Your organization needs to recover a batch of recently deleted or modified content. Content Recovery lets Box admins and co-admins restore and recover large numbers of files across the organization.
To use Content Recovery, your enterprise needs Shield enabled.
Co-admins have access to Content Recovery if they are given the Manage users, Manage groups, and Edit Archives and users’ content permissions. Co-admins can see all recovery tasks in the enterprise, but they have view-only access unless they created the recovery task.
Go to Admin Console > Content.
Select the Content Recovery tab.
Select Recover Content.
Enter the name of a managed or external user whose activity you want to analyze.
Select a date range. This is the analysis window, the period of the user’s activity you want analyzed. A custom range can cover up to the last 30 days.
Select Search. Analysis can take some time. When it finishes, Content Recovery shows:
A User File Activity chart of file modification and trash events in the date range
A list of the distinct files that were modified or trashed
Review the chart and file list. Optionally refine what you recover:
Hover over any column in the graph to see how many files were modified or trashed during that slice of time.
Select or clear events in the legend to show or hide event types in the graph and list.
Drag the ends of the time bar under the graph to narrow the start or end of the window. This updates which files are included; it does not start recovery.
Select Create file report () to generate a report of the found files. Use the report to review search results and identify files to recover. For each file, the report includes the file ID, name, path, owner, last recovery-related activity, and current recovery status.
Select Filter () to narrow the list by keyword in the file name, recovery activity type, and date range. Select Save to apply filters.
The time range you narrow down to is the recovery window. Content Recovery recovers files that were modified or trashed during this period. The recovery window always falls within the analysis window.
8. When the chart, filters, and file list reflect the content you want to restore, select Recover Files. A confirmation dialog appears with the number of files to recover and the recovery point.
9. Review the recovery point. By default, Content Recovery sets the recovery point to the start of the recovery window, because in most cases you want files back in the state they were in before the problem began. Content Recovery restores selected files to their state before the recovery point by making the matching file version the current version.
To change the recovery point, select Edit and choose a date and time within the analysis window. Avoid choosing a time after the start of the recovery window. Files affected between the start of the recovery window and your recovery point are restored to the version they had at the recovery point, which may already be damaged.For example, ransomware encrypts files between 10:00 AM and 10:15 AM, and you narrow the recovery window to that period. The recovery point defaults to 10:00 AM. If you change it to 10:10 AM, Content Recovery restores files to their 10:10 AM versions, so files encrypted between 10:00 AM and 10:10 AM stay encrypted.
Select Recover. The recovery process cannot be modified or paused once it starts.
The Content Recovery task page shows the status of files being recovered.
When recovery completes, restored content is accessible to its owners and collaborators.After recovery completes, download a file report (.csv) for more detail about the files involved. The report also lists files that were ineligible for recovery so you can investigate those individually. Box saves the report in your Box Reports folder. For column details and filters, see Content Recovery Report.
