Ransomware is a type of malware that encrypts your files, making them inaccessible. The attackers then demand ransom to unlock the files. Fortunately, if your files are in Dropbox, you can restore them to the time before the malware took effect.
If you have a Basic (free) or Plus account, you can restore a previous version of a file within 30 days of the change. If you have a Professional or Business account, you have 120 days. If you previous purchased the extended version history add-on for your Plus account, you have one full year.
Note: The extended version history add-on is no longer available for purchase.
Restore an individual file
Follow the instructions to recover an old version of a file by going to the file's version history.
When you look at a file's version history, you'll be able to see which user account and computer last edited the file.
The most recent computer to edit the file is probably infected with ransomware. To prevent further problems, unlink the computer and scan it with an antivirus app.
Restore a large number of files
If the number of files to restore is large, send deletion event links to Dropbox support. When contacting Dropbox support, you'll have two options:
- Undo only the events you specify
- Roll back your entire account to a point in time before an event occurred
If the malware affected files in a shared folder, you'll need to provide links for each shared folder. Once you've provided the required links, Dropbox Support will attempt to undo the events in question.
- Note: For most users, there's a 30-day limit for recovering previous versions of files. If you need files restores, contact us as soon as possible.
Restore renamed files
If ransomware renamed your files, you can restore previous version of the files from your deleted files view on dropbox.com. Once the correctly named files are restored, you can delete the encrypted versions of the files.
If a large amount of files were renamed, please contact Dropbox Support for further assistance.