# Recover your files after ransomware or mass deletion

Ransomware encrypted your files, or many files were deleted or changed at once? Stop the damage, then restore them from the Trash and file versions.

Updated: 2026-10-22  
Source: https://drime.cloud/support/security-and-privacy/recover-from-ransomware

Ransomware on a computer can encrypt or delete files in your Drime folder, and those changes then reach your Drime account. Drime cannot roll your whole Drive or a folder back to a date, but you can bring files back from the Trash and from their earlier versions.

**Checks**

1. Disconnect the infected computer from the internet, and stop Drime Desktop on it, so the damage stops spreading.
2. From a clean device, sign in to Drime on the web and change your password: see [I think someone else is using my account](https://drime.cloud/support/security-and-privacy/account-hacked).
3. Clean the infected computer before you reconnect it.

**How to fix it**

### Files were deleted

Deleted files stay in the **Trash** for 30 days, then Drime deletes them permanently (sooner if the Trash is emptied). Act within that time: in the Trash, use the **Deleted by** and **Date deleted** filters to find what was deleted at the time of the attack, select the items, then click **Restore**. They go back where they were.

See [Restore deleted files from the Trash](https://drime.cloud/support/drive/restore-deleted-files).

### Files were encrypted or changed

Each file keeps its earlier versions. For each damaged file, right-click it, click **File versions**, then restore the last version from before the attack with **Restore this version**.

Drime keeps up to 10 versions per file, for a number of days that depends on your plan: 30 days on the free and Starter plans, 90 days on Essentials, and 120 days on Professional and Advanced. The version dialog shows it. Act quickly, before the oldest versions are removed.

See [Restore a previous version of a file](https://drime.cloud/support/drive/restore-a-previous-version).

### In a workspace

Workspace admins are alerted by email when Drime suspects ransomware or a mass deletion. The **Alert policies** of the admin console control these alerts. See [Workspace activity log and security alerts](https://drime.cloud/support/workspaces/activity-and-alerts).

**Still stuck?**

If many files cannot be restored this way, [contact Drime support](https://drime.cloud/support/getting-started/contact-drime-support) with the time of the attack and the folders concerned.

## Next steps

- [Restore deleted files from the Trash](https://drime.cloud/support/drive/restore-deleted-files)
- [Restore a previous version of a file](https://drime.cloud/support/drive/restore-a-previous-version)
- [Workspace activity log and security alerts](https://drime.cloud/support/workspaces/activity-and-alerts)