To protect your files from being encrypted by ransomware, as well as to prevent accidental deletions, enable Controlled Folder Access (CFA), configure Windows Backup and File History, have at least one backup copy offline and unconnected to any network (malware can’t get there), and have a recovery drive available. Ransomware file protection only works when a clean copy of your data exists somewhere malware cannot reach or encrypt.
Ransomware locks your files until you pay. A mistaken delete or a failed drive removes them just as completely, with no criminal involved. But here’s some good news. One layered protection strategy protects against all forms of these types of attacks, and each of the tools going to list are native to Windows. This guide walks through six steps in order, then explains what to do if an attack still gets through.
Two Threats, One Plan
Ransomware encrypts your files, and it can also encrypt backups it can reach, such as a connected drive or synced folder. Accidental deletion is quieter: you remove a folder, empty the Recycle Bin or overwrite a document.
So the plan has two jobs. First, block unauthorized programs from changing your files. Second, keep separate, recent copies so that you can restore deleted files whatever the cause.
Ransomware Protection vs. Backup: What Each Tool Does
| Tool | Main purpose | Important limitation |
| Controlled folder access | Blocks untrusted apps from changing protected folders | Does not replace backups or guarantee every attack is blocked |
| Windows Backup and OneDrive | Syncs selected folders and restores files and settings on a new PC | Syncing is not the same as an independent offline backup |
| File History | Saves versions of personal files to an external drive or network location | A connected drive can be exposed to malware, and the backup must be verified |
| Disconnected external drive | Gives you a separate copy that the PC cannot reach all the time | Must be reconnected regularly to update it |
| Recovery drive | Helps you recover or reinstall Windows | Does not contain your personal documents |
For important files, combine Windows’ built-in security controls with versioned backups and at least one regularly updated copy that stays disconnected when not in use. Test a restore instead of assuming a configured backup works.
Steps to Secure Your Files Against Ransomware and Accidental Deletion
1. Turn On Ransomware File Protection
Controlled folder access is Windows Security’s ransomware protection. It helps protect files from ransomware by stopping untrusted apps from changing files in protected folders. It is off by default.
1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Ransomware protection, select Manage ransomware protection.
4. Turn on Controlled folder access.
It protects your Documents, Pictures, Videos, Music and Favorites folders and the default OneDrive folders, and you can add more folders. Microsoft Office apps are trusted by default. Some legitimate programs, games that save to Documents for example, may be blocked until you allow them under the same screen.
This is a safety net and not a full defense. Also keep Windows updated, since Microsoft lists patching among its main ransomware recommendations, and avoid unexpected attachments and links.
Add a Second Layer With Antivirus (Optional)
Controlled folder access guards your folders, but it does not scan for malware. Pairing it with a dedicated security tool adds detection before files are touched. Systweak Antivirus supports Windows 11 and offers real-time protection, exploit and malware protection, Quick, Deep and Custom scans, a scan scheduler and a quarantine list for detected threats.Systweak positions it as an extra layer on top of Windows Defender. It does not replace backups: once ransomware has encrypted your files, no security software can bring them back. After installing any third party anti-virus software, go into Windows Security and ensure that the Ransomware Protection Settings are available and active.
2. Set Up Windows Backup
Windows Backup is the Windows 11 app that syncs your Desktop, Documents, Pictures, Videos and Music folders to OneDrive. It can also save your installed apps list and settings such as Wi-Fi networks.
1. Sign in with a Microsoft account (work or school accounts do not qualify).
2. Open Windows Backup from the Start menu.
3. Expand Folders and turn on the folders you want.
4. Choose whether to remember your apps and settings, then select Back up.
You can check your backed up files at a later time by going to Settings > Accounts > Windows Backup. If you are looking for additional space in order to store larger photo or video collections, then you will need to purchase more space than what comes with the free Microsoft account (which comes with 5 GB of OneDrive). If you are wondering how to back up files in Windows 11, this is the built-in place to start.
Think of it like a cloud syncing tool with some kind of restore. It will protect against loss due to dead, theft or inaccessibility of the PC. With One Drive’s version history it will also help prevent many mistakes that occur during editing. This is not an off-line backup. One Drive syncing is not a standalone backup: a change or edit/deletion made by you on your PC will sync up to the cloud. As such, you are going to be relying upon the Version History and the One Drive recycle bin to get back (and you should continue to maintain an off-line backup).
3. Turn On File History (and Check It Works)
File History saves copies of your personal files to an external drive or network location, so you can restore deleted files or earlier versions.
To enable file history:
- Connect your external drive.
- Search for File History in the Start menu and open it (it lives in the Control Panel).
- Click on the location where you wish to save and choose Turn on.
Check it is still running. After the September 2026 security updates, Microsoft confirmed that File History might fail to back up or restore files to an external drive or network location. Some users saw a false “Reconnect your drive” message, a “Last Backup” time that never changed, or “No previous version available” for old files. Microsoft released a fix in optional updates for Windows 11 24H2, 25H2 and 26H1, and says it also arrives with October’s Patch Tuesday updates.
If you see File History not working, the first step is simple :Open File History, look at the backup time, and install pending updates from Settings > Windows Update. If the time is not moving, run a backup manually.
4. Follow the 3-2-1 Rule and Keep One Copy Offline
The 3-2-1 backup rule means three copies of your data: the original, a second copy on a local external drive and a third copy offsite, such as in the cloud. Here that maps neatly to your PC, File History and Windows Backup.
Add one habit for ransomware: an offline backup. An offline backup for ransomware is simply a copy the infected PC cannot reach. Ransomware can encrypt any drive that stays connected. After a backup finishes, disconnect the backup drive and store it. Rotate two drives if you want a safer routine.
A duplicate sitting in another folder is not a backup, because it lives on the same disk and can be lost or encrypted together with the original.
5. Create a Recovery Drive
A recovery drive is a USB drive that lets you reinstall Windows when your PC will not start. It holds Windows system files, installed updates and any PC manufacturer customizations. It does not include your personal files, so it complements your backups instead of replacing them.
1. Search for Recovery Drive in the Start menu and open it.
2. Make sure “Back up system files to the recovery drive” is selected, then choose Next.
3. Find an empty flash drive, plug it into your computer. Click the flash drive. Choose next. Erasing the data off of this device will take place after choosing next.
4. Choose “Create” and allow the process to complete.
Microsoft recommends you recreate it at least one time each year. To utilize it, start up your computer with the USB drive, select “Recovery from a drive” from the recovery options and follow the directions. Store it in a safe place where it will be protected from power surges (it has no power source), but do not connect to the Internet. A Recovery Drive is intended to repair or reinstall windows on the device. If you recover data off of it, your documents may be lost, therefore restore all personal files from an external backup after recovering from the Recovery Drive.
6. Guard Against Accidental Deletion
Ransomware gets the headlines, but most lost files are human error. Searches such as recover deleted files Windows 11 lead to the same few steps. Protect against accidental deletion with a few habits:
1. Pick the right route. If you deleted locally: go to your Recycle Bin and then File History. If you deleted via OneDrive: go to your OneDrive Recycle Bin, or view previous versions. When deleting via Shift + Delete or using an external device: use either File History or another backup source (the recycle bin will be skipped).
2. Always check the Recycle Bin prior to deleting any file. Most files that are deleted will end up in this location. Files deleted using the “Shift + Delete” option, as well as those deleted from an external drive or network drive, do not typically land here.
3. Restore from File History. Open File History, choose Restore your personal files, and browse earlier versions.
4. Use OneDrive. Synced folders keep a Recycle Bin and version history online, so you can recover files or revert to an earlier point.
5. Cease using the drive. As with the above point, if you need to recover deleted files from the drive that none of your backups hold, refrain from adding new data to the drive, as the new write activity may destroy the information you’re attempting to recover.
How to Check Whether Your Backups Work
A configured backup is not proof that it works. Run this checklist after setup and after major Windows updates:
- Check that File History’s last-backup time moves forward after a backup.
- Confirm the folders you expect are included in the backup.
- Restore one test file to a different location and open it.
- Confirm OneDrive has finished syncing and that version history is available for your files.
- Disconnect the external backup drive once its backup completes.
If Ransomware Hits
Act in this order:
- Disconnect the PC from the network and unplug external drives.
- Fully clean the PC with a Windows Security scan before restoring anything, since backups can contain infected files.
- Restore from a clean backup. If you use OneDrive with Microsoft 365, you may get a ransomware alert and a guided recovery to restore OneDrive to a point before the attack. Microsoft’s OneDrive ransomware recovery starts from the OneDrive website.
- Do not pay the ransom. Microsoft does not suggest paying the ransom.
You can confirm your OneDrive protection under Windows Security > Virus & threat protection > Ransomware protection, where the Ransomware data recovery section shows whether OneDrive is set up.
Frequently Asked Questions
The Bottomline
Ransomware file protection is a layered habit, it’s not simply flipping a switch. Enable “Controlled folder access,” use Windows Backup & File History to create backups of all files in multiple places (on-line and off-line), maintain a separate (off-line) copy of all files and create a “recovery” device. Additionally, check that every backup actually runs.