransomware/acident, kaomi i lalo, paʻa **Shift + kaomi ** i ka faila hope loa i ka pūʻulu, kaomi ʻākau, a koho Restore (Ctrl + Z a i ʻole ka hoʻihoʻi ʻana i ka uaki ikona). Hoʻihoʻi pololei ʻia kēlā me kēia faila i kāna waihona makua nested kumu.
5. Pehea inā ʻo ka Google Drive Trash Ua hoʻokaʻawale ʻia? (Google One Support & Google Workspace Admin 25-Day Rescue):
6. Google Workspace (Business, Enterprise, Education, Nonprofits): ʻOiai ma hope o ke kaomi ʻana o kahi mea hoʻohana Empty trash -> Delete forever, mālama nā kikowaena Google i nā faila i hoʻomaʻemaʻe ʻia no kahi 25 lā hou. E komo i loko o admin.google.com ma ke ano he Luna Nui -> hele i Directory -> Users -> kaomi i ka mea hoʻohana i pili -> kaomi i lalo i More options (a kaomi i ka panel hema ma lalo o ka hōʻuluʻulu mea hoʻohana) -> kaomi Restore data -> koho i ka Laka lā (a hiki i 25 mau lā ma hope), koho Drive e like me ka palapala noi, a kaomi Restore.
7. Nā moʻokāki Gmail pilikino / Google One: Inā ua haʻalele ʻia kāu ʻōpala Google Drive ponoʻī i loko o nā lā **25 i hala iho nei, mai ʻaʻole kākau i ka ʻikepili hou i ka drive; wehe koke support.google.com/drive/gethelp (a i ʻole ke kamaʻilio kākoʻo Google One) a noi i kahi Administrative Drive Deleted File Recovery. Hiki i nā mea hana kākoʻo a Google ke hoʻoulu i ka hoʻihoʻi ʻana o ka backend backend 25-lā like no nā moʻokāki mea kūʻai.
8. ** Hoʻihoʻi nui i nā faila i kākau ʻia me ka hoʻohana ʻana Manage Versions a i ʻole ka Google Drive API (rclone / Python)**:
9. No Google Docs, Sheets, and Slides: Wehe i ka faila -> kaomi File -> Version history -> See version history (Ctrl + Alt + Shift + H) a hoʻihoʻi i ka hōʻailona manawa o nehinei.
10. No nā faila binary (PDF, DOCX, XLSX, JPG, ZIP) i kākau ʻia ma kahi: E kaomi ʻākau i ka faila ma Google Drive -> File information -> Manage versions, kahi e mālama ai ʻo Google i nā mana kahiko no 30 lā (a i ʻole 100 mau mana).
11. Inā he mau tausani o nā faila binary i kākau ʻia ma kahi: Mai kaomi Manage versions 10,000 manawa ma ka lima. E hoʻohana rclone a i ʻole Google Apps Script / Drive API v3 revisions.list + revisions.delete palapala:
    • Ma Google Drive API v3, i ka wā i kākau ʻia ai kahi faila me kahi mana hou ʻino (Revision N), e kāhea ana Drive.Revisions.remove(fileId, latestRevisionId) hoʻopau wale i ka loiloi maikaʻi ʻole i hana ʻia i kēia lā, ** hoʻolaha ʻokoʻa i ka hoʻoponopono maʻemaʻe o nehinei N - 1 e hoʻi i ka faila o kēia manawa** ma nā waihona āpau:

      // Run inside script.google.com (with Advanced Drive Service v3 enabled) to roll back files modified after cutoffTime
      function rollbackOverwrittenFiles() {
        const cutoff = new Date("2026-11-01T00:00:00Z"); // Set to 5 minutes BEFORE the ransomware started
        const files = DriveApp.searchFiles('modifiedDate > "2026-11-01T00:00:00" and trashed = false');
        while (files.hasNext()) {
          const file = files.next();
          const revs = Drive.Revisions.list(file.getId()).revisions;
          if (revs && revs.length > 1) {
            const latest = revs[revs.length - 1];
            if (new Date(latest.modifiedTime) > cutoff) {
              Drive.Revisions.remove(file.getId(), latest.id);
            }
          }
        }
      }
      

12. Apple iCloud Drive (iCloud.com/recovery Hoʻihoʻi ʻikepili 30 lā):
13. ʻOiai inā ua holoi ʻia nā faila mai iCloud Drive a holoi ʻia mai ka Recently Deleted waihona ma kāu Mac a i ʻole iPhone, e komo i loko icloud.com/recovery ma kahi polokalamu kele pūnaewele:
14. Kaomi Restore Files -> nānā Select All (a i ʻole kānana ma ka lā i holoi ʻia) a kaomi Restore. Mālama ʻo Apple backend server i kahi waihona hoʻolaʻa 30 mau lā e hoʻihoʻi hou i nā palapala iCloud Drive i holoi ʻia, nā papa kuhikuhi / Nā palapala, nā Bookmarks, Contacts, a me nā Kalena.

Māhele 3: Ka ʻohi ʻana i nā hūnā hoʻopahemo kūloko mai nā mea hana lua a Google DriveFS / Windows Shadow Copies¶

Ma mua o ka hoʻopili hou ʻana i kekahi lolouila i ka pūnaewele, e nānā inā paʻa mau nā kope paʻa ʻole o kāu mau faila:

Māhele 4: ʻO ka protocol hoʻohui palekana (Pehea e hoʻihoʻi ai i nā kamepiula i hoʻomaʻemaʻe ʻia ma ka pūnaewele me ka ʻole e hoʻopōʻino i ke ao)¶

ʻO kekahi o nā hewa maʻamau i ka hoʻihoʻi ʻana i ke ao hiki ke hana ma hope ** ma hope o ka hoʻihoʻi maikaʻi ʻana i kāu mau faila ma ke kikowaena pūnaewele kapuaʻi: hoʻohuli ka mea hoʻohana i kāna kamepiula, ala ka mea kūʻai aku sync kūloko, ʻike i 20,000 .locked nā faila ransomware (a i ʻole nā waihona waihona ʻole) e noho ana ma ka ʻōpala paʻa kūloko, a ** hoʻonohonoho pono i ka palaho a hiki i ka pahu kapua i hoʻihoʻi hou ʻia **.

E hahai i kēia papa inoa hoʻopaʻa hoʻohui hou: 1. Ma ke kamepiula i hoʻokumu i ka hanana (Ransomware a i ʻole Accidental Script): - Inā pā ʻia e Ransomware: Mai hoʻopili hou i kēlā hoʻonohonoho OS i kāu moʻokāki kapua. Ma hope o ke kiʻi ʻana i ke kiʻi no ka forensics a i ʻole hoʻopakele ʻana i nā faila kūloko i hoʻopaʻa ʻole ʻia, holoi loa i ka SSD (Secure Erase / holoi i nā ʻāpana āpau) a hoʻomaʻemaʻe i ka Windows a i ʻole macOS mai kahi mea hoʻonohonoho USB maikaʻi i kūkulu ʻia ma kahi kamepiula ʻokoʻa. - E hoʻololi i kāu ʻōlelo huna Google, Microsoft, Dropbox, a me Apple a loiloi Account Security -> Devices a me Third-Party App Permissions no ka hōʻoia ʻaʻole e hoʻomau ʻia nā kuki hui infostealer. 2. Ma nā kamepiula lua ma mua o ka hoʻohuli ʻana iā Wi-Fi: - Inā ʻoe i hoʻihoʻi hou i ke kaʻa kapuaʻi i kahi kūlana maʻemaʻe ma o Restore your OneDrive a i ʻole Dropbox Rewind: 1. E hoʻopaʻa i ke kamepiula lua me ka Wi-Fi i OFF. 2. Hoʻopau OneDrive / Dropbox / Google Drive i ** Nā polokalamu hoʻomaka (Task Manager -> Startup apps)** no laila ʻaʻole hiki i ka daemon sync ke hoʻomaka maʻalahi. 3. Hoʻololi i ka inoa kūloko C:\Users\<Name>\OneDrive (a i ʻole Dropbox) waihona i OneDrive_OLD_LOCAL_BACKUP. 4. E ho'ā hou i ka Wi-Fi, e hoʻomaka i ka app sync cloud, e wehe a hoʻopili hou me ka maʻemaʻe, a ʻae iā ia e hoʻoiho i ke kūlana kapuaʻi hou i hoʻihoʻi hou ʻia i loko o kahi waihona hou.

3. Hoʻihoʻi hou i ka Windows Volume Shadow Copies (Previous Versions) a me macOS APFS Nā Kiʻi Paʻi Kūlana ma ka PC Source¶

He aha inā inā ʻaʻole ** hoʻokaʻawale ʻia kahi waihona i hoʻopili ʻia a holoi ʻia paha mai ka sync kapuaʻi** (e like me kahi kūloko Desktop waihona a i ʻole kahi faila i ʻoi aku ka nui ma mua o ka palena sync), a ʻaʻole i pau ka hoʻouka ʻana o ka mea kūʻai aku kapuaʻi i nā hoʻoponopono o ka pule i hala ma mua o ka ulia? 1. Ma Windows 10 / 11 (ShadowExplorer & vssadmin): - ʻOiai he nui nā ʻohana ransomware e hoʻāʻo nei e holo vssadmin.exe delete shadows /all /quiet, Mana mooolelo mea hoohana (UAC), ʻImi hope a pane (EDR), a i ʻole ka hoʻokō non-admin e ālai pinepine i ka holoi ʻana i ke aka. - E holo i ka Command Prompt ma ke ʻano he Administrator ma ka mīkini kaʻawale a ʻano:

vssadmin list shadows

Nīnau pinepine¶

Maikaʻi anei ka uku ʻana i ka uku decryptor o ka hui ransomware inā hoʻonohonoho ʻia kaʻu mau faila i OneDrive, Dropbox, a i ʻole Google Drive?¶

Aneane aole loa. ʻAʻole like me kahi kīkī paʻakikī kūloko i hoʻopaʻa ʻole ʻia, nā lawelawe mālama kapua (OneDrive, Dropbox, Google Drive, Pahu, a iCloud Drive) e mālama i nā faila ma nā ʻaoʻao hoʻopaʻa mea hiki ʻole ke hoʻololi ʻia kahi e hana ai kēlā me kēia hoʻololi i kahi mana mea hou a hoʻoneʻe kēlā me kēia holoi ʻana i ka mea i kahi pahu ʻōpala 30-lā (a i ʻole 93-a-180-lā). Ua hoʻopau paha ka ransomware i kāu mau faila a i ʻole i hana hou .paʻa nā faila a holoi i nā mea kumu, ʻO 100 pakeneka o kāu mau faila kumu i hoʻopili ʻole ʻia e noho mau ana ma nā kikowaena o ka mea hāʻawi kapua i loko o Version History a i ʻole ka ʻōpala.. Ke hoʻohana nei Hoʻihoʻi hou i kāu OneDrive, Dropbox Rewind, a i ʻole Google Drive Trash and Revision Recovery e hoʻihoʻi i kāu mau faila pre-attack pololei no ka manuahi me ka ʻole o ka pilikia o nā decryptors ransomware haki.

No ke aha i hoʻokō ai ka ransomware ma kaʻu Windows PC e hoʻopili i kaʻu Google Drive a i ʻole OneDrive ma kahi mua? ʻAʻole anei e pale ke ao i ka malware?¶

No ka hana ʻana i nā faila ao me nā papahana desktop e like me Microsoft Word, Excel, Photoshop, a me AutoCAD, nā mea kūʻai aku sync desktop (Google Drive no ka Papakaukau, OneDrive.exe, Dropbox.exe) e kau i kāu waihona kapuaʻi ma ke ʻano he waihona kūloko a i ʻole ka leka uila uila (G:\ a i ʻole C:\Users\Name\OneDrive) ma lalo o kāu ʻae hoʻohana Windows. Ke hoʻokō nei ʻo ransomware ma lalo o kāu moʻokāki mea hoʻohana Windows, loaʻa iā ia nā ʻae like hoʻololi i nā faila āu e hana ai: hele ia i kēlā me kēia leka uila i kau ʻia (C:\, D:\, G:\) a me ka waihona mea hoʻohana, heluhelu i kēlā me kēia faila, hoʻopili iā ia, a mālama iā ia. Hoʻonohonoho ʻia nā faila i "Nā waihona pūnaewele-wale / kahawai" (Nā waihona ma ka makemake) e hoʻoiho maʻalahi ("hydrated") ma ka lele e Windows i ka manawa e wehe ai ke kaʻina hana ransomware i ka waihona waihona e heluhelu ai. ʻO ia ke kumu he mea koʻikoʻi ka wehe koke ʻana i ka pūnaewele: ʻoki ʻo ia i ka hoʻoiho hydration ma luna o ka noi o nā faila kapua ma ka pūnaewele wale nō ma mua o ka hiki ke heluhelu ʻia e ka ransomware.

He aha inā inā ua hoʻopau wale au i kahi waihona Shared nui ma Google Drive a i ʻole Dropbox, a na nā lālā ʻē aʻe kekahi o nā faila i loko?¶

In Dropbox, hiki i nā lālā me nā ʻae hoʻoponopono ke hoʻohana Holoi ʻia nā faila a i ʻole Dropbox Rewind ma ka waihona waihona e hoʻihoʻi i ka hierarchy waihona holoʻokoʻa no ka hui holoʻokoʻa. In Google Drive, ʻokoʻa ka hoʻonaʻauao ʻana: ke holoi ʻoe i kahi waihona waihona i loko o ka Shared Folder a haʻi (kahi lakou ʻO ia ka mea nona a he Luna hoʻoponopono ʻoe), e wehe ana i ka faila mai ka waihona waihona keiki makua ole ka waihona ma mua o ka ʻōpala ʻana no ka mea nona, a i ʻole e neʻe wale i nā faila oe ponoi iloko kou ʻōpala (drive.google.com/drive/trash) ʻoiai nā faila a kāu hoa hana e komo ai i loko ko lakou ʻO ka ʻōpala (a i ʻole lilo i makua ʻole i kā lākou kumu Drive hiki ke ʻimi ʻia ma o ʻo:unorganized owner:me ma ka pahu huli Google Drive).

Hiki i ka ransomware ke holoi i kaʻu moʻolelo Cloud Version a i ʻole e hoʻokaʻawale i kaʻu OneDrive / Google Drive Recycle Bin?¶

ʻO nā binaries file-system ransomware binaries (LockBit, Akira, ʻEleʻele, Pāʻani, Phobos) hana maʻemaʻe ma o nā API pūnaewele waihona Windows kūloko (CreateFileW, KākauFile, HoloiFileW) a hiki ole e launa pū me ka pūnaewele-wale Moʻolelo moʻolelo, ʻO ka Pahu ʻAha ʻElua, a i ʻole Google Workspace Admin Vault. Eia naʻe, inā hoʻokomo ka mea hoʻouka i kahi mea ʻike ʻike (Lumma, Lāina ʻulaʻula) a i ʻole i loaʻa iā ia ka papapihi mamao mamao (RDP / AnyDesk) hiki i kāu polokalamu kele pūnaewele wehe, hiki iā lākou ke wehe lima i kāu polokalamu kele pūnaewele a kaomi ʻōpala ʻōpala. ʻOiai inā ua hana lākou, e hoʻomanaʻo i nā hope hope ʻelua: (1) On OneDrive / SharePoint, emptied items go to the ʻO ka Pahu ʻAha ʻElua a hiki i 93 lā; a me (2) Ma Google Drive / Google Workspace, hiki ke hoʻihoʻi hou ʻia nā mea ʻōpala i hoʻokaʻawale ʻia e kahi Admin Workspace a i ʻole Kākoʻo Google One no 25 mau lā ma hope o ka holoi mau ʻana.

Nā alakaʻi pili¶

• ʻO Ransomware a me ka malware: kaʻawale koke a me ka hoʻihoʻi
• Ka holoi ʻia ʻana o ka faila, ka pahu hoʻopono, a me ka hoʻihoʻi ʻana i ke kiʻi
• Hua'ōlelo, Excel, PDF, a i ʻole waihona waihona a me ka hoʻihoʻi ʻana i ka palapala i mālama ʻole ʻia
• Kākoʻo kamepiula: 3-2-1 hoʻolālā a me ka hoʻōla pōʻino
• ʻO ka hoʻopaʻa ʻana i nā kuki hui, nā polokalamu infostealer, a me ka hoʻopau ʻana i ka passkey
• Nā helu pilikia ma ka ʻāina

Nā kumu a me ke alakaʻi kūhelu¶

• Kākoʻo Official Microsoft (support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15): Hoʻihoʻi hou i kāu OneDrive (30-Day Point-in-Time Rollback Histogram, Ransomware Detection Alerts, and First/Second-Stage SharePoint Recycle Bin Recovery).
• Ke kikowaena Kokua Kokua Dropbox (help.dropbox.com/delete-restore/rewind & recover-older-versions): *Me ka hoʻohana ʻana iā Dropbox Rewind e wehe i ka Ransomware a i ʻole ka hoʻopau ʻana i ka nui, 30-a-180-Day Version History, a .dropbox.cache Ka hoʻohiwahiwa *.
• Kōkua Google Workspace Admin a me Google Drive Palapala Kūlana (support.google.com/a/answer/6052340 & developers.google.com/drive/api/reference/rest/v3/revisions): Hoʻihoʻi hou i ka ʻikepili Google Drive i holoi ʻia i loko o 25 mau lā ma o Admin Console a me Drive API v3 revisions Hooponopono.
• Keʻena palekana Cybersecurity a me Infrastructure Security Agency (CISA / StopRansomware.gov): Cloud Storage Sync Isolation a me Post-Ransomware Version Rollback Nā hana maikaʻi loa.