CryptoLocker - restore Drive file version with Google Apps Scripts

Question

long story short I got infected by the CryptoLocker Virus. My “normal” local files are not the problem because these files I backup. But I was using the Google Drive Sync client and all my Drive files got encrypted. I didn’t back them up because I thought Google Drive is save and my data is stored all over the world (my fault I know).

Now I can see that Google Drive provides versioning. This means my old uploads are still on the server. I can restore the previous version file by file but by several thousand files, good luck. I contacted the Google G Suite support team (I’m using Google G Suite for my business) and asked them if they can restore the latest version in one bulk action. The answer was “no you have to do it file by file”. Therefore I was checking the internet for scripts, tools etc.

I found a Google Apps Script in the Google Drive help forum “https://productforums.google.com/forum/#!topic/drive/p08UBFYgFs0https://productforums.google.com/forum/#!topic/drive/p08UBFYgFs0”.

1) I added the “Google Apps Script” app to my drive.

2) I created a new app and past the script:

function testSmallFolder() {          
  var smallFolder = DriveApp.getFolderById('FOLDER_ID_HERE');            
  var files = smallFolder.getFiles();  
  while (files.hasNext())
  {    
    file = files.next();      
    deleteRevisions(file);  
  }     
  var childFolders = smallFolder.getFolders(); 
  while(childFolders.hasNext()) 
  {
    var childFolder = childFolders.next();   
    Logger.log(childFolder.getName());    
    var files = childFolder.getFiles();  
    while (files.hasNext())
    {    
      file = files.next();         
      deleteRevisions(file);  
    }   
    getSubFoldersAndDelete(childFolder);     
  }   
} 

function deleteRevisions(file) 
{  
  var fileId = file.getId();  
  var revisions = Drive.Revisions.list(fileId);  
  if (revisions.items && revisions.items.length > 1) 
  {    
    for (var i = 0; i < revisions.items.length; i++) 
  {      
    var revision = revisions.items[i];      
    var date = new Date(revision.modifiedDate);      
    var startDate = new Date();      
    var endDate = new Date(revision.modifiedDate);      
    var fileName = Drive.Files.get(fileId);      
    if(revision.modifiedDate > "2017-02-16T10:00:00" && revision.modifiedDate < "2017-02-18T10:00:00" && revision.lastModifyingUserName == "ENTER_MODIFIED_USERNAME_HERE]]" && file.getName() !== "HELP_DECRYPT.URL" && file.getName() !== "HELP_DECRYPT.PNG" && file.getName() !== "HELP_DECRYPT.HTML")
    {      
      Logger.log(' %s, Date: %s, File size (bytes): %s',file.getName(), 
                 date.toLocaleString(),          
                 revision.fileSize);        
      return Drive.Revisions.remove( fileId, revision.id);      
    }    
  }  
  } else 
  {    
    Logger.log('No revisions found.');  
  }
}function getSubFoldersAndDelete(parent) 
{  
  parent = parent.getId();  
  var childFolders = DriveApp.getFolderById(parent).getFolders();  
  while(childFolders.hasNext()) 
{
 var childFolder = childFolders.next();     
 var files = childFolder.getFiles();  
 while (files.hasNext())
 {    
   file = files.next();         
   deleteRevisions(file);  
 }   
 getSubFoldersAndDelete(childFolder);     
}  
  return;
}

3) The script provides 3 functions “testSmallFolder” / “deleteRevisions” / “getSubFoldersAndDelete”. Looks like the function “festSmallFolder” can just work on a certain folder. Line 2: FOLDER_ID_HERE

4) I created a folder and moved my files into this folder. Afterwards I got the folder ID (URL) and added it to the script.

5) In line 37 you can add the start and end date of the modification. I also adjusted the username in the same line.

6) I saved the script and ran the “testSmallFolder” function.

7) I get an error message: “ReferenceError: "Drive" is not defined. (line 27, file "Code")“. Line 27 looks like this: „var revisions = Drive.Revisions.list(fileId);”.

I contacted again the Google G Suite support and asked them for help regarding this error. Their answer was “Sorry we do not support scripts.”

Now I’m here guys and asking you for help. Maybe we can get this script running so that I can restore the latest working version of my files.

I really appreciate any help you can provide.

Emanuele Tinari Emanuele Tinari · Accepted Answer · 2017-02-22T23:52:36

You first of all must be sure to enable Advance Drive Service as documented here: https://developers.google.com/apps-script/advanced/drive Go in your script page, click on Resources --> then click on Google Advances Services, then enable (must be GREEN!) Drive API. Maybe an alert open you a page where you MUST abilitate the script to access at your drive and folders (I think only the first time). After do that, if you put a breakpoint on the 2nd row of the script and run the debugger istruction after istruction, you pass the 27 line without any problem, and you can see in the variable stack all the string for the first file, then for the second etc.... Stop then and Run normally this time and all will be ok. Have a good night.

CryptoLocker - restore Drive file version with Google Apps Scripts

2 Answers