PanicStation.org
UK USA
uk Technology & digital loss conflicted copy files • lots of duplicate files overnight • cloud sync conflict copies • onedrive conflicted copies • dropbox conflicted copy • icloud drive conflict copies • google drive duplicate files • sync created many copies • files duplicated while asleep • unexpected file duplication • shared drive conflict copies • autosave created copies • multiple device sync conflict • version history recovery • cloud restore files • cloud files restore rollback • account compromised signs • suspicious sign in activity • mass file renaming • possible ransomware file changes • folders suddenly duplicated

What to do if…
many “conflicted copy” versions of files appear across your folders overnight

Short answer

Pause syncing and isolate the device first: disconnect from the internet and stop OneDrive/Dropbox/iCloud/Google Drive sync so you don’t create more copies or overwrite the version you need.

Do not do these things

  • Don’t start deleting “conflicted copy” files in bulk yet (you can erase the only good version).
  • Don’t “clean up” by moving everything into new folders right now (it makes recovery/version history harder).
  • Don’t keep multiple devices online and open the same files “to check” (that can generate more conflicts).
  • Don’t reinstall your OS or reset the device yet (you may lose the recovery trail you need).
  • Don’t connect backup drives “to save everything” if you suspect malware/ransomware (you could contaminate the backup).

What to do now

  1. Stop the spread (60 seconds).

    • Turn on airplane mode or disconnect Wi-Fi/Ethernet.
    • Pause/quit cloud sync apps on the affected device (OneDrive/Dropbox/iCloud Drive/Google Drive). If you’re not sure how, staying offline still prevents syncing.

  2. Preserve what you’re seeing before it changes.

    • Take photos/screenshots of: a folder showing the “conflicted copy” pattern, any error banners, and the time/date.
    • Write down which service(s) are involved (e.g., OneDrive personal/work, iCloud Drive, Dropbox) and which device(s) were on overnight.

  3. Check if this looks like a sync conflict vs. something more serious.

    • Sync conflicts often show duplicates with “conflicted copy”, device names, or timestamps.
    • Red flags for malware/ransomware include: lots of files suddenly won’t open, strange new extensions, ransom notes, or a surge of renamed/encrypted files. If you see these, keep the device offline and skip ahead to step 7.

  4. From a different “clean” device, secure the account that’s syncing.

    • Sign in to the cloud service’s web dashboard (not the affected laptop if you’re worried it’s compromised).
    • Change the password and enable two-step verification if it’s not already on.
    • If available, sign out other sessions/devices and review recent sign-ins for anything you don’t recognise.

  5. Use the cloud service’s restore/version tools (don’t guess by filenames).

    • Identify the time the duplication started using the service’s activity/recent changes view.
    • For a few key files, use version history to find the last known-good version.
    • If your service offers a broader restore/rollback feature (for example, restoring a whole drive/account to an earlier point in time), consider using it only after you’ve confirmed the correct timeframe and your account is secured.

  6. Make a cautious safety copy before big changes.

    • If you do not see ransomware red flags: copy only your most important folders first to storage that won’t auto-sync (for example, an external drive), then disconnect it immediately.
    • Don’t reconnect that drive until you’ve secured the account and run a reputable malware scan on the affected device (or had IT check it), so you don’t keep propagating the same problem.

  7. If you suspect a cyber attack (or this is a work/charity device), escalate instead of experimenting.

    • If it’s a work/school/organisation account, contact your IT/helpdesk and tell them: “Lots of conflicted copies appeared overnight; I’ve taken the device offline and paused sync.”
    • If you’re unsure who to report a cyber incident to, use the UK government’s “where to report a cyber incident” signposting service.
    • If you’ve been a victim of fraud/cybercrime in England, Wales, or Northern Ireland, report it via Report Fraud (online or by phone).
    • If you live in Scotland, report cybercrime/fraud to Police Scotland (101 for non-emergencies or online reporting).

What can wait

  • Deciding which of hundreds of copies to keep (do that only after syncing is paused and you’ve checked version history).
  • Deduping tools, “cleanup” scripts, or bulk renaming (they can destroy clues and good versions).
  • Factory resets, reinstalling cloud clients, or wiping accounts (these can make recovery harder).
  • Telling everyone to “resend files” or re-sharing folders (wait until you know what happened).

Important reassurance

This is a common pattern when cloud sync gets confused (for example, two devices edit the same files out of sequence, or an account/device sign-in mismatch). The safest move is to stop automatic changes first; you can usually recover a clean version once things stop moving.

Scope note

These are first steps to prevent further loss and keep recovery options open. Full recovery (especially across multiple devices/accounts) can take careful, methodical work or specialist IT support.

Important note

This is general information, not legal or professional advice. If you see signs of ransomware or a targeted compromise, prioritise isolation and qualified help over DIY fixes.

Additional Resources
Support us