March 30, 2026
Ransomware detection and file restoration for Google Drive now generally available
In September 2025, we launched ransomware detection and file restoration in beta to help organizations minimize the impact of malware attacks on personal computers. Today, we’re excited to share these two features are generally available with significant improvements in malware detection.
Compared to when the feature was in beta, we are now able to detect even more types of ransomware encryption and are able to do it faster. Our latest AI model is detecting 14x more infections, leading to even more comprehensive protection.
Thousands of users have tested file restoration, demonstrating that it’s scalable and reliable.
- Ransomware detection: When users have Google Drive for desktop installed on their computers, file syncing will be paused when ransomware is detected. The user will see a notification appear on their computer. Admins will see an alert in the Admin console security center; notification emails will be delivered to both users and admins.
- File restoration: Users are able to bulk restore their files to a previous version in Drive with ease, saving them time and money without paying a ransom. Users can select and restore multiple files prior to when ransomware infected their computer, making their files inaccessible.
Getting started
- Admins:
- Ransomware detection will be on by default for users in your organization. You can turn it on or off at the OU level by going to Admin console > Apps > Google Workspace > Settings for Drive and Docs > Malware and Ransomware. If ransomware is detected for your users, admins will receive an email and get an alert in the Alert center.
- Drive file restoration will be on by default. You can turn it on or off at Admin console > Apps > Google Workspace > Settings for Drive and Docs > Drive file restoration.
- Install the latest version of Drive for desktop on user computers (v.114 or later) to enable the detection alerts (syncing will still be paused on older versions).
- Visit the Help Center to learn more about managing ransomware detection and file restoration for your organization.
 |
The Admin console setting for ransomware detection |
 |
The Admin console setting for Drive file restoration |
 |
Email to admins when potential ransomware is detected |
 |
Admin alert in the Alert center with information on the potential ransomware detection |
 |
Alert detail on the ransomware detection |
- End users: The availability of this feature will depend on your admin’s settings. If turned on and ransomware is detected, you will see the alerts and access the interface below. Visit the Help Center to learn more about restoring files in bulk with Google Drive
 |
End user alert in Drive for desktop when ransomware is detected |
 |
Interface to assist with file recovery |
Rollout pace
- Rapid Release and Scheduled Release domains: Available now
Availability
- File restoration
- Available to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts
- Ransomware detection
- Business: Business Standard and Plus
- Enterprise: Enterprise Starter, Standard and Plus
- Education: Education Standard and Plus
- Other Editions: Frontline Standard and Plus
Resources
- Google Workspace Admin Help: Detect ransomware and recover files in Drive for desktop
- Google Help: Restore files in bulk with Google Drive
- Workspace Blog: Block ransomware proliferation and easily restore files with AI in Google Drive
- Google Workspace Updates Blog: Ransomware detection and file restoration for Google Drive available in beta