How to recover
Decrypt Dropbox files encrypted by ransomware
from Windows

My Dropbox files got hit by a CryptoLocker. I always thought that having files stored in the cloud is the best way to protect them from decryption. I feel frustrated as the only backups I had were in Dropbox. I cannot open any files on my PC as well. Please tell me if it’s possible to decrypt Dropbox files encrypted by a ransomware?

Lost accesses to all personal files is the worst nightmare of all PC users. Unfortunately, but the number of ransomware viruses is increasing every week causing money loss for millions of netizens and even huge companies. The ransomware industry exists for many years, probably starting from the days when personal computers became available for home users. Therefore, most of the people have already heard about such criminal activity, but deep in heart hope that they are not at risk. Unfortunately, but the hope is not enough. To protect photos, videos, important documents and other personal files from being encrypted with the complex encryption codes, people must use professional anti-virus programs and regularly update them. However, traditional signature-based anti-virus programs become familiar with the new ransomware versions only when they are sent out en-masse for many times. To bypass detection, hackers invent new ransomware versions with slightly modified characteristics, which is why they look new and manage to bypass signature-based anti-virus protection. Having this in mind, you should take other precautionary measures, for example, DO NOT open doubtful emails, especially their attachments; prevent visiting fishy websites or clicking on doubtful pop-up ads. Nevertheless, the best way to ensure the security of your personal files is to create backups.

These days, cloud storages, such as Google or Dropbox are dubbed as the safest and the most convenient file storages. The question is if the files stored on them can’t be locked by ransomware as well? Unfortunately, but there were lots of instances when CryptoLocker, Spora, Odin, TeslaCrypt, and other ransomware viruses encoded files on cloud storages simultaneously with the files on the PC. That’s because cloud storage service appears just like another drive on a PC. Locked files on Dropbox seem like a miserable experience, but you should not fall for panic immediately. This cloud storage keeps previous versions of files in the recycle bin or trash folder by default. The users of free Dropbox version can restore files in 30 days, while all file versions on paid Dropbox version are available for more than a year. The copies of Dropbox files are created regardless of who or what has initiated the modification or removal, so if the ransomware drops its public-key cryptography on the files, ransomware-untouched file versions will be still available. So, how to decrypt Dropbox files encrypted by ransomware?

How to decrypt Dropbox files encrypted by ransomware?

First of all, remove the ransomware from your PC or another device that you are using. For this purpose, use a professional anti-malware and initiate a full system scan twice. Our recommendation would be to use [d1].

1. Log in to your Dropbox account via the web browser and perform the following steps.
2. Find Deleted Files option on the left side of the screen.
3. Select the last copy of the file you want to restore and click the Restore button.

Unfortunately, but hackers seldom attack individual files. Therefore retrieval of hundreds of individual files manually would require loads of time. Therefore, to recover multiple Dropbox files, you should contact Dropbox Support and submit a deletion event.

1. Log in to your Dropbox account and select Events on the left.
2. You will have to provide the link for the event that needs to be undone. For that, open File recovery and select Undo a large number of changes to files and folders.
3. Then select Undo a large number of changes.
4. Submit a written permission to initiate modifications and include it in your message.
5. Now you’ll have to wait for the Dropbox Support to undo the changes.