Restore history - recover from ransomware


If your files get encrypted by ransomware, you can use the Restore History function to restore those files to an earlier version without losing any data.



Above: example of encrypted files.





How to use the tool:


1. Select the affected share under Share.

2. Select "Restore files after a selected date" under Date.

3. Under After, select a date that is before the date that the files were encrypted. In our example, the files were encrypted on 15-03-2016 , therefore, we set it to 14-03-2016.

4. Type in the file extension that your files were renamed to under File extensions. In our example, it is ".locked" . Don't forget to type the "." in front of the extension.

5. Leave everything else as it is.

6. Click "Start Recovery" and approve when you are certain.







✔    The system will now restore an earlier, non-encrypted version of the files.

✔    You can immediately see the restored files in the web app.

✔    Within 5 minutes, the server will also return the correct version to your local machine and hard drive.





Above: example of recovered files.




Important If this doesn't work, please ensure that:
 
1. Share is set to the share that contains the encrypted files.
 
2. Date is set to a date BEFORE the files were encrypted.
 
3. User is NOT set.
 
4. At file extensions, don't forget the "." before the extension name ( .locked , .file ).
 




In the event that this still doesn't bring your files back, it is probable that the ransomware didn't encrypt your files, but deleted them instead.

In this case, you can find the deleted files and manually restore them via undelete.