Ransomware

Hi,

Just a pre-emptive question in case I ever get hit by a Ransomware attack.  

I sync all my data to Onedrive for Business from several PC's and I have versioning enabled and if I look at a file, I can see all the previous versions.  Now, an assumption.  If a Ransomware program ever got onto a PC, it would encrypt my files and rename them.  Looking at versioning it appears there are several Powershell scripts around which will restore a previous version so this would (hopefully) get around the encryption as a new version would be created when the file was modified.  Even if I had to go back several versions then that is better than nothing.  Then there is the rename.  In a test, I can't see a way of undo'ing a file rename on Onedrive for Business.

Does anyone know how to do this or has anyone got any experience of recovering from a Ransomware attack.

Thanks

Joe

Hi Joe,

In case that you are not able to recover your data through recycle bin or version history, you can immediately contact our Office 365 for Business Support hotline if you need to restore your online documents. The point in time which we can restore your documents are limited to those within 14 days, prior to the time the restored is executed.


Or you may just select your Country or Region, then the phone number will be displayed.


Let us know if you need further assistance.

Thanks,

Mike

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Joe,

Do you need further assistance on this?

Thanks,

Mike

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Michael, 

I understand your reply is a few month old at this point, but My company has been hit 3 times in the last month by ransomware and we are now at the point that we may just move off all our files off our local server and into our respective business one drive accounts. 

Am I understanding your answer correctly in that we have 14 days, if infected, to recover our files? What happens after the 14 days and also how long does the recovery process usually take?

Any info at all would be helpful as we're pretty much at wits end on preventing this from happening again. 

Thank you. 

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Rich,

 

In case your files has been deleted on a local folder that is sync to your SharePoint or OneDrive for Business, the files are not deleted immediately. Instead, it is sent to the site’s Recycle Bin, where you can restore the deleted content if needed. Note that, documents in the recycle bin are held only for a period. You can check this article for more information.

 

Another method is the versioning of files on a SharePoint list or library. You can still restore and track items on a list or library whenever a user has modified the document. You can check this link for more information regarding versioning.

 

As for your concern, in case of data loss scenarios, Microsoft Support will assess/evaluate the situation to provide the best option available to recover the desired content.

 

Thanks,

Mike

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks for the reply Mike. We're at the end of our rope as far as these type of attacks go. For a fail-safe most will move files into the one drive while we explore our share point options/capabilities. 

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated September 30, 2021 Views 203 Applies to: