--- title: What is the Advanced Ransomware Recovery feature? description: "Ransomware typically infects user endpoints, such as laptops or desktops, and encrypts files stored on those devices. When cloud synchronization services such as Google Drive, Shared Drives, OneDrive, or SharePoint are in use, the encrypted versions of those files may be synchronized to the cloud and replace the original versions.\n\nSysCloud scans your backups to identify files that may have been encrypted by ransomware. These files are referred to as encrypted files throughout this article." --- [Skip to content](https://help.syscloud.com/what-is-the-advanced-ransomware-recovery-feature#main-content) English Show submenu for translations [Create Ticket](https://help.syscloud.com/kb-tickets/new?hsLang=en) ![Untitled design (1)-Aug-01-2022-12-37-27-80-PM.png\]](https://help.syscloud.com/hs-fs/hubfs/Untitled%20design%20(1)-Aug-01-2022-12-37-27-80-PM.png?height=40&name=Untitled%20design%20(1)-Aug-01-2022-12-37-27-80-PM.png) - [Help Center](https://help.syscloud.com/) - [Go to SysCloud](https://www.syscloud.com/) Open main navigation Close main navigation - [Help Center](https://help.syscloud.com/) - [Go to SysCloud](https://www.syscloud.com/) - English Show submenu for translations - [Create Ticket](https://help.syscloud.com/kb-tickets/new) Hello. How can we help you? - There are no suggestions because the search field is empty. 1. [Help Center](https://help.syscloud.com/?hsLang=en) 2. [Add-ons](https://help.syscloud.com/add-ons?hsLang=en) 3. [Ransomware](https://help.syscloud.com/add-ons?hsLang=en#ransomware) # What is the Advanced Ransomware Recovery feature? Ransomware typically infects user endpoints, such as laptops or desktops, and encrypts files stored on those devices. When cloud synchronization services such as Google Drive, Shared Drives, OneDrive, or SharePoint are in use, the encrypted versions of those files may be synchronized to the cloud, replacing the original versions. SysCloud scans your backups to identify files that may have been encrypted by ransomware (referred to as "encrypted files" throughout this article) and provides recovery and remediation options to help administrators respond to potential ransomware incidents. Files identified as potentially encrypted are flagged and displayed in the **Ransomware Protection** section of the SysCloud dashboard, where administrators can review and take appropriate actions. #### Actions available for identified encrypted files: **1. Transfer ownership**: - **Transfer Ownership** - Transfer ownership of the files to an admin for further review. Refer to this [LINK](https://help.syscloud.com/how-to-transfer-ownership-of-a-ransomware-flagged-file?hsLang=en)for steps - **Restore Ownership** - Restore the file ownership to the original owner if one or more ownership transfers were performed on the selected file(s). Refer to this [LINK](https://help.syscloud.com/how-to-restore-ownership-of-a-ransomware-flagged-file?hsLang=en) for steps - **Quarantine File(s)** - Remove all file sharing and transfer the ownership to the SysCloud account owner. Refer to this [LINK](https://help.syscloud.com/how-do-i-quarantine-files-when-addressing-ransomware-violations-in-syscloud-backup?hsLang=en)for steps **2. Remove Sharing**: - **Remove all sharing**: This will revoke all sharing permissions for the file, allowing only the file owner to retain access. Refer to this [LINK](https://help.syscloud.com/how-to-remove-all-sharing-from-a-ransomware-flagged-file?hsLang=en)for steps - **Remove link sharing**: This action will revoke all access to the file granted via link sharing, leaving only direct access intact. Refer to this [LINK](https://help.syscloud.com/how-to-remove-link-sharing-from-a-ransomware-flagged-file-for-google-workspace?hsLang=en)for steps - **Remove external domain sharing**: This action will revoke all access granted to users from external domains, whether through direct sharing or link sharing. Refer to this [LINK](https://help.syscloud.com/how-to-remove-external-sharing-from-a-ransomware-flagged-file?hsLang=en)for steps. **3. Restore from safe snapshot**: Restore the safe version of the files identified by SysCloud's algorithm or recover files that may have been removed by ransomware or the user. Refer to this [LINK](https://help.syscloud.com/how-to-restore-from-a-safe-snapshot-after-ransomware-detection?hsLang=en)for steps **4. Delete**: Delete the affected files from the SysCloud Archives or directly from the cloud environment. Refer to this [LINK](https://help.syscloud.com/how-do-i-delete-encrypted-and-ransomware-infected-files-from-my-backup-archives-and-live-cloud?hsLang=en)for steps. **5. Dismiss**: If you determine that the detected files do not pose a threat, dismiss the alert. Refer to this [LINK](https://help.syscloud.com/how-to-dismiss-a-ransomware-violation?hsLang=en)for steps - [Get started with Turbo backup](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#main-content) - [General](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#general) - [Account creation](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#account-creation) - [Create and configure backup jobs](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#create-and-configure-backup-jobs) - [Connect clouds](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#connect-clouds) - [Configure backup](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#configure-backup) - [Manage archives](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#manage-archives) - [Cloud Connection](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#cloud-connection) - [Notification Center](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#notification-center) - [Settings](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#settings) - [Manage Legacy backup](https://help.syscloud.com/manage-legacy-backup?hsLang=en#main-content) - [General](https://help.syscloud.com/manage-legacy-backup?hsLang=en#general) - [SysCloud application](https://help.syscloud.com/manage-legacy-backup?hsLang=en#syscloud-application) - [Backup archives](https://help.syscloud.com/manage-legacy-backup?hsLang=en#backup-archives) - [Error messages](https://help.syscloud.com/manage-legacy-backup?hsLang=en#error-messages) - [Google Workspace](https://help.syscloud.com/google-workspace?hsLang=en#main-content) - [Setup Google Workspace backup](https://help.syscloud.com/google-workspace?hsLang=en#setup-google-workspace-backup) - [Google Admin Console](https://help.syscloud.com/google-workspace?hsLang=en#google-admin-console) - [Google Chat](https://help.syscloud.com/google-workspace?hsLang=en#google-chat) - [Backup archives](https://help.syscloud.com/google-workspace?hsLang=en#backup-archives) - [Restore](https://help.syscloud.com/google-workspace?hsLang=en#restore) - [Export](https://help.syscloud.com/google-workspace?hsLang=en#export) - [Errors](https://help.syscloud.com/google-workspace?hsLang=en#errors) - [Sync](https://help.syscloud.com/google-workspace?hsLang=en#sync) - [Cloud connection](https://help.syscloud.com/google-workspace?hsLang=en#cloud-connection) - [Google Classroom](https://help.syscloud.com/google-classroom?hsLang=en#main-content) - [Setup Google Classroom backup](https://help.syscloud.com/google-classroom?hsLang=en#setup-google-classroom-backup) - [Backup archives](https://help.syscloud.com/google-classroom?hsLang=en#backup-archives) - [Restore](https://help.syscloud.com/google-classroom?hsLang=en#restore) - [Export](https://help.syscloud.com/google-classroom?hsLang=en#export) - [Microsoft 365](https://help.syscloud.com/microsoft-365?hsLang=en#main-content) - [Setup Microsoft 365 backup](https://help.syscloud.com/microsoft-365?hsLang=en#setup-microsoft-365-backup) - [Backup archives](https://help.syscloud.com/microsoft-365?hsLang=en#backup-archives) - [Restore](https://help.syscloud.com/microsoft-365?hsLang=en#restore) - [Export](https://help.syscloud.com/microsoft-365?hsLang=en#export) - [Errors](https://help.syscloud.com/microsoft-365?hsLang=en#errors) - [Sync](https://help.syscloud.com/microsoft-365?hsLang=en#sync) - [Slack](https://help.syscloud.com/slack?hsLang=en#main-content) - [Setup Slack backup](https://help.syscloud.com/slack?hsLang=en#setup-slack-backup) - [Slack Backup archives](https://help.syscloud.com/slack?hsLang=en#slack-backup-archives) - [Restore Slack data](https://help.syscloud.com/slack?hsLang=en#restore-slack-data) - [Export Slack data](https://help.syscloud.com/slack?hsLang=en#export-slack-data) - [Resolve Slack errors](https://help.syscloud.com/slack?hsLang=en#resolve-slack-errors) - [QuickBooks Online](https://help.syscloud.com/quickbooks-online?hsLang=en#main-content) - [Setup QuickBooks Online backup](https://help.syscloud.com/quickbooks-online?hsLang=en#setup-quickbooks-online-backup) - [Backup archives](https://help.syscloud.com/quickbooks-online?hsLang=en#backup-archives) - [Restore](https://help.syscloud.com/quickbooks-online?hsLang=en#restore) - [Export](https://help.syscloud.com/quickbooks-online?hsLang=en#export) - [Xero](https://help.syscloud.com/xero?hsLang=en#main-content) - [Backup archives](https://help.syscloud.com/xero?hsLang=en#backup-archives) - [Export](https://help.syscloud.com/xero?hsLang=en#export) - [Setup Xero backup](https://help.syscloud.com/xero?hsLang=en#setup-xero-backup) - [HubSpot](https://help.syscloud.com/hubspot?hsLang=en#main-content) - [Setup HubSpot backup](https://help.syscloud.com/hubspot?hsLang=en#setup-hubspot-backup) - [Backup archives](https://help.syscloud.com/hubspot?hsLang=en#backup-archives) - [Restore](https://help.syscloud.com/hubspot?hsLang=en#restore) - [Export](https://help.syscloud.com/hubspot?hsLang=en#export) - [Errors](https://help.syscloud.com/hubspot?hsLang=en#errors) - [Salesforce](https://help.syscloud.com/salesforce?hsLang=en#main-content) - [Setup Salesforce backup](https://help.syscloud.com/salesforce?hsLang=en#setup-salesforce-backup) - [Backup archives](https://help.syscloud.com/salesforce?hsLang=en#backup-archives) - [Restore](https://help.syscloud.com/salesforce?hsLang=en#restore) - [Export](https://help.syscloud.com/salesforce?hsLang=en#export) - [Errors](https://help.syscloud.com/salesforce?hsLang=en#errors) - [Box](https://help.syscloud.com/box?hsLang=en#main-content) - [Setup backup](https://help.syscloud.com/box?hsLang=en#setup-backup) - [Restore Box Data](https://help.syscloud.com/box?hsLang=en#restore-box-data) - [Resolve errors](https://help.syscloud.com/box?hsLang=en#resolve-errors) - [Export](https://help.syscloud.com/box?hsLang=en#export) - [Sky - AI Copilot](https://help.syscloud.com/sky-ai-copilot?hsLang=en) - [Add-ons](https://help.syscloud.com/add-ons?hsLang=en#main-content) - [Turbo backup](https://help.syscloud.com/add-ons?hsLang=en#turbo-backup) - [Advanced ransomware recovery](https://help.syscloud.com/add-ons?hsLang=en#advanced-ransomware-recovery) - [Archiver](https://help.syscloud.com/add-ons?hsLang=en#archiver) - [Data change insights](https://help.syscloud.com/add-ons?hsLang=en#data-change-insights) - [Security & Compliance](https://help.syscloud.com/add-ons?hsLang=en#security-compliance) - [eDiscovery](https://help.syscloud.com/add-ons?hsLang=en#ediscovery) - [Ransomware](https://help.syscloud.com/add-ons?hsLang=en#ransomware) - [Resolve errors](https://help.syscloud.com/add-ons?hsLang=en#resolve-errors) - [Partner Portal](https://help.syscloud.com/partner-portal?hsLang=en#main-content) - [Automated onboarding](https://help.syscloud.com/partner-portal?hsLang=en#automated-onboarding) - [Subscription and payments](https://help.syscloud.com/subscription-and-payments?hsLang=en#main-content) - [Manage subscription (Turbo backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-subscription-turbo-backup) - [Manage subscription (Legacy backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-subscription-legacy-backup) - [Manage Licenses (Turbo backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-licenses-turbo-backup) - [Manage Licenses (Legacy backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-licenses-legacy-backup) - [Billing FAQs](https://help.syscloud.com/subscription-and-payments?hsLang=en#billing-faqs) - [US sales tax FAQs](https://help.syscloud.com/subscription-and-payments?hsLang=en#us-sales-tax-faqs) - [Manage admin roles](https://help.syscloud.com/manage-admin-roles?hsLang=en#main-content) - [Admin roles (Turbo backup)](https://help.syscloud.com/manage-admin-roles?hsLang=en#admin-roles-turbo-backup) - [Settings](https://help.syscloud.com/settings?hsLang=en#main-content) - [Security](https://help.syscloud.com/settings?hsLang=en#security) - [Manage account](https://help.syscloud.com/settings?hsLang=en#manage-account) - [Manage users](https://help.syscloud.com/settings?hsLang=en#manage-users) - [Manage domains](https://help.syscloud.com/settings?hsLang=en#manage-domains) - [Backup](https://help.syscloud.com/settings?hsLang=en#backup) - [K-12 Security & Compliance](https://help.syscloud.com/k-12-security-compliance?hsLang=en#main-content) - [General](https://help.syscloud.com/k-12-security-compliance?hsLang=en#general) - [Google Workspace security and compliance](https://help.syscloud.com/k-12-security-compliance?hsLang=en#google-workspace-security-and-compliance) - [Microsoft 365 security and compliance](https://help.syscloud.com/k-12-security-compliance?hsLang=en#microsoft-365-security-and-compliance) - [Google Drive Encryption](https://help.syscloud.com/google-drive-encryption?hsLang=en) - [Uncategorized](https://help.syscloud.com/uncategorized?hsLang=en) - [Shopify](https://help.syscloud.com/shopify?hsLang=en#main-content) - [Setup backup](https://help.syscloud.com/shopify?hsLang=en#setup-backup) - [Restore](https://help.syscloud.com/shopify?hsLang=en#restore) - [Export](https://help.syscloud.com/shopify?hsLang=en#export) - [Ransomware](https://help.syscloud.com/ransomware?hsLang=en) - [Cookie consent](https://help.syscloud.com/cookie-consent?hsLang=en) - [Google Admin Console](https://help.syscloud.com/google-admin-console?hsLang=en) - [Microsoft O365](https://help.syscloud.com/microsoft-o365?hsLang=en#main-content) - [Restore](https://help.syscloud.com/microsoft-o365?hsLang=en#restore) - [Export](https://help.syscloud.com/microsoft-o365?hsLang=en#export) - [Backup Archives](https://help.syscloud.com/microsoft-o365?hsLang=en#backup-archives) - [Go to SysCloud](https://www.syscloud.com/) - [Create Ticket](https://www.syscloud.com/support/ticket/) [![Chill listening crop-3](https://help.syscloud.com/hs-fs/hubfs/Syscloud%20logo@2x-100.jpg?width=116&height=24&name=Syscloud%20logo@2x-100.jpg "Chill listening crop-3")](https://www.syscloud.com/) SysCloud Help Center Copyright © 2025, SysCloud Inc.