Guides › Account misused
Files changed after someone got into your cloud account
Secure the account first: from a device you trust, change the password, sign out devices you don’t recognise and undo settings you didn’t make. Then restore files only from the provider’s own versions, trash or account restore, choosing a point from before the change — restoring first lets the same person undo it again.
Your account
Look in: “Recent security events” → Review security events
Choose “No, it wasn’t me” for anything you didn’t do and follow the steps (SE02, SE03). Then review Drive activity and file versions for anything unusual (SE04).
The order that keeps a restore safe
Steps
- Secure the account from a trusted deviceGoogle: the “Recent security events” panel → Review security events, then “No, it wasn’t me” for anything you didn’t do (SE02, SE03). Microsoft: Security basics → Change password (SE88, SE92). If the password no longer works: Forgot my password → I think someone else is using my Microsoft account (SE32).
- Sign out what you don’t recogniseGoogle: google.com/devices (SE08). Apple: account.apple.com → Devices (SE89). Dropbox: account settings → Security tab (SE73). How to read these lists, and why a time or place may look wrong, is in the guide on unknown cloud file activity.
- Undo access and settings you didn’t makeGoogle: remove linked apps you didn’t approve — an app with manage access can edit, create and delete data (SE12); revoking it stops further access (SE13). Apple: ask your carrier whether SMS forwarding was set up (SE48). Dropbox: change the password of the email account behind it too (SE65).
- Write down what changed before you restoreNote file names, dates and shared links. Drive: More → Manage versions (SE75); only recent versions stay unless you choose Keep forever (SE18), so pin the last good one before anything else changes.
- Restore from a point before the changeOneDrive ransomware recovery preselects the time the attack was detected (SE35); Restore your OneDrive covers the last 30 days for Microsoft 365 subscribers (C12). Dropbox: All files → ☑ settings → Folder settings → Rewind this folder (SE90), picking the day before the incident — usually a spike on the graph (SE67).
- Close shares, then check the restored filesClose any share or link you didn’t create — the guide on unknown cloud file activity walks through each provider’s sharing screen. If you were removed from a shared folder, Rewind won’t put you back (SE68); ask the owner. Our advice, not a provider rule: open each restored file to confirm it before you delete anything else.
Secure, then restore — by provider
| Provider | Secure the account | Restore a known point | Limit to know |
|---|---|---|---|
| Review security events (SE02); devices at google.com/devices (SE08) | Drive file versions; pin one with Keep forever (SE18) | Versions may go after 30 days or 100 newer versions (C07) | |
| Microsoft (OneDrive) | Security basics → Change password (SE88, SE92); Recent activity (SE86) | Restore your OneDrive, last 30 days, Microsoft 365 (C12); ransomware recovery — first one free if you’re not a Microsoft 365 subscriber (SE33) | Version history kept 30 days (C13) |
| Apple (iCloud Drive) | account.apple.com → Devices (SE89) | iCloud.com recovers files deleted in the last 30 days (C14) | An account-wide undo for iCloud Drive: the official help does not describe this |
| Dropbox | Log out devices, sessions and apps (SE62) | Rewind on Plus, Family, Professional and business plans (SE93); version history 30 / 180 / 365 days by plan (C20–C22) | Rewind can’t go earlier than your version history (SE69); not from the mobile app (SE94) |
SE-codes point to quotes in the account-security fact journal, C-codes to the main one. How long activity logs are kept is not described in the official help we read — the provider’s page for your plan decides.
If many files were encrypted or renamed at once
Mass renames, strange file suffixes or a ransom note are a separate case. When Microsoft 365 detects ransomware it notifies you on your device and by email, and if you’re not a subscriber your first notification and recovery is free (SE33). Clean every device before restoring, or files could be encrypted again (SE34); the restore point is preselected at the time the attack was detected (SE35). Dropbox Rewind is meant for this kind of major data-loss incident, such as a virus infecting your account (SE66), and works from the website, not the mobile app (SE94). The official help we read describes only the provider’s own trash, versions and restore tools — nothing outside them. If work data is involved, tell your administrator before you change anything.
Limits: when nothing is left
- Older than the history. Dropbox Rewind can’t undo changes made earlier than your version history (SE69) — 30, 180 or 365 days by plan (C20–C22). Drive may drop versions after 30 days or 100 newer versions (C07).
- Removed from a shared folder. Rewind won’t add you back to a shared folder you were removed from (SE68). On iCloud, once the owner stops sharing a folder, participants can no longer view or edit its files (SE56). Only the owner can share it with you again.
- Rewind needs an eligible plan. It is listed for Dropbox Backup, Plus, Family, Professional, Essentials, Standard, Advanced, Business, Business Plus and Enterprise (SE93); a Basic account has deleted files and version history instead (C19, C20).
- Whole-account undo on OneDrive. Restore your OneDrive is for Microsoft 365 subscribers, last 30 days (C12). Without a subscription you have the Recycle bin, 30 days (C10), and the first ransomware recovery (SE33).
Questions
Should I restore files or change the password first?
Secure the account first. OneDrive asks you to clean every device before restoring, or files could be encrypted again, and an app or person still signed in could undo the restore.
Can I see who changed my files?
Partly. Drive’s activity shows changes and who made them. The records name accounts, not people; the guide on unknown cloud file activity explains how to read them.
Lots of files were deleted. How far back can I go?
Restore your OneDrive covers the last 30 days for Microsoft 365 subscribers. Dropbox Rewind reaches as far as your version history: 30, 180 or 365 days by plan.
What if I can’t sign in at all?
Use the provider’s recovery route. For Microsoft, choose Forgot my password, then I think someone else is using my Microsoft account.
Many files were renamed with a strange ending.
That looks like ransomware. Microsoft 365 notifies you when it detects an attack, and if you’re not a subscriber the first recovery is free. Clean every device before restoring.
It’s a work or school account.
Tell your administrator first. A Workspace admin can recover Drive items within 25 days after the trash is emptied; Dropbox team members should contact their team admin.
Should I pay a recovery service?
The official help we read describes only the provider’s own trash, versions and restore tools. iCloud says files deleted from Recently Deleted are deleted immediately and not recoverable, so be wary of any offer that promises a result.
Sources Checked October 2026
- Google Account Help — Secure a compromised Google Account
- Google Account Help — See devices with account access
- Google Drive Help — Check activity & file versions
- Microsoft Support — What happens if there’s an unusual sign-in to your account
- Microsoft Support — How to detect ransomware and recover files using OneDrive
- Apple Support — If you think your Apple Account has been compromised
- Dropbox Help — How to protect your Dropbox account if it’s been compromised
- Dropbox Help — How to use Dropbox Rewind