Ransomware guard: canary files and rollback

The steps, in order

1. 1

   Step 1

   Plant canary files in the folders that matter. They are harmless files no legitimate process should touch.

2. 2

   Step 2

   The check runs every 60 seconds. A modified or deleted canary raises an event, not a blind reaction.

3. 3

   Step 3

   The threshold of 40 writes in a short window is the “burst” signal. Below it, behaviour is considered normal.

4. 4

   Step 4

   Rollback is manual, from the pre-write copies. We do not automatically overwrite your files based on a heuristic — restoring is your decision.