Ransomware detection and file restoration for Google Drive now generally available

March 30, 2026
Ransomware detection and file restoration for Google Drive now generally available

In September 2025, we launched ransomware detection and file restoration in beta to help organizations minimize the impact of malware attacks on personal computers. Today, we’re excited to share these two features are generally available with significant improvements in malware detection.

Compared to when the feature was in beta, we are now able to detect even more types of ransomware encryption and are able to do it faster. Our latest AI model is detecting 14x more infections, leading to even more comprehensive protection.

Thousands of users have tested file restoration, demonstrating that it’s scalable and reliable.

• Ransomware detection: When users have Google Drive for desktop installed on their computers, file syncing will be paused when ransomware is detected. The user will see a notification appear on their computer. Admins will see an alert in the Admin console security center; notification emails will be delivered to both users and admins.
• File restoration: Users are able to bulk restore their files to a previous version in Drive with ease, saving them time and money without paying a ransom. Users can select and restore multiple files prior to when ransomware infected their computer, making their files inaccessible

Getting started
Admins:

• Ransomware detection will be on by default for users in your organization. You can turn it on or off at the OU level by going to Admin console > Apps > Google Workspace > Settings for Drive and Docs > Malware and Ransomware. If ransomware is detected for your users, admins will receive an email and get an alert in the Alert center.
• Drive file restoration will be on by default. You can turn it on or off at Admin console > Apps > Google Workspace > Settings for Drive and Docs >Drive file restoration.
• Install the latest version of Drive for desktop on user computers (v.114 or later) to enable the detection alerts (syncing will still be paused on older versions).
• Visit the Help Center to learn more about managing ransomware detection and file restoration for your organization.
• End users: The availability of this feature will depend on your admin’s settings. If turned on and ransomware is detected, you will see the alerts and access the interface below. Visit the Help Center to learn more about restoring files in bulk with Google Drive

Rollout pace
Rapid Release and Scheduled Release domains: Available now

Availability
File restoration

• Available to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts

Ransomware detection

• Business: Business Standard and Plus
• Enterprise: Enterprise Starter, Standard and Plus
• Education: Education Standard and Plus
• Other Editions: Frontline Standard and Plus