Active Protection

To protect your computer from malicious software, Acronis True Image 2021 uses the Acronis Active Protection technology.

Active Protection constantly checks your computer for ransomware, viruses, and other malicious threats while you continue working as usual. In addition to your files, Acronis Active Protection protects the Acronis True Image application files, your backups, and archives. Active protection consists of two protection levels that you can enable independently from each other:

• Antiransomware Protection

• Real-time Protection

Antiransomware Protection

Ransomware encrypts files and demands a ransom for the encryption key.

When the Antiransomware Protection service is on, it monitors in real time the processes running on your computer. When it detects a third-party process that tries to encrypt your files, the service informs you about it and asks if you want to allow the process to continue or to block the process.

To allow the process to continue the activity, click Trust. If you are not sure if the process is safe and legal, we recommend that you click Quarantine. After this, the process will be added to Quarantine and blocked from any activities.

Recovering your files after blocking a process

After blocking a process, we recommend that you check if your files have been encrypted or corrupted in any way. If they are, click Recover modified files. Acronis True Image 2021 will search the following locations for the latest file versions to recover.

• Temporary file copies that were preliminarily created during the process verification
• Local backups
• Cloud backups

If Acronis True Image 2021 finds a good temporary copy, the file is restored from that copy. If temporary file copies are not suitable for restore, Acronis True Image 2021 searches for backup copies locally and in the cloud, compares the creation dates of the copies found in both locations, and restores your file from the latest available non-corrupt copy.

Note  Acronis True Image 2021 does not support file recovery from password-protected backups.

Real-time Protection

When Real-time Protection is enabled, it constantly checks the files you interact with to protect your machine from suspicious activity, viruses, and other malicious threats in real time.

Real-time Protection has two modes of operation:

• Smart on-access—all system activities are monitored, and the files are scanned once you access them.
• On execution—only executable files are scanned as they are launched to make sure that they will not damage your machine.

You can configure Real-time protection what to do with blocked files:

• Block and quarantine—The process suspected of malware activity will be blocked, and the file will be moved to the quarantine folder.
• Block and notify—The process suspected of malware activity will be blocked, and you will get a notification.

You can view the results in the Activities list.