Cloud Storage recovery after accidental mass changes or ransomware

If a device sync client accidentally deletes many files, overwrites folders, or encrypts files (ransomware), the situation can spread quickly because sync will replicate changes to Cloud Storage.

This guide describes a safe recovery workflow for Cloud Storage (powered by Nextcloud).

1) Stop the damage immediately

• Pause or quit the Cloud Storage sync app on all computers/phones that are connected.
• If you suspect malware, disconnect the affected device from the network.
• Do not “clean up” files locally first — those changes may sync and make recovery harder.

2) Check what happened (Activity / Audit)

1. Log in to Cloud Storage in a browser.
2. Open Activity (or a similar log section).
3. Identify:
   • which user account made the changes,
   • when the changes started,
   • which folders were affected.

This helps you decide what to restore and which device/user to investigate.

3) Restore deleted data from “Deleted files”

If files were deleted, the fastest recovery is usually:

1. Open the Deleted files / Trash section in Cloud Storage.
2. Sort by date and restore the affected folders/files.

4) Restore overwritten/encrypted files using “Versions”

For ransomware/encryption cases, files are often overwritten, not deleted. Use file versions:

1. Locate an affected file in Cloud Storage.
2. Open the file menu and select Versions (or “Previous versions”).
3. Restore a version from before the incident.

Tip: Start with a small test folder to confirm you are restoring the correct point in time.

5) Secure the account before re‑enabling sync

• Change the Cloud Storage password.
• Enable 2FA if available.
• Review active devices/sessions and remove unknown sessions if the interface provides that option.
• Review share links and revoke any that should no longer be public.

6) Reconnect sync clients carefully

• Re‑enable sync on one device first and monitor what it uploads/downloads.
• If you see conflict files or re‑deletions, stop sync and review settings.
• In serious cases, it can be safer to remove the local sync folder and download a clean copy after recovery.

Important notes

• Retention of deleted items and versions depends on your quota and server policies. The sooner you act, the better your chances.
• If you suspect malware, clean the affected device before reconnecting it to sync.