If your files get encrypted by ransomware, you can use the RushFiles web app to restore those files to an earlier version without losing any data.



Above: example of encrypted files.


1: Open your web browser and login to the web client.

2: Navigate to Company Administration in the left panel and click on Restore History. (NOTE - you will need to be an administrator to do this)

3: Here, you will need to enter the affected share's name, and the extensions that they have. (in our example, it is ".locked")



4: In the example above the extension will be: .locked

5: Click "Start Recovery" and approve when you are certain.


The system will now restore an earlier, non-encrypted version of the files.

You can immediately see the restored files in the web app.


Within 5 minutes, the server will also return the correct version to your local machine and harddrive.


If this doesn't work, please ensure that:

1. Share is set to the share that contains the encrypted files.

2. Date is set to BEFORE the files were encrypted.

3. User is NOT set.

4. At file extensions, don't forget the "." before the extension name ( .locked ).


In the event that this still doesn't work, it is probable that the ransomware didn't encrypt your files, but deleted them instead.


In this case, you can find the deleted files and manually restore them via undelete.