Published: 08.10.2026
Ransomware and accidental deletion have one thing in common: they change or remove files that you need. Automated snapshots keep earlier states of your Cloud Drive storage, so that you can return to a version from before the damage. This article explains how that protection works, what it does not cover and how to restore a single file step by step.
How snapshots protect your data
A snapshot records the state of the storage at one point in time. If files are deleted later, or a malicious program encrypts them, the snapshot still holds the earlier versions, provided it was taken before the damage. Cloud Drive offers automated snapshots, up to 10, so a regular schedule means less work is lost when something goes wrong.
What snapshots do not cover
- Damage that happened before the oldest snapshot still in the history.
- Changes that you made on purpose, unless you recognise them and choose an earlier version.
- Files that were never copied to Cloud Drive in the first place.
- An attacker who obtains an administrative login and removes the storage contents, which is why accounts need protection.
Because the number of snapshots is limited, the oldest version eventually leaves the history. An infection noticed late may therefore have no clean version left, which is why quick detection matters.
Layers of defence
- Use a separate subaccount for each backup job, limited to its own folder.
- Use read-only subaccounts for accounts that only need to read files, such as a reporting tool.
- Use unique passwords or keys for each account, and keep them outside the servers they serve.
- Keep an independent copy of critical files in a separate place as well.
Restore a single file
- Determine when the file was last correct, using your notes, logs or the modification dates.
- Find the snapshot from just before the problem in the customer area, and follow the restore options shown there.
- Restore the file to a separate folder or under a new name, rather than over the current file, so that you can compare the two.
- Open the restored copy and check its content before you replace anything.
- Copy the verified file back to its place, and record what happened and when.
If you cannot see how a single file is restored from a snapshot, open a support ticket before you try anything that could overwrite data.
Restore a folder or a larger set
For a larger recovery, restore a folder into a separate location first, check the result and then decide whether to replace the live data. Replacing everything at once can erase the evidence you need to understand the incident. Keep the affected copy until the investigation is finished, and document the times and folders involved.
Test the process
Test restores before you need them. Once a quarter, choose a file at random, restore it from an earlier snapshot and compare its content with the expected version. Record how long the steps took. A process that you have practised is much easier to follow under pressure.
Frequently asked questions
Is a snapshot enough protection against ransomware? It is an important layer, but not the only one. Combine it with separate credentials, independent copies and early detection.
How many snapshots are kept? Automated snapshots are included, up to 10. Check which dates the snapshots cover, to decide how far back you need to go.
Can I restore a file that I deleted on purpose? Yes, if the file is in a snapshot taken before the deletion. Snapshots taken after the deletion will not contain it.
