Sync vs Backup: How Long Have You Got to Undo a Ransomware Attack?
“My files are in the cloud, so they’re backed up.”
It’s an understandable assumption. Services like OneDrive, Google Drive and Dropbox keep files available across your devices, and many include useful recovery tools.
But if ransomware scrambles your files, what happens to the copies in the cloud? And how long have you got to recover them?
The answer depends on the service, your subscription and how your protection is set up.
What does syncing actually do?
Sync keeps files up to date across connected locations.
Edit a document on your laptop, and the updated version appears in the cloud and on your other devices. Delete a file, and that deletion may sync too.
The same can happen with ransomware. If malicious software encrypts files in a synced folder—making them unreadable—the sync service may upload those damaged versions.
Sync is good at keeping changes consistent. It needs recovery features to help you undo unwanted changes.
Google and Microsoft both provide tools for restoring earlier versions after ransomware damage. However, those tools have limits. Google’s recovery guidance, Microsoft’s recovery guidance.
How is a backup different?
A backup provides a separate copy you can restore when something goes wrong. A well-designed backup system keeps older recovery points, rather than continually replacing your only good copy.
For ransomware protection, those copies also need protection from the attack itself. A backup drive that is always connected, or a backup system accessible using compromised accounts, may be vulnerable.
New Zealand’s National Cyber Security Centre warns that attackers can deliberately destroy backups before encrypting systems. Having a backup matters; protecting and testing it matters too. NCSC ransomware guidance.
How long have you got to undo the damage?
There is no single recovery period that applies to everyone.
| Service or protection | Published recovery window |
|---|---|
| OneDrive with Microsoft 365 | The “Restore your OneDrive” feature can undo file and folder actions from the previous 30 days. |
| Google Drive’s bulk “Restore file versions” tool | Google documents 25 days of revisions for this tool. Its help page currently labels the feature as beta; check availability for your account. |
| Dropbox | Version history is 30, 180 or 365 days, depending on your plan. |
| A separate backup service or system | Depends on its retention settings, successful backups and whether usable copies survive the attack. |
These figures describe particular recovery features, rather than a guarantee that every file can be recovered. Deleted-file recovery, individual version history and whole-account rollback can have different rules. OneDrive limits, Google Drive limits, Dropbox plan limits.
The clock does not wait until you notice the problem.
For example, if damaged changes synced 20 days ago and your rollback window is 30 days, you may have roughly 10 days left to act. You do not get a fresh 30 days when you discover the attack.
Longer retention can give you more breathing room, but you still need a clean version from before the damage.
What should you do if ransomware strikes?
Disconnect affected devices from Wi-Fi and wired networks promptly, and get technical help. Avoid connecting backup drives to the affected computer.
Restoring files is only part of recovery. The affected devices and accounts need to be secured before normal use resumes, or recovered files could be damaged again. Ransomware response guidance, Microsoft recovery steps.