Unusual backups

Each job builds up a picture of what its backups normally look like. When a new backup looks very different, such as a folder that suddenly emptied or files that ransomware encrypted, Edge holds it instead of uploading it. Your good snapshots on Central stay safe from retention until you decide. Detection only uses file paths, sizes, file types, and how well the archive compresses. It never reads your files’ contents.

​

What Edge checks

Each job keeps its last 20 uploaded backups as its “normal”. Photo and video folders that never compress well aren’t flagged by the compression check, and adding lots of new files only trips the count check, not the changed-files check.

​

When a backup is held

The job shows held for review with the reasons, for example:

The archive barely compresses (100% of the original size, usually 41%), which is typical of encrypted files. Files ending in .locked went from 0% to 100% of the folder.

Edge also sends a high-priority ntfy alert if notifications are set up. Then either:

• The change is expected, such as a reorganized folder: click Upload anyway. The backup uploads and becomes part of the job’s normal, so the same pattern won’t be flagged again.
• Something is wrong: click Clear staged backup to discard it, then fix the folder, for example by restoring the last good snapshot.

A held job stays held on later cycles while its files stay the same. If the files return to their last uploaded state, the hold clears by itself.

​

Settings

Choose Unusual backups in Edit Edge Settings, or set ANOMALY_MODE in .env: Force Upload always uploads without checking, since it’s an explicit request. Central runs its own, simpler check on archive sizes as a second line of defense. See Unusual sizes.