Stolen accounts
A reused or phished password can give an attacker the same access as a legitimate user, including the ability to delete files.
Ransomware resilience
Ransomware protection starts before the incident.
Separate backup copies, retained restore points and a recovery procedure you have tested. No product can promise that an attack will not happen; the goal is to shorten the damage.
- Separate backup copies
- Object Lock where configured
- Tested restore path
Before
Active files
The working copy on a team device or shared drive.
Q3 forecasts.xlsx Client list.csv Contracts.pdf
Incident
Files are locked
Ransomware encrypts the files it can reach on the endpoint.
Q3 forecasts.xlsx Client list.csv
Protected copies
Earlier versions
Retained backup points stay separate from the infected device.
Daily pointRetainedWeekly pointRetainedObject LockWhere configured
Recovery
Restore and verify
Preview a restore point, then recover the files that matter.
Q3 forecasts.xlsx Hash checked
Illustrative incident path: active files are affected, retained copies stay available, and a verified restore returns the files.
Why storage is targeted
Four ways an attack reaches your files
Ransomware is not only an endpoint problem. The storage account, the sync client and the backup destination are part of the attack surface.
Sync spreads the damage
A synced folder propagates deletion and encryption to every connected device, often before anyone notices.
One endpoint is enough
An infected workstation can reach mapped drives and shared folders with the credentials of the person using it.
Backups become a target
Attackers look for the copies you rely on. A backup that can be deleted with the same account is not a safe copy.
Layered defence
Four layers, none of them sufficient alone
Prevention reduces the chance of an incident. Protected copies and a tested restore reduce the cost when prevention fails.
Prevention
Named access, least privilege and prompt removal of leavers reduce the accounts an attacker can use. Endpoint protection remains your responsibility.
Protected copies
Scheduled backups create restore points that are separate from the working device, so encryption on the endpoint does not overwrite them.
Immutable retention
Where Object Lock is configured, restore points can be retained for a fixed period that normal deletion cannot shorten.
Recovery planning
A documented restore procedure, a named owner and a periodic test turn a backup into something you can actually use.
What Everabyte is not
Everabyte is not an endpoint detection and response product, an antivirus or a managed security service. We provide storage, backup, access control and retention options that support your incident response plan.
Response
The first four hours
A short, ordered procedure prevents the most common recovery mistake: restoring onto an infected device before the account is secured.
Detect and isolate
Disconnect the affected device, preserve evidence and confirm which accounts were used.
Identify a clean point
Review restore points before the incident and choose the most recent one that is free of encrypted or corrupted files.
Restore selectively
Preview the restore, recover priority files first and keep the affected originals for investigation.
Verify and close
Open the restored files, check hashes where available, then reset credentials before reconnecting the device.
Test the restore before you need it
Choose a file set, restore it to a separate folder, open it and record the result. Repeat on a schedule and keep the record with your incident documentation.
- Know the retention window. Restore points expire according to plan and configuration.
- Keep a copy outside the sync path. A backup stored only in the synced folder can be affected with it.
- Protect the backup account. Separate credentials and least privilege limit the damage from a compromised user.
- Record who restores. A named owner and a documented step list shorten the next recovery.
Device isolated network access removedDone
Restore point selected before the incidentDone
Priority files restored to a clean folderIn progress
Verification open files and compare hashesPlanned
Owner: IT operationsReview after every test
Honest limits
What we do not promise
Zero incidents
No storage or backup product can guarantee that ransomware will not reach a device. Prevention belongs to your endpoint and identity controls.
Instant recovery
Recovery time depends on volume, bandwidth and the restore point selected. We do not promise instant or zero-downtime restoration.
Universal immutability
Object Lock is available where configured for the deployment. It is not applied automatically to every file or every plan.
A plan you can read in one page
Write down what is backed up, how often, where the copies live, who can delete them and who tests a restore. If any answer is missing, that is the first gap to close.
Shorten the distance between incident and recovery
Tell us which systems hold critical files, how long you can tolerate downtime and what you already test. We will map the backup and retention options that fit.
No zero-incident, instant-recovery or universal immutability guarantee is implied by this page.