{"en":"This page is not currently available in your language.","id":"Halaman ini sekarang belum tersedia dalam bahasa Anda.","ms":"Laman ini kini belum boleh didapati dalam bahasa anda.","es_ES":"Esta página no está disponible en tu idioma en este momento.","da_DK":"Denne side er i øjeblikket ikke tilgængelig på dit sprog.","fr":"Cette page n'est actuellement pas disponible dans votre langue.","de":"Diese Seite ist zurzeit nicht in Ihrer Sprache verfügbar.","en_GB":"This page is not currently available in your language.","pl":"Ta strona aktualnie nie jest dostępna w Twoim języku.","it":"Al momento questa pagina non è disponibile nella tua lingua.","nl_NL":"Deze pagina is momenteel niet beschikbaar in je taal.","nb_NO":"Denne siden er for øyeblikket ikke tilgjengelig på språket ditt.","ru":"На данный момент эта страница недоступна на вашем языке.","zh_TW":"此頁面目前沒有您語言的版本。","sv_SE":"Denna sida är för närvarande inte tillgänglig på ditt språk.","th_TH":"หน้านี้ยังไม่มีให้บริการในภาษาของคุณในขณะนี้","zh_CN":"本页面暂无您所需的语言版本。","ja":"申し訳ありませんが、このページは選択した言語ではご利用になれません。","pt_BR":"Esta página não está disponível no momento em seu idioma.","ko":"현재 이 페이지는 한국어 번역이 제공되지 않습니다.","es":"Esta página aún no está disponible en tu idioma.","uk_UA":"На даний момент ця сторінка недоступна на вашій мові.","en_AU":"This page is not currently available in your language."}

Recover files affected by malicious software

This article discusses a feature that is currently in alpha and is only available to a limited number of people.

What does it mean for a Dropbox product to be in "alpha" or "beta"?

Dropbox is committed to keeping your files safe. If your files were locked by malicious software, we're here to help. The Dropbox ransomware recovery feature can:

  • Detect if malicious software locked files in your Dropbox folder
  • Send you an alert that malicious software was detected
  • Help recover your locked files

Note: The ransomware recovery feature is only available to people that Dropbox notified about malicious software detected on a connected device.

How do I know if my files are locked?

Your files may be locked if:

  • You're notified that Dropbox detected malicious software
  • Your files are unusable or encrypted
  • Your filenames are followed by an unknown extension (this can look like myfile.docx.unknown)

If Dropbox notified you that we detected malicious software, read on to recover your files using the ransomware recovery feature.

If your files are locked and Dropbox didn’t notify you, contact Dropbox Support.

Recover locked files with the ransomware recovery feature

If you receive a notification that Dropbox detected malicious software on your device, you can use the ransomware recovery feature to recover your files:

Important note: If you have more than one device, follow these steps on a device that wasn't affected by malicious software.

  1. Click Start recovery in the notification.
  2. In your web browser, you're taken to dropbox.com. Click Recover files to begin the recovery process.
  3. Dropbox recovers your files. This process takes anywhere from 15 minutes to several hours.
    • During this time, the Dropbox folder on the affected device is unlinked from your account. You can still access your unlocked files on dropbox.com and on your other unaffected devices.
  4. While Dropbox recovers your files, remove the malicious software from your computer.
    • Dropbox can recover your files even if you haven’t removed the malicious software from your computer. However, if you re-link your computer without removing the malicious software, the malicious software may lock your files again.
  5. After your files are recovered, click Continue in the notification on your computer.
  6. On dropbox.com, confirm that the malicious software is removed by checking the box next to Yes, I’ve removed the malicious software.
  7. Click Re-link my computer.

Note: If you’re a Dropbox Business team admin, you can use the ransomware recovery feature on behalf of your team members. You may receive an email with information about which member and device are affected. From there, use the same steps to recover these files.

When should I use the ransomware recovery feature?

Use the ransomware recovery feature immediately after you're alerted that Dropbox deleted malicious software on your device. If you make changes in Dropbox from the affected computer, the ransomware recovery feature may not recover the correct versions of those files.

Dropbox keeps version history of your files in your Dropbox account from the past 30 days (or longer with Extended Version History or Dropbox Business). If you try to use the tool once your version history period expires after you were notified, we can’t recover your files.

Ransomeware recovery feature

Remove ransomware from your device with antivirus software

You can use a trusted antivirus program to identify and remove the malicious software from your affected device. Dropbox can’t remove the malicious software from your device. You can use a trusted antivirus software like Trend Micro to help you remove malicious software from your device.

Can I recover files before I remove the malicious software from my device?

Yes, you can recover and access files before removing the malicious software from your affected device. When you start the recovery process, the Dropbox folder on your affected device is inaccessible. We prevent it from making any additional changes to your files. Once your files are recovered, you can access and edit these files on dropbox.com or other unaffected devices.

Access your files

How were my files locked?

Some types of malicious software, like ransomware, can lock your files and make them unusable. Malicious software is most commonly spread through email attachments from untrusted senders.

If you open one of these email attachments on your computer, the malicious software can spread to your computer. Dropbox syncs any files that are in the Dropbox folder on your computer. If your computer is affected by ransomware, then the files in your Dropbox folder can be locked. These files then sync to dropbox.com.

How does Dropbox recover my files?

Dropbox keeps version history of your files in your Dropbox account from the past 30 days (or longer with Extended Version History or Dropbox Business). Dropbox can recover old versions of files that existed before malicious software affected your computer.

How does Dropbox detect ransomware in my account?

Certain patterns are associated with malicious software. We keep track of how malicious software can affect files and can detect when these behaviors are initiated from a device. This helps us identify affected accounts.

If my files were locked, what do other members of my shared folders see?

Changes made by malicious software act like any other changes to your files. If one of your shared folders contains locked files, folder members see the locked files.

To prevent further issues, don’t leave folders after your files are locked. The easiest way to recover your files is using the ransomware recovery feature. Making further changes in your Dropbox before recovering your files can complicate the recovery process.

My files were locked by malicious software, why didn’t Dropbox notify me?

There are several reasons why we may not notify you about malicious software that affects your account:

  • Malicious software constantly changes and we may not catch every instance
  • If you don’t have the desktop application installed on your computer, we can’t detect malicious software
  • If a member of your shared folder was affected by malicious software, you see these files in the shared folder
    • If this is the case, don’t remove the affected member from the folder. Removing the affected member from the shared folder removes their permission to recover files in the folder. If they choose to use the ransomware recovery feature, your shared folder can’t be recovered in the automated file recovery process.

If your files are locked, but Dropbox didn’t notify you, you can recover files or contact support.

My device wasn’t affected by malicious software, but I still got an alert from Dropbox.

In rare instances, we can falsely detect that malicious software affected your device. If you click the Dropbox notification about malicious software, you can let us know that you were not affected.

I went through the ransomware recovery process but lost the most recent edit of a file.

The ransomware recovery feature recovers your files to the last version saved before the files were locked. The most recent version may not be recovered if:

  • You were actively working on the file when the malicious software affected your computer
  • The change wasn’t synced to Dropbox before your computer was affected

I went through the ransomware recovery process and saw an error message, or Dropbox did not recover all my files.

If you saw an error message or are still missing files after the recovery is complete, reply to the email notification you received about the malicious software. Provide examples of content you’re missing or the names of files and folders that weren’t recovered to the correct version. A support agent can help you with your files.

If you left or were removed from a shared folder, it may not have been included in the recovery. Contact support to recover these files.

I’m having trouble re-linking my device after the recovery completed.

You can re-link your device through the Dropbox application on your computer.

Learn more about re-linking your computer

Note: Syncing can take time. Once your computer is relinked, allow it to complete syncing, and then your files will be accessible on this computer.

We’re sorry to hear that. Let us know how we can improve:

Thanks for your feedback! Let us know how this article helped:

Thanks for your feedback!

Community answers

    Other ways to get help

    Community

    Twitter support

    Contact support