Ransomware protection: canary files, a write threshold and rollback from pre-write copies.
What happens in the first 60 seconds of an attack
Modern ransomware does not encrypt one file and leave. It enumerates, opens, writes, renames — hundreds of times a minute. The window to intervene is short and full of legitimate noise: a backup, a build and a cloud sync all look similar at the file-event level.
Second 0–10: the process installs and starts enumerating. No antivirus has a verdict yet, because nothing abnormal has been written.
Second 10–40: the first mass writes. This is where the threshold matters: 40 writes in a short window is the burst signal, below it behaviour is considered normal.
Second 40–60: canary files are touched. A modified or deleted canary raises an event — not a blind reaction, but a signal with context.
After: rollback from the pre-write copies, for the files modified in the detected window.
Three layers, each with a different job
None of them is enough alone. Together they cover the three ways an attack becomes visible: behaviour, a footprint on target files, and a way back.
Canary files: six harmless files in the folders that matter. No legitimate process should touch them, so a touch is a signal with a near-zero false-positive rate.
Write threshold: 40 writes in a short window. It catches attacks that never reach a canary because they target a different folder.
Pre-write copies: a copy before every modification. Without them detection is bad news; with them detection is a recovery.
What the product does when it detects
The reaction is deliberately limited. An antivirus that freezes processes on a heuristic can kill a legitimate backup in the middle of the night, and the cost of that mistake outweighs the benefit.
Stops the process identified as the source of the burst, with the PID in the log.
Moves the detected file into AES-256-GCM encrypted quarantine, with tag verification on restore.
Keeps the pre-write copies, so rollback is possible minutes after the incident.
Writes everything to the append-only audit log and, if configured, sends it to SIEM.
Why rollback is manual
Automatic restore sounds great in a demo and is dangerous in production. If a legitimate process writes 40 files in a minute — a build, a sync, an export — automatic restore would undo an operation the user actually wanted. We would rather hand you the copies and the decision.
You see the list of files modified in the detected window, with both the original and the copy available.
You choose what to restore. Nothing is overwritten without your confirmation.
The operation is recorded in the audit log, with the actor and the time.
Ransomware guard does not replace a backup
It is a net for the first minutes, not a recovery strategy. An attack that runs for two days, or one that encrypts the copies too, goes past any local protection. The 3-2-1 rule stays mandatory: three copies, two media, one off-site.
Pre-write copies are local. An attack with administrator privileges can reach them.
Offline backup remains the only real defence against an attack that runs for days.
Test restoring from backup before you need it. An untested backup is a hope, not a copy.
How to set up your canary files correctly
Canary files only work if they sit where an attack arrives first. A canary in a folder nobody opens is decoration.
Put them in the folders that matter: company documents, accounting, active projects. Not in the drive root.
Do not exclude them from other backup tools and do not let an automatic sync move them — a move looks like a deletion.
Check once a month that the files are still there. A canary deleted by a user is a canary that announces nothing.
Frequently asked questions about ransomware protection
It can stop the process producing a write burst or touching a canary, in the first minutes, and it can keep the copies needed for rollback. What it cannot do is guarantee a full recovery: an attack running for days, or one with administrator privileges over the local copies, gets past it. That is why an offline backup stays mandatory.
Six harmless files, planted in the folders that matter. They contain nothing sensitive and no legitimate process should modify or delete them. The check runs every 60 seconds; a modification or deletion raises an event, not an automatic reaction.
Not for a tool running on a production machine. A build, a cloud sync or an export can write 40 files in a minute. Automatic restore would undo a legitimate operation, and you would find out afterwards. We prefer to give you the copies and the decision, with the operation recorded in the log.
Partially. Data exfiltration produces no write burst and touches no canary file, so ransomware guard does not see it. What can help are the local DLP policies, which flag personal-data indicators, card numbers or secrets in files, and the audit log for SIEM correlation. We do not claim to cover exfiltration.
The detected file is moved into AES-256-GCM encrypted quarantine: moved, encrypted with a random 12-byte IV and a 16-byte tag, then deleted from its original location. Metadata stays in the local database. For files already encrypted by the attacker, the recovery source is the pre-write copy, not quarantine.
Yes. Ransomware guard is part of the Complete plan, alongside real-time protection, because it depends on continuous folder monitoring. The Free plan includes the full scanner and encrypted quarantine, but does not run in the background.
Useful next steps
Try it on a file you already have.
The installer is 177 MB and asks for no account. Not convinced? Check a link above — the web engine is already running on this page.