Ransomware doesn't just encrypt your live files; a lot of variants actively hunt for connected backup destinations and try to encrypt or delete those too. If your only backup is a mounted drive or a synced folder, the attack can take both copies in the same pass. Version history is what breaks that.

What version history actually does

Instead of overwriting a file every time it changes, Vouchio keeps prior versions for a retention window. When ransomware encrypts a file and that encrypted version gets backed up, the clean version from before the attack is still sitting there, untouched, because it was never overwritten, only added to.

The recovery process

  1. Isolate the affected systems so the attack can't keep spreading before you restore anything.
  2. Identify the last known-clean point in time, usually just before file modification times spike unusually.
  3. Restore from that version, not the most recent one.
  4. Confirm the restored files open correctly and aren't themselves partially encrypted.
  5. Only then reconnect the restored systems to your network.

Why retention window length matters

If your retention window is shorter than the time between infection and detection, you can lose the clean copy before you ever get to use it: some ransomware sits quietly for days or weeks before triggering. Active Storage includes 30 days of version history by default; if your detection times tend to run longer than that, it's worth discussing a longer window in your questionnaire.

PlanVersion historyExtra protection
Active Storage30 days includedExtendable on request
Archive StorageFull historyRetention Lock (immutable)
Recovery ReadyFull historyTested recovery drills
Retention Lock closes the last gap Version history protects you from overwrites, but a sufficiently privileged attacker (or a malicious insider) could still try to delete the version history itself. Retention Lock on Archive Storage makes that impossible until the retention period expires, full stop, no exceptions, not even for Vouchio. See the long-term archiving solution.

Don't skip the drill

The steps above look simple on paper. They're a lot less simple at 2am during an actual incident, which is exactly why Recovery Ready includes quarterly recovery drills: running this process before you need it is how you find out it actually works.

Want a ransomware recovery plan you've actually tested?

Recovery Ready pairs version history with drills, so the plan isn't theoretical when it matters.

Get your quote