Restore History - Recover from ransomware


If your files get encrypted by ransomware, you can use the Restore History function to restore those files to an earlier version without losing any data.


Above: example of encrypted files.



How to use the tool:


  1. Select the affected share under Share name.
  2. Select the Start date under Date. Files will be restored to the latest version with a modification date before your selected Start date. In the example situation above, you would likely want to select 15-03-2016 to recover those ransomware-encrypted files. Selecting an End date as well will cause the tool to restore only files with a current last modified date between and including the Start and End dates.
  3. Type in the file extension that your files were renamed to under File extensions. In our example, it is "locked".  Leaving it blank will restore files of any type.
  4. Click Start recovery and approve when you are certain.




✔  The system will now restore an earlier, non-encrypted version of the files.

✔  You can immediately see the restored files in the web app.

✔  Within up to 20 minutes (or after a restart), the server will also return the correct version in the PC Client.


Above: example of recovered files.


Important Note!

The Restore History action can not be reversed. Make sure that the settings are correct before executing it.

This feature relies on storing historical file versions. If the files do not have an available history version (eg. due to low history settings), then they can not be restored to an earlier version.

Finally, please ensure that:

1. Share name is set to the Share that contains the encrypted files.
2. End date is set to the date, or before the date the files were encrypted.
3. The correct file extension is specified. Leave the file extension field blank if you'd like to restore every single file in the Share.
4. The correct user is specified, or the User field is blank.
5. That your files have a version in their history to restore them to.



In the event that this still doesn't bring your files back, it is probable that the ransomware didn't encrypt your files but deleted them instead.


In this case, you can find the deleted files and restore them by undeletion.



If you have further questions or clarifications, feel free to contact us by submitting a ticket through RushFiles HelpDesk Support.