Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →If ransomware has changed or deleted files in SharePoint Online, first stop OneDrive sync or disconnect the mapped SharePoint library to prevent more infected local changes from syncing. Then choose recovery based on the damage: restore a clean file version, retrieve deleted items from the Recycle Bin, use Files Restore for broader library changes, or use Microsoft 365 Backup if it was configured and has a suitable restore point.
This guidance applies to SharePoint in Microsoft 365 (SharePoint Online), not automatically to SharePoint Server on-premises. Your available recovery options depend on tenant settings, retention rules, permissions, and whether a usable restore point exists.
As an Amazon Associate I earn from qualifying purchases.
What to do first after a suspected SharePoint ransomware attack
- Stop synchronization. Immediately stop OneDrive sync or disconnect the mapped drive to the SharePoint library. Microsoft’s guidance explains that ransomware running locally can change files through a synced or mapped connection, and those changes can then sync online. See Microsoft’s ransomware guidance.
- Escalate and record the incident. Contact your Microsoft 365 or security administrator. Record affected site collection URLs and the last known time files were clean; Microsoft asks for these details when requesting support-assisted restoration.
- Determine what happened. Separate modified or encrypted files from renamed files and deleted files. The recovery route differs: version history is for changed files, while the Recycle Bin is for deleted items.
- Assess broader recovery options carefully. For many affected files, an administrator can evaluate Files Restore or a configured Microsoft 365 Backup restore point. Review the candidate time and destination before restoring so that healthy newer material is not overwritten.
Which SharePoint recovery option should you use?
| What happened | First recovery route | Important limit |
|---|---|---|
| A file was encrypted or overwritten but still exists | Restore a previous version | A clean earlier version must still be retained; version settings, trimming, and retention rules affect availability. |
| A file was deleted | Check the site Recycle Bin, then the site collection Recycle Bin. | The standard retention period is 93 days from deletion at the original location. Items manually purged from the second-stage bin may not be normally recoverable. |
| Many files or a library were changed | Evaluate SharePoint Files Restore or library recovery. | Files Restore reaches a point in time within the preceding 30 days and relies on file versions, so version reduction can limit what it can recover. |
| A site-wide recovery point is needed | Use Microsoft 365 Backup, if it was configured for the site and the needed restore point is available. | Full-site restore points are documented at 10-minute intervals for the prior 0–14 days and weekly for 15–365 days. Coverage does not begin retroactively. |
| Content was hard-deleted or ordinary recovery failed | Contact Microsoft Support promptly. | Microsoft documents an additional 14-day backup period after actual deletion for support-assisted recovery at site collection or subsite scope; it is not a guarantee of granular file restoration. |
Can version history undo ransomware encryption?
Often, if the affected file still exists and a clean earlier version is available. Open the file’s version history and restore a known-good version rather than assuming the latest version is safe. Microsoft’s instructions are in Restore a previous version of an item or file in SharePoint.
Version history is not a substitute for checking tenant configuration. Organization and library settings, automatic trimming, manual version limits, retention policies, and eDiscovery holds can all affect which versions remain available. Microsoft’s documentation on version history limits and retention policies for SharePoint and OneDrive explains the relevant controls. Older Microsoft ransomware guidance cited a default minimum of 500 versions, but that figure should not be treated as a universal current setting; check the tenant’s actual configuration.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How long do deleted SharePoint files stay in the Recycle Bin?
Microsoft’s standard SharePoint Recycle Bin period is 93 days from deletion at the item’s original location. Check both the site’s first-stage Recycle Bin and the site collection’s second-stage Recycle Bin. See Microsoft’s instructions for restoring deleted items from the site collection Recycle Bin.
After content is actually deleted, Microsoft documents an additional 14-day backup period during which support-assisted recovery may be requested. This is not the same as a promised file-level restore: the documented recovery scope is a full site collection or subsite. Provide the affected site collection URL and last known clean time when contacting Microsoft Support.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Can you restore a SharePoint document library to before the attack?
SharePoint Files Restore can return a document library to a point in time within the preceding 30 days. It uses file versions, so aggressive version trimming can reduce how far back or how completely it can recover. An administrator should inspect the proposed recovery point and affected content before proceeding. Microsoft’s service resiliency documentation describes SharePoint and OneDrive data resiliency.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor site-wide recovery, Microsoft 365 Backup may provide another option if the site was covered by a backup policy before the incident. Microsoft documents full SharePoint site restore points every 10 minutes for the prior 0–14 days and weekly for 15–365 days. Granular SharePoint and OneDrive file or folder restore points are roughly daily for the prior 0–14 days and weekly for 15–365 days, with rare alignment to weekly points noted in the documentation. Restore points start when the backup policy is created; enrollment does not recreate earlier history. See Microsoft 365 Backup restore documentation.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Microsoft 365 Backup supports restoring to the original or a new location. The appropriate target depends on whether the current site contains healthy work that must be preserved. Verify policy coverage and available restore points in your tenant; licensing and availability are tenant-specific.
Quick Recap
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to prepare SharePoint before an attack
- Check versioning at organization and library levels. Confirm version limits and trimming behavior, and understand how retention policies or holds affect preservation.
- Practice recovery workflows. Administrators should know how to interrupt sync, restore a file version, recover deleted items, and initiate a library restore.
- Verify backup coverage. If using Microsoft 365 Backup, confirm that the relevant sites are included in a policy and that administrators know how to choose a restore point and destination.
- Coordinate with compliance owners. Retention settings and eDiscovery holds can change how deleted content and versions are preserved or expired. Consult the Microsoft 365 administrator and compliance owner before changing retention settings during an incident.
- Validate the recovery plan. Service-retained backups have defined windows and restore scopes; do not assume they replace an organization’s own tested recovery plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
