Deleted files not showing up under Deleted Files (ransomware attack)

[Straffin]

In trying to recover from a ransomware attack that hit my Dropbox folder (among others), I'm not seeing the files that were deleted (and replaced with encrypted copies) in the "Deleted Files" screen. The deletion/addition activity shows up under Events just fine, but the deleted files aren't listed to restore. Any idea why? 😞

[310EI]

Hello, Straffin...

You can recover deleted files but that's only available for 30-days unless you have a pro account with extended version history in place prior to the deletions (or have a Dropbox for Business account).

[310EI · Accepted solution]

Hello, Straffin...

I'm sorry to hear about your computer being infected with ransomware.

Your first order of business is to make sure that the ransomware is COMPLETELY REMOVED from the INFECTED computer before trying to RESTORE your DATA.

NO MORE RANSOM . ORG:

• Read the useful information posted on the NoMoreRansom.org website.

• Their Crypto Sheriff page can help you to determine which ransomware is affecting your device.

• In addition, their Decryption Tool may be able to help you with DECRYPTING your locked files.

• PLEASE NOTE:  NoMoreRansom.org does not remove the ransomware from your device(s).

MORE RANSOMWARE INFORMATION:

• View Rich's answer from a different forum thread.
• Is my computer infected since my files have an; .exx, .xyz, .zzz or .aaa extension?
• CryptoWall & Help_Decrypt Ransomware Information Guide
• How to rescue your PC from ransomware.

HELP CENTER ARTICLES:

• My files were corrupted or renamed by ransomware. What can I do?
• My Dropbox files have been encrypted by a virus/malware
• Instructions for an account rollback.
• How do I recover deleted files?
• How do I recover previous versions of files?
• Why are my files missing?
• How do I rejoin a shared folder?

 
ACCOUNT ROLLBACK INSTRUCTIONS:

Be sure to read this article prior to requesting a rollback of your account.

1. Get a link to the event you'd like to undo.
2. Submit a help request.
3. Afterwards, you can track your ticket.

Replies usually take 1 to 3 business days with Pro users getting priority (longer for basic members).

PLEASE BE AWARE:

Do not submit more than one ticket for your particular problem.  Doing so will force your ticket to the end of the queue again which is counter-productive.

[Straffin]

The files were deleted yesterday. There's no sign of them under "Deleted Files".

[Straffin]

I've already submitted a support request. Unfortunately, they just replied, telling me to use the self-help system, which leads me to a page that tells me to submit a support request. 😕

[Ed]

Hi there,

Can you please share your ticket number so I can ask our support team to look into it?

[Straffin · Accepted solution]

Ed,

It's Ticket #5164677. By this point, I've already resorted to restoring files from backups and retrieving or re-creating the files from that day. Now, I really just need to know whether or not DropBox will actually be restoring the files as I requested over a week ago, or if I'm safe to re-populate my DropBox with the files that I've recovered on my own.

Granted, I'm also very interested in why none of them showed up under Deleted Files after less than 24 hours had passed, but that almost seems like an afterthought by now ...

- John

[EdGarcia]

---

@310EI wrote:

NO MORE RANSOM . ORG:

• Read the useful information posted on the NoMoreRansom.org website.

• Their Crypto Sheriff page can help you to determine which ransomware is affecting your device.

• In addition, their Decryption Tool may be able to help you with DECRYPTING your locked files.

• PLEASE NOTE:  NoMoreRansom.org does not remove the ransomware from your device(s).

---

Hey 310EI,

I saw your ransomware tweet last month which led me to your forum post, it was a lifesaver. I sent your post to our local tech who was able to use your link suggestions which helped him to tackle removing the ransomware. After that he used No More Ransomware's website instructions to decrypt our data, we never heard of their website before.

After he backed up all our decrypted data he did a clean install of windows 7 to erase any traces of the ransomware. He wanted me to mention that he appreciated you taking his phone call last month, he said your suggestion to remove the infected hard drives and scan them externally was a time saver plus effective way to get rid of the ransomware. Also, he implemented the off-site backup service and anti-ransomware software that you recommended for our computers.

Your contributions saved us a lot of money not only for the ransom they demanded but for the data we could have lost. We just had to tell you we're grateful for your post and other useful suggestions.

THANK YOU, THANK YOU, THANK YOU.

~Ed

Dropboxers: I'm new to the forum so not sure if my response is acceptable to post here, hopefully it's okay (if not remove it please).

[Mark]

More than welcome Ed!

Pleased it helped you out! 🙂

[Straffin]

I'm sorry, but this is NOT a solution to my problem (from a year-and-a-half ago). The was NEVER a solution to my problem. The files that had been synced to Dropbox then deleted from my local computer had *NO* copies *ANYWHERE* in Dropbox. I requested a rollback, but none was ever performed. I simply had to live with what I was left with.

I'm now a happy box.com user.