Ransomware or Accidental Mass Deletion on Google Drive, OneDrive, or Dropbox Syncing Corrupted Files to All Devices (30-Day Version History and Vault Rewind)¶

Watching the sync icon in your Windows taskbar or macOS menu bar spin rapidly as thousands of business documents, tax records, family photos, and source code files inside Google Drive for Desktop, Microsoft OneDrive, Dropbox, oz iCloud Drive are either encrypted by ransomware (.locked, .bianlian, .akira, .play, .lockbit) or wiped out by a misconfigured rsync --delete, nenamerno povleci in spusti mapo ali lažni skript je katastrofa pri visoki hitrosti podatkov. Ker so odjemalci za sinhronizacijo namizja v oblaku zasnovani za dvosmerno podvajanje v realnem času (inotify na Linuxu, FSEvents na macOS in ReadDirectoryChangesW / Cloud Filter API v sistemu Windows), binarno ali naključno programsko opremo Shift + Delete na enem samem okuženem prenosnem računalniku se takoj razširi do strežnika v oblaku in v nekaj sekundah potisne navzdol na vsa druga namizja, prenosne računalnike in skupno skupinsko mapo, povezano s tem računom.

Vendar motorji za sinhronizacijo v oblaku ni neobdelano prepisovanje diska: v zakulisju, Microsoft OneDrive, Dropbox, Google Drive, in Box vzdržujte nespremenljivo shranjevanje predmetov na strani strežnika z 30-dnevnimi do 180-dnevnimi zgodovinami različic v trenutku, Koši druge stopnje in orodji za povrnitev celotnega računa (OneDrive Restore Your OneDrive in Dropbox Rewind). Dokler okuženi računalnik takoj ločite od omrežja, začasno ustavite sinhronizacijo na sekundarnih računalnikih, da pridobite lokalne predpomnilnike brez povezave, in se izognete usodni pasti ponovnega nalaganja šifriranih datotek preko vaše kvote zgodovine različic, lahko celoten disk v oblaku vrnete nazaj na točno minuto pred začetkom šifriranja ali brisanja, ne da bi plačali niti centa odkupnine. Za zadrževanje zlonamerne programske opreme lokalnega računalnika in izrezovanje datotečnega sistema si oglejte naše vodnike odziv na izsiljevalsko in zlonamerno programsko opremo, nenamerno brisanje datoteke in obnovitev formatiranega pogona, in računalniške varnostne kopije: strategija 3-2-1 in obnovitev po katastrofi. Če napad z izsiljevalsko programsko opremo zadene bolnišnico, kliniko ali dispečersko mrežo za nujne primere, nemudoma aktivirajte postopke za klinične izpade brez povezave in pokličite lokalno številko za klic v sili (911 v ZDA in Kanadi, 112 po vsej Evropski uniji, 999 v Združenem kraljestvu) ali preverite naš imenik številke za klic v sili.

Naredi to zdaj¶

1. Odklopite ethernetni kabel in izklopite Wi-Fi na izvornem računalniku TAKOJ (preden zaprete aplikacije ali kliknete kar koli):
2. Zakaj prekinitev omrežja reši vaš trezor v oblaku: Vsako sekundo okuženi računalnik ali računalnik, ki se izbriše, ostane povezan, odjemalec za sinhronizacijo namizja (OneDrive.exe, GoogleDriveFS.exe, Dropbox.exe) naloži dodatnih 50 do 200 operacij šifriranih ali izbrisanih datotek na sekundo v API za oblak. Prekinitev Wi-Fi in Ethernet zamrzne čakalno vrsto za nalaganje v oblak.
3. Pojdite do VSAKEGA DRUGEGA prenosnika, namizja, tablice in telefona, povezanega z istim računom v oblaku, in IZKLOPITE njihov Wi-Fi/Ethernet, PREDEN prebudite njihove zaslone:
4. Vaš sekundarni prenosni računalnik brez povezave je nedotaknjena časovna kapsula: Če vaš domači namizni računalnik ali sekundarni MacBook že od včeraj spi v vaši torbi, OneDrive, Dropbox, oz Google Drive (Mirror files / Always keep on this device) še vedno vsebuje 100-odstotno nešifrirane, nedotaknjene kopije vaših datotek.
5. Če zbudite ta sekundarni prenosnik, medtem ko je Wi-Fi vklopljen, se demon sinhronizacije v oblaku takoj poveže, s strežnika prenese šifrirana besedila za množično brisanje ali izsiljevalsko programsko opremo in uniči to nedotaknjeno lokalno kopijo v manj kot 60 sekundah. Izklopite domači usmerjevalnik Wi-Fi (izključite njegov napajalni kabel), preden zbudite kateri koli sekundarni računalnik, nato kopirajte lokalne mape na zunanji pogon USB, ko ste brez povezave.
6. Če je vzrok izsiljevalska programska oprema, izvlecite napajalni kabel (ali na silo držite gumb za vklop 10 sekund) na okuženem računalniku; če je vzrok nenamerno brisanje na SSD-ju, ga pustite izoliranega in odklopite/ustavite sinhronizacijski demon:
7. Izsiljevalska programska oprema: vlečenje ustavi šifrirne niti (AES / ChaCha20 delavci) pred šifriranjem preostalih nešifriranih map na vašem lokalnem disku in ohrani hlapljive ključe RAM, če je potrebna forenzična analiza pomnilnika.
8. Nenamerno brisanje: Ubij OneDrive.exe / Dropbox.exe / GoogleDriveFS.exe v upravitelju opravil (Ctrl + Shift + Esc) ali Activity Monitor takoj, tako da lokalni odjemalec preneha biti v čakalni vrsti DELETE API klici.
9. NE izbrišite ročno datotek, šifriranih z izsiljevalsko programsko opremo (.locked) v spletnem vmesniku v oblaku, če je zlonamerna programska oprema preimenovala datotečne pripone:
10. Razumejte, kako izsiljevalska programska oprema sodeluje s shrambo v oblaku:
    • Primer A: Prepisovanje na mestu (isto ime datoteke): Izsiljevalska programska oprema je šifrirana Tax_2025.xlsx in shranil šifriran tovor pod popolnoma istim imenom Tax_2025.xlsx. Tukaj storitev v oblaku obravnava šifrirano datoteko kot različico 2, medtem ko je vaša čista izvirna datoteka varno pod različico 1 v Version History.
    • Primer B: Preimenuj + Izbriši izvirnik (Tax_2025.xlsx.lockbit): Večina sodobnih izsiljevalskih programov bere Tax_2025.xlsx, zapiše novo datoteko z imenom Tax_2025.xlsx.lockbit, in izbriše izvirnik Tax_2025.xlsx. Evo, tvoj čisti izvirnik Tax_2025.xlsx je v smetnjaku v oblaku/smetnjaku (in povrnitev računa v prejšnje stanje).
11. Prijavite se v spletni portal v oblaku (onedrive.live.com, dropbox.com, drive.google.com, icloud.com) iz ČISTE, NEOKUŽENE naprave (kot je pametni telefon na mobilnih podatkih ali izoliran računalnik):
12. Nikoli se ne prijavljajte nazaj v svoj račun v oblaku iz računalnika, okuženega z izsiljevalsko programsko opremo, in takoj prekličite sejo naprave OAuth okuženega računalnika na strani Varnost računa Google, Microsoft ali Dropbox, tako da okuženi računalnik ne more nadaljevati sinhronizacije, če ga kdo znova vklopi.
13. Uporabi povrnitev računa v določenem trenutku (Restore your OneDrive oz Dropbox Rewind) namesto da obnovite 50.000 datotek eno za drugo:
14. Tako Microsoft OneDrive kot Dropbox vključujeta avtomatiziran časovni stroj za celoten račun, ki vrne vsako mapo, različico datoteke in izbrisane elemente po celotnem disku nazaj na določen časovni žig (1 hour ago, Yesterday at 11:00 PM, ali do 30 to 180 days ago) v eni operaciji na strani strežnika.

Odločitveno drevo: zadrževanje katastrofe pri sinhronizaciji v oblaku in obnova v trenutku¶

Izvedite ta potek dela v nujnih primerih, da ustavite širjenje sinhronizacije med napravami in obnovite stanje čistega oblaka:

flowchart TD
    Start["Šifriranje izsiljevalske programske opreme ALI nenamerno množično brisanje, ki se sinhronizira v pogonu v oblaku"] --> CutNet["1. KORAK: Takoj odklopite Ethernet in izklopite Wi-Fi na izvornem računalniku (ali odklopite napajalni kabel Wi-Fi usmerjevalnika)"]

    CutNet --> SaveSecondaries["2. KORAK: Ohranite vse sekundarne prenosnike/osebne računalnike brez povezave (način v letalu) -> Kopirajte njihove lokalne predpomnilniške mape »OneDrive / Dropbox / Google Drive« na zunanji pogon USB"]

    SaveSecondaries --> RevokeSession["3. KORAK: V čistem telefonu/brskalniku odprite Varnost računa (Google/Microsoft/Dropbox) -> Prekliči/prekini povezavo seje sinhronizacije namizja z okuženim računalnikom"]

    RevokeSession --> WhichCloud{"Katera platforma za shranjevanje v oblaku je bila prizadeta?"}

    WhichCloud -->|"Microsoft OneDrive / SharePoint (Personal or Microsoft 365)"| OneDriveRestore["Use 'Settings -> Options -> Restore your OneDrive' (Rolls Back All Edits, Renames, & Deletions Across Entire Account up to 30 Days) + Check 1st & 2nd-Stage Recycle Bin"]

    WhichCloud -->|"Dropbox (Plus, Family, Professional, Business, or Basic)"| DropboxRestore["Use 'Dropbox Rewind' on Root Folder (Rewinds Entire Account to Exact Minute Before Attack) OR Use 'Deleted files' + 'Events' Log (30 to 180 Days)"]

    WhichCloud -->|"Google Drive (Personal Gmail or Google Workspace)"| GDriveRestore["1. Sort 'Trash' by 'Trashed date' to Bulk-Restore Deleted Originals. 2. For Overwritten Files: Right-Click -> 'File information -> Manage versions' OR Run Google Drive API v3 Bulk Revision Rollback Script"]

    WhichCloud -->|"Apple iCloud Drive"| iCloudRestore["Log into 'iCloud.com/recovery' -> Click 'Restore Files' (Recovers Files Deleted Within Last 30 Days, Even If Emptied From Recently Deleted)"]

Phase 1: How cloud sync engines process ransomware vs. mass deletion (Where your clean files actually live)¶

Before clicking restore buttons in a panic, inspect how your files were altered on the cloud web portal (drive.google.com, onedrive.live.com, oz dropbox.com). Every cloud sync incident falls into one of three technical patterns:

Phase 2: Platform-by-platform cloud rollback and bulk version recovery¶

Follow the exact recovery procedure for your cloud provider from a clean, uninfected browser.

1. Microsoft OneDrive & SharePoint Online (Restore Your OneDrive & 2-Stage Recycle Bin)¶

Microsoft je zasnoval OneDrive posebej za preživetje šifriranja izsiljevalske programske opreme in množičnih izbrisov sinhronizacije:

1. Metoda A: Povrnitev celotnega računa v trenutku (Restore your OneDrive):
2. Na voljo v Microsoft 365 Personal, Family, Business in Enterprise (SharePoint Online knjižnice dokumentov):
3. Prijavite se v onedrive.live.com (ali vaš spletni portal Microsoft 365 OneDrive) na čistem računalniku.
4. Kliknite ikono zobnika za nastavitve (zgornji desni kot) -> izberite Options -> click Restore your OneDrive v levem podoknu za krmarjenje (na SharePointovih spletnih mestih skupine kliknite Settings Gear -> Restore this library).
5. Pod Select a date, izberi Yesterday (ali Custom date and time).
6. Poglejte palični grafikon histograma dejavnosti: na časovnici boste videli ogromen skok, ki označuje točno minuto, ko se je začelo šifriranje ali množično brisanje izsiljevalske programske opreme.
7. Povlecite drsnik časovne premice levo od te konice (tako da je vsako zlonamerno preimenovanje, prepisovanje in brisanje datoteke, ustvarjeno po tej minuti, preverjeno za razveljavitev).
8. Click Restore. Microsoftovi strežniki bodo samodejno razveljavili vsako spremembo datoteke in izbrisali novo ustvarjeno izsiljevalsko programsko opremo .locked datoteke in obnoviti vse izbrisane izvirne datoteke nazaj v njihovo točno strukturo map iz časa pred incidentom.
9. Način B: Skriti »koš druge stopnje« (ko je bil običajni koš izpraznjen):
10. Kaj pa, če se napadalec (ali samodejni skript) prijavi v vaš spletni vmesnik OneDrive/SharePoint in klikne Empty recycle bin?
11. V OneDrive for Business / SharePoint Online (in računih Microsoft 365) praznjenje primarnega koša NE izbriše vaših datotek. Namesto tega jih premakne v skriti Koš druge stopnje (Site Collection Recycle Bin), kjer ostanejo zaščiteni do skupaj 93 dni:
    1. Odpri Recycle bin v levi stranski vrstici OneDrive.
    2. Pomaknite se do samega dna strani in kliknite majhno povezavo: Can't find what you're looking for? Check the Second-stage recycle bin.
    3. Izberite vse datoteke in kliknite Restore.

2. Dropbox (Dropbox Rewind, Events Vrnitev nazaj in Deleted Files)¶

1. Metoda A: Uporaba Dropbox Rewind za povrnitev celotnih map ali celotnega računa:
2. Na voljo v paketih Dropbox Plus, Family, Professional in Business (30 days do 180 days pogled nazaj):
3. Prijavite se v dropbox.com v čistem brskalniku.
4. Če želite naenkrat previti celoten račun Dropbox, premaknite miškin kazalec nad All files glava (ali kliknite ... (Več dejanj) na desni plošči z dejanji, ko ni izbrana nobena posebna mapa) in kliknite Rewind this folder (ali Rewind Dropbox).
5. Click Get started -> poglejte graf dejavnosti dan za dnem, da poiščete skok, ko je prišlo do izsiljevalske programske opreme ali izbrisa -> kliknite ta dan, da povečate časovno os po urah / po minutah.
6. Postavite modro navpično črto tik pred začetkom slabega dogodka, kliknite Continue in kliknite Rewind.
7. Dropbox bo razveljavil vse prepisane datoteke, izbrisal novo dodane opombe izsiljevalske programske opreme in obudil vse izbrisane mape na mestu.
8. Metoda B: Kaj pa, če ste na brezplačnem Dropbox Basic račun (kje Dropbox Rewind je zaklenjeno)?
9. Pomembno: Tudi na brezplačnem Dropbox Basic (2 GB), Dropbox še vedno obdrži polnih 30 dni Version History in 30-dnevni Deleted Files obnovitev za vsako posamezno datoteko na njihovih strežnikih.
10. 1. možnost (brezplačna ročna obnovitev): Kliknite Deleted files v levi stranski vrstici dropbox.com za filtriranje po datumu in množično obnavljanje izbrisanih izvirnikov; ali kliknite ... -> Activity -> Version history on any overwritten file to restore the previous clean revision.
11. Option 2 (Instant Dropbox Plus Upgrade Unlock): Because Dropbox records the underlying event log on all accounts regardless of tier, upgrading a Dropbox Basic account to Dropbox Plus ($11.99 for 1 month) after an incident unlocks the Dropbox Rewind UI over the past 30 days of already-recorded file events.

3. Google Drive & Google Workspace (Trash, Manage Versions, Admin Console 25-Day Post-Trash Recovery, and Bulk API Rollback)¶

Unlike OneDrive and Dropbox, Google Drive does not have a single one-click "Rewind Entire Drive" button in the consumer UI, so you must use the right recovery method depending on whether the files were deleted or overwritten in place:

1. Recovering Deleted Originals from Google Drive Trash (For Rename+Delete Ransomware or Mass Deletion):
2. Odpri drive.google.com/drive/trash in a desktop browser.
3. Kliknite na Trashed date column header to sort the most recently deleted files to the top.
4. Click the first clean file deleted by the ransomware/accident, scroll down, hold Shift + click the last file in the batch, right-click, and select Restore (Ctrl + Z or the Restore clock icon). Every file returns directly to its original nested parent folder.
5. What if the Google Drive Trash was already Emptied? (Google One Support & Google Workspace Admin 25-Day Rescue):
6. Google Workspace (Business, Enterprise, Education, Nonprofits): Even after a user clicks Empty trash -> Delete forever, Google's servers retain the purged files for an additional 25 days. Log into admin.google.com as a Super Admin -> go to Directory -> Users -> click the affected user -> scroll down to More options (or click the left panel under the user summary) -> click Restore data -> select the Date Range (up to 25 days back), select Drive kot aplikacijo in kliknite Restore.
7. Osebni računi Gmail/Google One: Če je bil vaš osebni smeti Google Drive izpraznjen v zadnjih 25 dneh, ne ne zapisujte novih podatkov na pogon; takoj odprisupport.google.com/drive/gethelp (ali klepet s podporo za Google One) in zahtevajte obnovitev izbrisane datoteke s skrbniškega diska. Googlova podporna orodja lahko sprožijo popolnoma enako 25-dnevno obnovitev zaledja po košu za potrošniške račune.
8. Bulk-Restoring Overwritten Files Using Manage Versions or the Google Drive API (rclone / Python):
9. Za Google Dokumente, Preglednice in Predstavitve: odprite datoteko -> kliknite File -> Version history -> See version history (Ctrl + Alt + Shift + H) in obnovite včerajšnji časovni žig.
10. For binary files (PDF, DOCX, XLSX, JPG, ZIP) overwritten in place: Right-click the file in Google Drive -> File information -> Manage versions, where Google retains older versions for 30 days (or 100 versions).
11. If thousands of binary files were overwritten in place: Do not click Manage versions 10,000 times by hand. Use rclone or a Google Apps Script / Drive API v3 revisions.list + revisions.delete script:
    • In Google Drive API v3, when an existing file is overwritten with a bad new version (Revision N), calling Drive.Revisions.remove(fileId, latestRevisionId) deletes only the malicious top revision created today, automatically promoting yesterday's clean Revision N - 1 back to be the active current file across all folders:

      // Run inside script.google.com (with Advanced Drive Service v3 enabled) to roll back files modified after cutoffTime
      function rollbackOverwrittenFiles() {
        const cutoff = new Date("2026-11-01T00:00:00Z"); // Set to 5 minutes BEFORE the ransomware started
        const files = DriveApp.searchFiles('modifiedDate > "2026-11-01T00:00:00" and trashed = false');
        while (files.hasNext()) {
          const file = files.next();
          const revs = Drive.Revisions.list(file.getId()).revisions;
          if (revs && revs.length > 1) {
            const latest = revs[revs.length - 1];
            if (new Date(latest.modifiedTime) > cutoff) {
              Drive.Revisions.remove(file.getId(), latest.id);
            }
          }
        }
      }
      

12. Apple iCloud Drive (iCloud.com/recovery 30-Day Data Recovery):
13. Even if files were deleted from iCloud Drive and purged from the Recently Deleted folder on your Mac or iPhone, log into icloud.com/recovery in a web browser:
14. Click Restore Files -> check Select All (or filter by date deleted) and click Restore. Apple's backend server maintains a separate 30-day recovery vault that restores deleted iCloud Drive documents, Desktop/Documents folders, Bookmarks, Contacts, and Calendars.

Phase 3: Harvesting local offline caches from secondary devices and Google DriveFS / Windows Shadow Copies¶

Before reconnecting any computer to the internet, check whether your local hard drives still hold uncorrupted copies of your files:

Phase 4: Safe reconnection protocol (How to bring cleaned computers back online without re-corrupting the cloud)¶

One of the most common mistakes in cloud recovery happens after you successfully restore your files in the cloud web interface: the user turns their laptop back on, the local sync client wakes up, sees 20,000 .locked ransomware files (or empty folders) sitting on the local hard drive, and syncs the corruption right back up to the freshly restored cloud drive.

Follow this strict reconnection checklist: 1. On the computer that caused the incident (Ransomware or Accidental Script): - If hit by Ransomware: Never reconnect that OS installation to your cloud account. After imaging the drive for forensics or rescuing any unbacked-up local-only files, completely wipe the SSD (Secure Erase / delete all partitions) and clean-install Windows or macOS from a known-good USB installer built on a separate computer. - Change your Google, Microsoft, Dropbox, and Apple account passwords and review Account Security -> Devices in Third-Party App Permissions to verify no infostealer session cookies remain active. 2. On secondary computers before turning Wi-Fi back on: - If you already restored the cloud drive to a clean state via Restore your OneDrive oz Dropbox Rewind: 1. Boot the secondary computer with Wi-Fi still OFF. 2. Disable OneDrive / Dropbox / Google Drive in Startup Apps (Task Manager -> Startup apps) so the sync daemon cannot launch automatically. 3. Rename the local C:\Users\<Name>\OneDrive (oz Dropbox) folder to OneDrive_OLD_LOCAL_BACKUP. 4. Turn Wi-Fi back on, launch the cloud sync app, let it unlink and relink cleanly, and allow it to download the freshly restored clean cloud state into a brand-new folder.

3. Restoring Windows Volume Shadow Copies (Previous Versions) and macOS APFS Local Snapshots on the Source PC¶

What if a folder that was encrypted or deleted was excluded from cloud sync (such as a local Desktop folder or a file larger than the sync limit), or the cloud sync client had not finished uploading last week's edits before the crash? 1. On Windows 10 / 11 (ShadowExplorer & vssadmin): - While many ransomware families attempt to run vssadmin.exe delete shadows /all /quiet, User Account Control (UAC), Endpoint Detection and Response (EDR), or non-admin execution frequently blocks the shadow copy wipe. - Run Command Prompt as Administrator on the isolated machine and type:

vssadmin list shadows

Pogosta vprašanja¶

Does paying the ransomware gang's decryptor ransom make sense if my files are synced to OneDrive, Dropbox, or Google Drive?¶

Almost never. Unlike a standalone unbacked-up local hard drive, cloud storage services (OneDrive, Dropbox, Google Drive, Box, in iCloud Drive) store files on immutable object storage backends where every modification creates a new object version and every deletion moves the object to a 30-day (or 93-to-180-day) trash container. Whether the ransomware overwrote your files in place or created new .locked files and deleted the originals, 100 percent of your unencrypted original files are still sitting on the cloud provider's servers inside Version History or the Trash. Using Restore your OneDrive, Dropbox Rewind, or Google Drive Trash and Revision recovery restores your exact pre-attack files for free with zero risk of broken ransomware decryptors.

Why did ransomware on my Windows PC manage to encrypt my Google Drive or OneDrive in the first place? Doesn't the cloud protect against malware?¶

To make cloud files work with desktop programs like Microsoft Word, Excel, Photoshop, and AutoCAD, desktop sync clients (Google Drive za namizne računalnike, OneDrive.exe, Dropbox.exe) namestite shrambo v oblaku kot a črka lokalne mape ali navideznega pogona (G:\ oz C:\Uporabniki\Ime\OneDrive) pod vašimi uporabniškimi dovoljenji Windows. Ko se izsiljevalska programska oprema izvaja pod vašim uporabniškim računom Windows, ima popolnoma enaka dovoljenja za spreminjanje datotek kot vi: sprehodi se po vsaki črki nameščenega pogona (C:\, D:\, G:\) and user folder, reading each file, encrypting it, and saving it. Even files set to "Online-Only / Stream Files" (Files On-Demand) get automatically downloaded ("hydrated") on the fly by Windows whenever the ransomware process opens the file handle to read it. That is why unplugging the network immediately is critical: it breaks the on-demand hydration download of online-only cloud files before the ransomware can read them.

What if I accidentally deleted a massive Shared Folder in Google Drive or Dropbox, and other team members owned some of the files inside it?¶

In Dropbox, any member with edit permissions can use Deleted files oz Dropbox Rewind on the shared folder to restore the entire folder hierarchy for the whole team. In Google Drive, ownership architecture is unique: when you delete a subfolder inside someone else's Shared Folder (where they are the Owner and you are an Editor), removing the file from the shared folder orphans the file rather than trashing it for the owner, or moves only the files you own into your Trash (drive.google.com/drive/trash) while files owned by your colleague go into their Trash (or become orphaned in their root Drive searchable via is:unorganized owner:me in the Google Drive search bar).

Can ransomware delete my Cloud Version History or empty my OneDrive / Google Drive Recycle Bin automatically?¶

Standard file-system ransomware binaries (LockBit, Akira, BlackCat, Igraj, Fobos) delujejo izključno prek API-jev lokalnega datotečnega sistema Windows (CreateFileW, WriteFile, DeleteFileW) and ne more komunicirati samo s spletom Zgodovina različic, Koš druge stopnje, oz Google Workspace Admin Vault. Če pa je napadalec uporabil tudi an infostealer (Lumma, RedLine) ali je imel interaktivno oddaljeno namizje (RDP / AnyDesk) dostop do vašega odprtega spletnega brskalnika, lahko ročno odprejo vaš brskalnik in kliknejo Izprazni koš. Tudi če bi, se spomnite dveh končnih varovalk: (1) Vklopljeno OneDrive / SharePoint, izpraznjeni artikli gredo v Koš druge stopnje do 93 dni; in (2) Vklopljeno Google Drive / Google Workspace, izpraznjene elemente koša še naprej lahko obnovi skrbnik Workspace ali podpora za Google One 25 dni po trajnem izbrisu.

Sorodni vodniki¶

• Izsiljevalska in zlonamerna programska oprema: takojšnja izolacija in obnovitev
• Accidental file deletion, formatted drive, and photo recovery
• Poškodovana datoteka Word, Excel, PDF ali zbirka podatkov in obnovitev neshranjenega dokumenta
• Computer backups: 3-2-1 strategy and disaster recovery
• Session cookie hijacking, infostealer malware, and passkey revocation
• Številke za klic v sili po državah

Viri in uradna navodila¶

• Microsoftova uradna podpora (support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15): Obnovite svoj OneDrive (30-dnevni histogram za povrnitev na točko v času, opozorila o odkrivanju izsiljevalske programske opreme in prvo/drugostopenjsko obnovitev SharePointovega koša).
• Uradni center za pomoč Dropbox (help.dropbox.com/delete-restore/rewind & recover-older-versions): Uporaba Dropbox Rewind za razveljavitev izsiljevalske programske opreme ali množičnih izbrisa, 30- do 180-dnevna zgodovina različic in .dropbox.cache Uprizoritev.
• Pomoč za skrbnike za Google Workspace in uradna dokumentacija za Google Drive (support.google.com/a/answer/6052340 & developers.google.com/drive/api/reference/rest/v3/revisions): Obnovitev trajno izbrisanih podatkov Google Drive v 25 dneh prek skrbniške konzole in Drive API v3 revisions Upravljanje.
• Cybersecurity and Infrastructure Security Agency (CISA / StopRansomware.gov): Izolacija sinhronizacije shranjevanja v oblaku in najboljše prakse za povrnitev različice po izsiljevalski programski opremi.