Skip to main content
For Box Shield customers, the Content Recovery tool allows Box admins and co-admins to restore and recover content across their organization at scale. It uses the same file versioning and restore-from-Trash capabilities built into Box to perform these tasks over thousands of files at once. Content Recovery was designed to address two main use cases:
  • Negligent or malicious user mass modifying content across an organization (ransomware, and similar incidents)
  • Negligent or malicious user mass trashing content across an organization
Once an admin has identified and contained one of the above situations in their Box environment, they can use Content Recovery to begin the remediation process.
Any recovery or restore operation that does not involve content across several owners and/or folders should be handled in Content Manager or directly in the web application at the file level.
Content Recovery is designed for high-volume recovery of content that has experienced activity within the previous 30 days. It is not meant to act as a “time machine” and revert content across your organization. Instead, it restores the state of selected files to a specific point in time, without reversing file/folder actions or removing metadata, thus maintaining compliance fidelity with existing retention policies or legal holds.

​
Content Recovery limitations

There are a few cases where files are deemed ineligible for recovery. These include:
  • Files that have been permanently deleted (no longer in Trash)
  • Files that were in folders that were permanently deleted (no longer in Trash), because the recovery process attempts to put the file back to its original location, which no longer exists
  • File or parent folder is currently being deleted, because recovery does not interrupt the deletion process
  • No file versions or file rename events found before the recovery point
  • A recovered filename conflicts with the name of a file in the location where a recovery is attempted
  • Files that are not owned by your organization

​
Managing Content Recovery tasks

Each enterprise can have up to 100 Content Recovery tasks. If you reach this limit, delete a recovery task before you create another one. Do not keep unnecessary recovery tasks in the Admin Console. Use these options instead to retain a record of recovery activity:
  • After a recovery task completes, download a file report (.csv) that lists all files involved in the recovery. Box saves the report in your Box Reports folder. For details, see Content Recovery Report.
  • All recovery actions (restore from Trash, rename, and promote file version) are recorded in the event stream.
  • User activity events for creating, initiating, and deleting a recovery are available for reporting in the Admin Console.

​
Task expiration

After you create a recovery task, it remains in the Admin Console until an admin deletes it. If a task is more than 30 days old and recovery has not been initiated, Content Recovery marks the task as expired. Analysis data from the original search is then stale and no longer applicable, so you cannot interact with or recover content from that task. You can keep or delete an expired recovery task.
Last modified on October 8, 2026