Ransomware detection and file restoration for Google Drive available in beta

September 30, 2025

Ransomware detection and file restoration for Google Drive available in beta

What’s changing
We’re adding two new features to help organizations minimize the impact of ransomware attacks on personal computers. Specifically, we are adding these features in beta:

• Ransomware detection: When users have Google Drive for desktop installed on their computers, file syncing will be paused when ransomware is detected. The user will see a notification appear on their computer. Admins will see an alert in the Admin console security center. And notification emails will be delivered to both users and admins.
• File restoration: Users are able to restore their files to a previous version in Drive with ease, saving them time and money without paying a ransom. Users can select and restore multiple files prior to when ransomware infected their computer, making their files inaccessible.

Getting started
Admins:

• Ransomware detection will be on by default for users in your organization. You can turn it on or off at the OU level by going to Admin console > Apps >Google Workspace >Settings for Drive and Docs > Malware and Ransomware. If ransomware is detected for your users, admins will receive an email and get an alert in the Alert center.
• Drive file restoration will be on by default. You can turn it on or off at Admin console > Apps>Google Workspace>Settings for Drive and Docs> Drive file restoration.
• Install the latest version of Drive for desktop on user computers (v.114 or later) to enable the detection alerts (syncing will still be paused on older versions).
• Visit the Help Center to learn more about managing ransomware detection and file restoration for your organization.

End users:

• The availability of this feature will depend on your admin’s settings. If turned on and ransomware is detected, you will see the alerts and access the interface below.
• Use the Help Center to learn more about restoring files in bulk with Google Drive.

Rollout pace
Admin console setting

• Rapid and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on September 30, 2025.
  File detection and restoration features
• Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on October 14, 2025.

Availability
File restoration

• Available to all Google Workspace customers, Workspace Individual Sub

Ransomware detection

Available for Google Workspace:

• Business Standard, Plus
• Enterprise Starter, Standard, Plus
• Education Standard and Plus
• Frontline Standard and Plus