Skip Ahead To...
Can I create a snapshot at a particular time?
Can the snapshots be kept for longer than the 50-day window?
Can a user recover their data to any point in time within the 120 days?
Is there a limit to the number of files/folders that can be restored?
Is there a limit to the number of restoration jobs that can be processed at the same time?
Which file version is restored from the snapshot?
Are the encrypted versions/files deleted during the restoration process?
Can I have multiple mounted snapshots at the same time?
How long can I keep the snapshot mounted?
How do I know which snapshot to mount?
How do I know which files or folders to restore?
Can I recover data even when they are purged from the Trash?
Is the full 120-day coverage applied starting from the first day when the 120-day extended coverage was added?
When the admin previews or downloads files using the snapshot, is it recorded in the audit?
When the files are restored by a Restoration Job, is it recorded in the audit?
When the admin mounts a snapshot, is it recorded in the audit?
When the admin starts a Recovery Job, is it recorded in the audit?
Can I create a snapshot at a particular time?
No, currently, all the snapshots are created automatically according to the following schedule:
50-Day Basic Coverage
| Age of Data | Snapshot Frequency | Snapshots per day |
| Days 0–2 | Every 6 hours | 4 |
| Days 3–9 | Every 12 hours | 2 |
| Days 10–30 | Every 24 hours | 1 |
| Days 31–50 | Once every 10 days | 1 in 10 days, taken at the end of the day (UTC) |
120-Day Extended Coverage
| Age of Data | Snapshot Frequency | Snapshots per day |
| Days 0–2 | Every 6 hours | 4 |
| Days 3–9 | Every 12 hours | 2 |
| Days 10–30 | Every 24 hours | 1 |
| Days 31–120 | Once every 10 days | 1 in 10 days, taken at the end of the day (UTC) |
- In the 31–120 day range there are only 9 snapshots (one every 10 days, at the end of day), so recovery is limited to those 10-day interval points and the oldest recoverable point rotates between 111 and 120 days.
- The 120-day extended snapshot coverage is available for customers having the Ultimate plan.
Contact your account manager or Egnyte Sales team for more information.
Can the snapshots be kept for longer than the 50-day window?
There is an extended 120 day coverage available only for Ultimate plans.
For the other plans, the 50-day window cannot be extended right now. The focus of Snapshot-based Ransomware Recovery is to allow recovery from a ransomware attack. Usually, the encrypted ransomware files are discovered within 1-3 days of the attack. Hence, the 50-day window should be large enough. In the future, product capabilities may allow larger time windows.
Can a user recover their data to any point in time within the 120 days?
Not to any arbitrary point. Snapshot frequency decreases the further back one goes:
- Days 0–30: frequent snapshots (every 6 hours, then every 12 hours, then daily) — near point-in-time recovery.
- Days 31–120: one snapshot every 10 days, taken at end of day — recovery is limited to these 10-day interval points.
Because the extended snapshots rotate on a sliding window, the furthest-back recovery point stays between 111 and 120 days. If a specific change happened between two 10-day snapshots in the extended window, that exact state cannot be recovered.
Is there a limit to the number of files or folders that can be restored?
Yes, there is currently a limit of up to 10 folder per restoration job. Please note that if the user is selecting files to be restored, there is no such limit on number of files to be selected. If the user needs to restore more than 10 folders, they should split the task into multiple restoration jobs. This limit is in place to ensure a smooth and fail-safe restoration process.
Sometimes while restoring the files using the option Restore files to the same location, it may happen that after restoring the files the number of files exceeds the limitation of 50k files per folder and in that case, the restoration job may fail or complete with errors.
Is there a limit to the number of restoration jobs that can be processed at the same time?
Yes, there is currently a limit of up to 3 concurrent restoration jobs being processed simultaneously. If the user has already created 3 restoration jobs and all of them are being processed, they need to wait until at least one job to be completed before creating any new restoration job.
Which file version is restored from the snapshot?
The latest version of a file from a snapshot will be added to the existing version of the file in the domain. If the destination file does not exist in the domain, the latest version of the file on the snapshot will be restored.
Are the encrypted versions/files deleted during the restoration process?
No, the restoration job will restore the files (versions). It does not delete the encrypted files/versions . Admin can delete the files that are not needed after the restoration.
Can I have multiple mounted snapshots at the same time?
Only one snapshot can be mounted at a time . If it is needed to mount another snapshot, it is necessary to unmount the currently mounted snapshot.
How long can I keep the snapshot mounted?
If no restoration jobs are running for a mounted snapshot, the snapshot will be unmounted after some time (usually, 1-3 days since it was mounted) .
How do I know which snapshot to mount?
The file Audit Report contains records of the file activity of users, so it is possible to identify when a user uploads many files starting from a specific point in time. If it happens to be the ransomware activity, a snapshot created before that specific point in time should be mounted for recovery.
How do I know which files or folders to restore?
The file Audit Report contains records of the file activity of users, so it is possible to identify when a user uploads many files starting from a specific point in time. If it happens to be the ransomware activity, then files and folders impacted by the action should be restored from the snapshot.
Can I recover data even when they are purged from the Trash?
Yes, when the feature is turned on for a domain, it is possible to recover the data deleted from Trash, if it was deleted within the sliding 50-day or 120-day window (based on the Egnyte plan) for which the snapshots are kept. Please note that the data can be recovered from the original location using the snapshot that was taken just most recently before the deletion.
Important: In the first 30 days, snapshots are frequent (as often as every 6 hours), so the snapshot before a deletion will usually be very close in time. In the 31–120 day range, snapshots are taken only once every 10 days at the end of day. As a result, the closest snapshot before a deletion could be up to ~10 days earlier. If data was deleted and then purged between two 10-day snapshots, it may not be captured in any snapshot. Recovery in the extended window is limited to the state of the data at those 10-day interval points.
Is the full 120-day coverage applied starting from the first day when the 120-day extended coverage was added?
Yes, the full 120 days coverage begins from day 1 of added extended coverage with a guaranteed coverage of 111 days, provided that the domain is more than 120 days old. The existing limitations will still be applicable.
When the admin previews or downloads files using the snapshot, is it recorded in the audit?
Yes, there will be records in the File Audit Report:
- "Access": "Web UI - Snapshot Preview"
- This tells the user that these audit entries result from snapshot preview action from the Web UI.
- "Action":
- "Preview on Snapshot"
- This tells the user that the file was previewed from the snapshot.
- "Download from Snapshot"
- This tells the user that the file was downloaded from the snapshot.
- "Preview on Snapshot"
When the files are restored by a Restoration Job, is it recorded in the audit?
Yes, there will be records in the File Audit Report:
- "Access": "Restoration Job"
- This tells the user that these audit entries result from initiating a restoration process from the Web UI.
- "Action": "Restore from Snapshot" OR "Restore from Snapshot – Download Link" OR "Restore from Snapshot – Upload Link"
- Restore from Snapshot: This tells the user that the file was restored from the snapshot.
- Restore from Snapshot - Download Link: This tells the user that the download link for the file was restored from the snapshot.
- Restore from Snapshot - Upload Link: This tells the user that the upload link for the folder was restored from the snapshot.
When the admin mounts a snapshot, is it recorded in the audit?
Yes, there is a separate Snapshot Recovery Reports, where users see information about who initiated the mounting of a snapshot when the snapshot was unmounted.
When the admin starts a Recovery Job, is it recorded in the audit?
Yes, in the Snapshot Recovery Audit Report, users see information about who initiated the restoration job.
Additional Resources
Learn more about Snapshot Based Ransomware Recovery by watching a Quick Tip on Egnyte University: Snapshot-Based Ransomware Recovery.