Google Drive, OneDrive yoki Dropbox-da to'lov dasturi yoki tasodifiy ommaviy o'chirish buzilgan fayllarni barcha qurilmalarga sinxronlash (30 kunlik versiya tarixi va omborni orqaga qaytarish)¶

Windows vazifalar panelidagi yoki macOS menyu panelidagi sinxronlash belgisini tomosha qilish, ichkarida minglab biznes hujjatlari, soliq yozuvlari, oilaviy fotosuratlar va manba kodi fayllari tez aylanadi. Google Drive for Desktop, Microsoft OneDrive, Dropbox, yoki iCloud Drive ransomware tomonidan shifrlangan (.locked, .bianlian, .akira, .play, .lockbit) yoki noto'g'ri konfiguratsiya tufayli o'chiriladi rsync --delete, tasodifiy papkani sudrab olib tashlash yoki noto'g'ri skript - bu yuqori tezlikdagi ma'lumotlar halokati. Chunki bulutli ish stoli sinxronlash mijozlari real vaqtda ikki tomonlama replikatsiya uchun ishlab chiqilgan (inotify Linuxda, FSEvents macOS-da va ReadDirectoryChangesW / Cloud Filter API Windows da), ikkilik yoki tasodifiy to'lov dasturi Shift + Delete bitta virusli noutbukda darhol bulutli serverga tarqaladi va soniyalar ichida har bir boshqa ish stoli, noutbuk va shu hisobga ulangan umumiy jamoa papkasiga tushiriladi.

Biroq, bulutli sinxronlash dvigatellari xomashyo diskning ustiga yozilmaydi: sahna ortida, Microsoft OneDrive, Dropbox, Google Drive, va Box 30 kundan 180 kungacha bo'lgan vaqt oralig'idagi versiyalar tarixi, Ikkinchi bosqichli qayta ishlash qutilari va butun hisobni qaytarish vositalari () bilan server tomonida o'zgarmas ob'ektni saqlashni saqlang (OneDrive Restore Your OneDrive va Dropbox Rewind). Zararlangan kompyuterni tarmoqdan zudlik bilan uzib qo‘ysangiz, oflayn mahalliy keshlarni yig‘ish uchun ikkilamchi mashinalarda sinxronlashni to‘xtatib tursangiz va versiyalar tarixi kvotangiz bo‘yicha shifrlangan fayllarni qayta yuklashning halokatli tuzog‘idan qochsangiz, bir tsent to‘lov to‘lamasdan butun bulutli diskingizni shifrlash yoki o‘chirish boshlanishidan bir daqiqa oldin qaytarib olishingiz mumkin. Mashina uchun mahalliy zararli dasturlardan himoya qilish va fayl tizimini oʻymakorligi uchun bizning qoʻllanmalarimizga murojaat qiling ransomware va zararli dasturlarga javob, tasodifiy faylni o'chirish va formatlangan diskni tiklash, va kompyuterning zaxira nusxalari: 3-2-1 strategiyasi va falokatni tiklash. Agar ransomware hujumi kasalxonaga, klinikaga yoki favqulodda dispetcherlik tarmog'iga tushsa, darhol oflayn klinik ishlamay qolish tartib-qoidalarini faollashtiring va mahalliy favqulodda yordam raqamiga qo'ng'iroq qiling (911 AQSh va Kanadada, 112 Evropa Ittifoqi bo'ylab, 999 Buyuk Britaniyada) yoki bizning katalogimizni tekshiring favqulodda raqamlar.

Buni hozir qiling¶

1. Ethernet kabelini ajratib oling va manba kompyuterdagi Wi-Fi-ni DAVOLA o'chiring (ilovalarni yopish yoki biror narsani bosishdan oldin):
2. Nima uchun tarmoqni uzish bulutli omboringizni tejaydi: Har soniyada virusli yoki o‘chirilgan kompyuter onlayn qoladi, ish stoli sinxronlash mijozi (OneDrive.exe, GoogleDriveFS.exe, Dropbox.exe) bulutli API-ga soniyada yana 50 dan 200 gacha shifrlangan yoki oʻchirilgan fayl operatsiyalarini yuklaydi. Wi-Fi va Ethernetni kesish bulutli yuklash navbatini o'z yo'lida muzlatib qo'yadi.
3. Bir xil bulut hisobiga ulangan HAR BIR noutbuk, ish stoli, planshet va telefonga boring va ekranlarini uyg'otishdan oldin ularning Wi-Fi/Ethernet tarmog'ini o'chiring:
4. Sizning ikkilamchi oflayn noutbukingiz toza vaqt kapsulasidir: Agar uy ish stoli yoki ikkinchi darajali MacBook kechadan beri sumkangizda uxlab yotgan bo‘lsa, uning mahalliy OneDrive, Dropbox, yoki Google Drive (Mirror files / Always keep on this device) jildida hali ham fayllaringizning 100 foiz shifrlanmagan, tegilmagan nusxalari saqlanadi.
5. Agar siz ushbu ikkilamchi noutbukni Wi-Fi yoqilgan vaqtda uyg‘otsangiz, bulutli sinxronlash demoni darhol ulanadi, serverdan ommaviy o‘chirish yoki to‘lov dasturining shifrlangan matnlarini yuklab oladi va 60 soniyadan kamroq vaqt ichida ushbu toza mahalliy nusxani yo‘q qiladi. Har qanday ikkinchi darajali kompyuterni uyg'otishdan oldin uy Wi-Fi routeringizni o'chiring (uning quvvat simini ajratib oling), so'ngra oflayn rejimda mahalliy papkalarni tashqi USB diskiga nusxalang.
6. Agar sabab Ransomware bo'lsa, zararlangan kompyuterda quvvat simini torting (yoki Quvvat tugmasini 10 soniya bosib turing); Agar sabab SSD-da tasodifiy o'chirish bo'lsa, uni izolyatsiya qilib qo'ying va sinxronlash demonini o'chiring/to'xtating:
7. Ransomware: quvvatni tortib olish shifrlash iplarini to'xtatadi (AES / ChaCha20 ishchilar) mahalliy diskingizdagi qolgan shifrlanmagan papkalarni shifrlashdan saqlaydi va agar sud xotira tahlili zarur bo'lsa, o'zgaruvchan RAM kalitlarini saqlaydi.
8. Tasodifiy o'chirish: O'ldiring OneDrive.exe / Dropbox.exe / GoogleDriveFS.exe Vazifa menejerida (Ctrl + Shift + Esc) yoki Faoliyat monitorini darhol tanlang, shunda mahalliy mijoz navbatda turishni to'xtatadi DELETE API qo'ng'iroqlari.
9. Ransomware shifrlangan fayllarni qo'lda o'chirmang (.locked) bulutli veb-interfeysda, agar zararli dastur fayl kengaytmalari nomini o'zgartirgan bo'lsa:
10. Ransomware bulutli saqlash bilan qanday o'zaro ta'sir qilishini tushuning:
    • A holat: O‘z o‘rnida qayta yozish (bir xil fayl nomi): to‘lov dasturi shifrlangan Tax_2025.xlsx va shifrlangan foydali yukni aynan shu nom ostida saqladi Tax_2025.xlsx. Bu yerda bulut xizmati shifrlangan faylni Versiya 2 deb hisoblaydi, sizning toza asl faylingiz esa Versiya 1 ostida xavfsiz joylashadi. Version History.
    • Case B: Rename + Delete Original (Tax_2025.xlsx.lockbit): Eng zamonaviy ransomware o'qiydi Tax_2025.xlsx, nomli yangi faylni yozadi Tax_2025.xlsx.lockbit, va asl nusxani o'chiradi Tax_2025.xlsx. Mana, sizning toza asl nusxangiz Tax_2025.xlsx is sitting inside the Cloud Trash / Recycle Bin (and point-in-time account rollback).
11. Log into the cloud web portal (onedrive.live.com, dropbox.com, drive.google.com, icloud.com) from a CLEAN, UNINFECTED device (such as a smartphone on cellular data or an isolated computer):
12. Never log back into your cloud account from the ransomware-infected computer, and immediately revoke the infected computer's OAuth device session under your Google, Microsoft, or Dropbox Account Security page so the infected PC cannot resume syncing if someone turns it back on.
13. Use Point-in-Time Account Rollback (Restore your OneDrive yoki Dropbox Rewind) instead of restoring 50,000 files one by one:
14. Both Microsoft OneDrive and Dropbox include an automated whole-account time machine that rolls every folder, file version, and deleted item across your entire drive back to a specific timestamp (1 hour ago, Yesterday at 11:00 PM, or up to 30 to 180 days ago) bitta server tomonidagi operatsiyada.

Qaror daraxti: bulutli sinxron falokatni to'xtatish va o'z vaqtida tiklash¶

Execute this emergency workflow to stop cross-device sync propagation and restore your clean cloud state:

flowchart TD
    Start["Ransomware Encryption OR Accidental Mass Deletion Syncing Across Cloud Drive"] --> CutNet["STEP 1: Unplug Ethernet & Turn Off Wi-Fi on the Source Computer Immediately (Or Unplug the Wi-Fi Router Power Cord)"]

    CutNet --> SaveSecondaries["STEP 2: Keep All Secondary Laptops/PCs Offline (Airplane Mode) -> Copy Their Local 'OneDrive / Dropbox / Google Drive' Cache Folders to an External USB Drive"]

    SaveSecondaries --> RevokeSession["STEP 3: From a Clean Phone/Browser, Open Account Security (Google / Microsoft / Dropbox) -> Revoke / Unlink the Infected PC's Desktop Sync Session"]

    RevokeSession --> WhichCloud{"Which Cloud Storage Platform Was Hit?"}

    WhichCloud -->|"Microsoft OneDrive / SharePoint (Personal or Microsoft 365)"| OneDriveRestore["Use 'Settings -> Options -> Restore your OneDrive' (Rolls Back All Edits, Renames, & Deletions Across Entire Account up to 30 Days) + Check 1st & 2nd-Stage Recycle Bin"]

    WhichCloud -->|"Dropbox (Plus, Family, Professional, Business, or Basic)"| DropboxRestore["Use 'Dropbox Rewind' on Root Folder (Rewinds Entire Account to Exact Minute Before Attack) OR Use 'Deleted files' + 'Events' Log (30 to 180 Days)"]

    WhichCloud -->|"Google Drive (Shaxsiy Gmail yoki Google Workspace)"| GDriveRestore["1. O‘chirilgan asl nusxalarni ommaviy tiklash uchun “Axlat qutisi”ni “Axlatga tashlangan sana” bo‘yicha tartiblang. 2. Qayta yozilgan fayllar uchun: sichqonchaning o‘ng tugmachasini bosing -> “Fayl haqida ma’lumot -> Versiyalarni boshqarish” YOKI Google Drive API v3 ommaviy qayta ko‘rib chiqish skriptini ishga tushiring."]

    WhichCloud -->|"Apple iCloud Drive"| iCloudRestore["'iCloud.com/recovery' saytiga kiring -> 'Fayllarni tiklash' tugmasini bosing (yaqinda o'chirilgandan bo'shatilgan bo'lsa ham oxirgi 30 kun ichida o'chirilgan fayllarni tiklaydi)"]

1-bosqich: Bulutli sinxronlash mexanizmlari to‘lov dasturini va ommaviy o‘chirishni qanday qayta ishlaydi (toza fayllaringiz qayerda yashaydi)¶

Vahima ichida tiklash tugmachalarini bosishdan oldin, bulut veb-portalida fayllaringiz qanday o'zgartirilganligini qanday tekshirib ko'ring (drive.google.com, onedrive.live.com, yoki dropbox.com). Har bir bulutli sinxronizatsiya hodisasi uchta texnik sxemadan biriga to'g'ri keladi:

Phase 2: Platform-by-platform cloud rollback and bulk version recovery¶

Follow the exact recovery procedure for your cloud provider from a clean, uninfected browser.

1. Microsoft OneDrive va SharePoint Online (Restore Your OneDrive & 2 bosqichli axlat qutisi)¶

Microsoft OneDrive-ni ransomware shifrlash va ommaviy sinxronlash o'chirishdan omon qolish uchun maxsus ishlab chiqdi:

1. Method A: Whole-Account Point-in-Time Rollback (Restore your OneDrive):
2. Available on Microsoft 365 Personal, Family, Business, and Enterprise (SharePoint Online document libraries):
3. Sign into onedrive.live.com (or your Microsoft 365 OneDrive web portal) on a clean computer.
4. Click the Settings Gear icon (top-right corner) -> select Options -> click Restore your OneDrive chap navigatsiya panelida (SharePoint jamoasi saytlarida ** ni bosingSettings Gear -> Restore this library**).
5. ** ostidaSelect a date**, tanlang Yesterday (yoki Custom date and time).
6. Faoliyat gistogramma satri diagrammasiga qarang: siz to'lov dasturini shifrlash yoki ommaviy o'chirish boshlangan daqiqani belgilovchi vaqt jadvalida katta o'sishni ko'rasiz.
7. Vaqt jadvali slayderini o‘sha boshoqning chap tomoniga torting (shuning uchun har bir zararli fayl nomini o‘zgartirish, qayta yozish va shu daqiqadan so‘ng yaratilgan o‘chirishni bekor qilish uchun tekshiriladi).
8. ** bosingRestore**. Microsoft serverlari har bir fayl modifikatsiyasini avtomatik ravishda bekor qiladi, yangi yaratilgan to'lov dasturini o'chiradi .locked fayllarni o'chirib tashlang va barcha o'chirilgan asl fayllarni voqea sodir bo'lgunga qadar aniq papka tuzilishiga qaytaring.
9. B usuli: Yashirin "Ikkinchi bosqichli axlat qutisi" (oddiy axlat qutisi bo'shatilganda):
10. Agar tajovuzkor (yoki avtomatlashtirilgan skript) OneDrive/SharePoint veb-interfeysingizga kirsa va bosgan bo'lsa-chi Empty recycle bin?
11. On OneDrive for Business / SharePoint Online (and Microsoft 365 accounts), emptying the primary Recycle Bin does NOT delete your files. Instead, it moves them into a hidden Second-Stage Recycle Bin (Site Collection Recycle Bin) where they remain protected for up to 93 days total:
    1. Ochiq Recycle bin in the left sidebar of OneDrive.
    2. Scroll all the way to the very bottom of the page and click the small link reading: Can't find what you're looking for? Check the Second-stage recycle bin.
    3. Select all files and click Restore.

2. Dropbox (Dropbox Rewind, Events Rollback, and Deleted Files)¶

1. Method A: Using Dropbox Rewind Butun papkalarni yoki butun hisobingizni orqaga qaytarish uchun:
2. Dropbox Plus, oilaviy, professional va biznes rejalarida mavjud (30 days uchun 180 days qayta ko'rib chiqish):
3. Sign into dropbox.com toza brauzerda.
4. To rewind your entire Dropbox account at once, hover over the All files header (or click the ... (More actions) menu in the right-hand action panel when no specific folder is selected) and click Rewind this folder (yoki Rewind Dropbox).
5. ** bosingGet started** -> look at the day-by-day activity graph to find the spike when the ransomware or deletion occurred -> click that day to zoom into the hour-by-hour / minute-by-minute timeline.
6. Moviy vertikal chiziqni yomon hodisa boshlanishidan oldin joylashtiring, ** tugmasini bosingContinue**, and click Rewind.
7. Dropbox will revert all overwritten files, purge the newly added ransomware notes, and resurrect all deleted folders in place.
8. Method B: What if you are on a Free Dropbox Basic account (where Dropbox Rewind is locked)?
9. Important: Even on a free Dropbox Basic (2 GB) account, Dropbox still retains full 30-day Version History and 30-day Deleted Files recovery for every single file on their servers.
10. Option 1 (Free Manual Recovery): Click Deleted files in the left sidebar of dropbox.com to filter by date and bulk-restore deleted originals; or click ... -> Activity -> Version history on any overwritten file to restore the previous clean revision.
11. Variant 2 (Instant Dropbox Plus Upgrade Unlock): Because Dropbox records the underlying event log on all accounts regardless of tier, upgrading a Dropbox Basic account to Dropbox Plus ($11.99 for 1 month) after an incident unlocks the Dropbox Rewind UI over the past 30 days of already-recorded file events.

3. Google Drive & Google Workspace (Trash, Manage Versions, Admin Console 25-Day Post-Trash Recovery, and Bulk API Rollback)¶

Unlike OneDrive and Dropbox, Google Drive does not have a single one-click "Rewind Entire Drive" button in the consumer UI, so you must use the right recovery method depending on whether the files were deleted or overwritten in place:

1. Recovering Deleted Originals from Google Drive Trash (For Rename+Delete Ransomware or Mass Deletion):
2. Ochiq drive.google.com/drive/trash in a desktop browser.
3. ** tugmasini bosingTrashed date** column header to sort the most recently deleted files to the top.
4. Click the first clean file deleted by the ransomware/accident, scroll down, hold Shift + click the last file in the batch, right-click, and select Restore (Ctrl + Z or the Restore clock icon). Every file returns directly to its original nested parent folder.
5. What if the Google Drive Trash was already Emptied? (Google One Support & Google Workspace Admin 25-Day Rescue):
6. Google Workspace (Business, Enterprise, Education, Nonprofits): Even after a user clicks Empty trash -> Delete forever, Google's servers retain the purged files for an additional 25 days. Log into admin.google.com as a Super Admin -> go to Directory -> Users -> click the affected user -> scroll down to More options (or click the left panel under the user summary) -> click Restore data -> select the Date Range (up to 25 days back), select Drive as the application, and click Restore.
7. Personal Gmail / Google One Accounts: If your personal Google Drive Trash was emptied within the last 25 days, do not write new data to the drive; immediately open support.google.com/drive/gethelp (or the Google One support chat) and request an Administrative Drive Deleted File Recovery. Google's support tooling can trigger the exact same 25-day post-trash backend restore for consumer accounts.
8. Bulk-Restoring Overwritten Files Using Manage Versions or the Google Drive API (rclone / Python):
9. For Google Docs, Sheets, and Slides: Open the file -> click File -> Version history -> See version history (Ctrl + Alt + Shift + H) and restore yesterday's timestamp.
10. For binary files (PDF, DOCX, XLSX, JPG, ZIP) overwritten in place: Right-click the file in Google Drive -> File information -> Manage versions, where Google retains older versions for 30 days (or 100 versions).
11. If thousands of binary files were overwritten in place: Do not click Manage versions 10,000 times by hand. Use rclone or a Google Apps Script / Drive API v3 revisions.list + revisions.delete script:
    • In Google Drive API v3, when an existing file is overwritten with a bad new version (Revision N), calling Drive.Revisions.remove(fileId, latestRevisionId) faqat bugungi kunda yaratilgan zararli yuqori versiyani o'chiradi, kechagi toza tahrirni avtomatik ravishda targ'ib qiladi N - 1 barcha papkalarda faol joriy fayl bo'lish uchun:

      // Run inside script.google.com (with Advanced Drive Service v3 enabled) to roll back files modified after cutoffTime
      function rollbackOverwrittenFiles() {
        const cutoff = new Date("2026-11-01T00:00:00Z"); // Set to 5 minutes BEFORE the ransomware started
        const files = DriveApp.searchFiles('modifiedDate > "2026-11-01T00:00:00" and trashed = false');
        while (files.hasNext()) {
          const file = files.next();
          const revs = Drive.Revisions.list(file.getId()).revisions;
          if (revs && revs.length > 1) {
            const latest = revs[revs.length - 1];
            if (new Date(latest.modifiedTime) > cutoff) {
              Drive.Revisions.remove(file.getId(), latest.id);
            }
          }
        }
      }
      

12. Apple iCloud Drive (iCloud.com/recovery 30 kunlik maʼlumotlarni tiklash):
13. Agar fayllar iCloud Drive-dan o'chirilgan va diskdan tozalangan bo'lsa ham Recently Deleted Mac yoki iPhone-dagi papkaga kiring icloud.com/recovery veb-brauzerda:
14. ** bosingRestore Files** -> tekshirish Select All (yoki o'chirilgan sana bo'yicha filtrlang) va bosing Restore. Apple's backend server maintains a separate 30-day recovery vault that restores deleted iCloud Drive documents, Desktop/Documents folders, Bookmarks, Contacts, and Calendars.

Phase 3: Harvesting local offline caches from secondary devices and Google DriveFS / Windows Shadow Copies¶

Before reconnecting any computer to the internet, check whether your local hard drives still hold uncorrupted copies of your files:

4-bosqich: Xavfsiz qayta ulanish protokoli (Tozalangan kompyuterlarni bulutni qayta buzmasdan qanday qilib onlayn rejimiga qaytarish mumkin)¶

Bulutni tiklashda eng ko'p uchraydigan xatolardan biri siz bulutli veb-interfeysda fayllaringizni muvaffaqiyatli tiklaganingizdan so'ng sodir bo'ladi: foydalanuvchi o'z noutbukini qayta yoqadi, mahalliy sinxronlash mijozi uyg'onadi, 20 000 ni ko'radi. .locked mahalliy qattiq diskda o'tirgan ransomware fayllari (yoki bo'sh papkalar) va korruptsiyani yangi tiklangan bulutli disk bilan sinxronlashtiradi.

Ushbu qat'iy qayta ulanish nazorat ro'yxatiga rioya qiling: 1. On the computer that caused the incident (Ransomware or Accidental Script): - If hit by Ransomware: Never reconnect that OS installation to your cloud account. After imaging the drive for forensics or rescuing any unbacked-up local-only files, completely wipe the SSD (Secure Erase / barcha bo'limlarni o'chiring) va Windows yoki macOS-ni alohida kompyuterda o'rnatilgan taniqli USB o'rnatuvchidan tozalang. - Change your Google, Microsoft, Dropbox, and Apple account passwords and review Account Security -> Devices va Third-Party App Permissions to verify no infostealer session cookies remain active. 2. On secondary computers before turning Wi-Fi back on: - If you already restored the cloud drive to a clean state via Restore your OneDrive yoki Dropbox Rewind: 1. Boot the secondary computer with Wi-Fi still OFF. 2. Disable OneDrive / Dropbox / Google Drive in Startup Apps (Task Manager -> Startup apps) so the sync daemon cannot launch automatically. 3. Rename the local C:\Users\<Name>\OneDrive (yoki Dropbox) folder to OneDrive_OLD_LOCAL_BACKUP. 4. Turn Wi-Fi back on, launch the cloud sync app, let it unlink and relink cleanly, and allow it to download the freshly restored clean cloud state into a brand-new folder.

3. Restoring Windows Volume Shadow Copies (Previous Versions) and macOS APFS Local Snapshots on the Source PC¶

What if a folder that was encrypted or deleted was excluded from cloud sync (such as a local Desktop folder or a file larger than the sync limit), or the cloud sync client had not finished uploading last week's edits before the crash? 1. Windows 10/11 da (ShadowExplorer & vssadmin): - While many ransomware families attempt to run vssadmin.exe delete shadows /all /quiet, Foydalanuvchi hisobini boshqarish (UAC), Endpoint Detection and Response (EDR), or non-admin execution frequently blocks the shadow copy wipe. - Run Command Prompt as Administrator on the isolated machine and type:

vssadmin list shadows

Tez-tez beriladigan savollar¶

Does paying the ransomware gang's decryptor ransom make sense if my files are synced to OneDrive, Dropbox, or Google Drive?¶

Almost never. Unlike a standalone unbacked-up local hard drive, cloud storage services (OneDrive, Dropbox, Google Drive, Box, va iCloud Drive) store files on immutable object storage backends where every modification creates a new object version and every deletion moves the object to a 30-day (or 93-to-180-day) trash container. Whether the ransomware overwrote your files in place or created new .locked files and deleted the originals, 100 percent of your unencrypted original files are still sitting on the cloud provider's servers inside Version History or the Trash. Using Restore your OneDrive, Dropbox Rewind, or Google Drive Trash and Revision recovery restores your exact pre-attack files for free with zero risk of broken ransomware decryptors.

Why did ransomware on my Windows PC manage to encrypt my Google Drive or OneDrive in the first place? Doesn't the cloud protect against malware?¶

To make cloud files work with desktop programs like Microsoft Word, Excel, Photoshop, and AutoCAD, desktop sync clients (Google Drive for Desktop, OneDrive.exe, Dropbox.exe) mount your cloud storage as a local folder or virtual drive letter (G:\ yoki C:\Users\Name\OneDrive) under your Windows user permissions. When ransomware executes under your Windows user account, it has the exact same file-modification permissions you do: it walks every mounted drive letter (C:\, D:\, G:\) and user folder, reading each file, encrypting it, and saving it. Even files set to "Online-Only / Stream Files" (Files On-Demand) get automatically downloaded ("hydrated") on the fly by Windows whenever the ransomware process opens the file handle to read it. That is why unplugging the network immediately is critical: it breaks the on-demand hydration download of online-only cloud files before the ransomware can read them.

What if I accidentally deleted a massive Shared Folder in Google Drive or Dropbox, and other team members owned some of the files inside it?¶

In Dropbox, any member with edit permissions can use Deleted files yoki Dropbox Rewind on the shared folder to restore the entire folder hierarchy for the whole team. In Google Drive, ownership architecture is unique: when you delete a subfolder inside someone else's Shared Folder (where they are the Owner and you are an Editor), removing the file from the shared folder orphans the file rather than trashing it for the owner, or moves only the files you own into your Trash (drive.google.com/drive/trash) while files owned by your colleague go into their Trash (or become orphaned in their root Drive searchable via is:unorganized owner:me in the Google Drive search bar).

Can ransomware delete my Cloud Version History or empty my OneDrive / Google Drive Recycle Bin automatically?¶

Standard file-system ransomware binaries (LockBit, Akira, BlackCat, Play, Phobos) operate purely through local Windows filesystem APIs (CreateFileW, WriteFile, DeleteFileW) va cannot interact with the web-only Version History, Second-Stage Recycle Bin, yoki Google Workspace Admin Vault. However, if the attacker also deployed an infostealer (Lumma, RedLine) or had interactive Remote Desktop (RDP / AnyDesk) access to your open web browser, they might manually open your browser and click Empty Trash. Even if they did, remember the two ultimate backstops: (1) On OneDrive / SharePoint, emptied items go to the Second-Stage Recycle Bin for up to 93 days; and (2) On Google Drive / Google Workspace, emptied Trash items remain recoverable by a Workspace Admin or Google One Support for 25 days after permanent deletion.

Tegishli qo'llanmalar¶

• Ransomware and malware: immediate isolation and recovery
• Accidental file deletion, formatted drive, and photo recovery
• Corrupted Word, Excel, PDF, or database file and unsaved document recovery
• Kompyuterning zaxira nusxalari: 3-2-1 strategiyasi va falokatni tiklash
• Seans kukilarini o'g'irlash, ma'lumot o'g'irlash uchun zararli dastur va kalitni bekor qilish
• Mamlakat bo'yicha favqulodda raqamlar

Manbalar va rasmiy ko'rsatmalar¶

• Microsoft Official Support (support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15): Restore Your OneDrive (30-Day Point-in-Time Rollback Histogram, Ransomware Detection Alerts, and First/Second-Stage SharePoint Recycle Bin Recovery).
• Dropbox Official Help Center (help.dropbox.com/delete-restore/rewind & recover-older-versions): Using Dropbox Rewind to Undo Ransomware or Mass Deletions, 30-to-180-Day Version History, and .dropbox.cache Staging.
• Google Workspace Admin Help & Google Drive Official Documentation (support.google.com/a/answer/6052340 & developers.google.com/drive/api/reference/rest/v3/revisions): Restoring Permanently Deleted Google Drive Data Within 25 Days via Admin Console and Drive API v3 revisions Management.
• Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA / StopRansomware.gov): Cloud Storage Sync Isolation and Post-Ransomware Version Rollback Best Practices.