Abstract: A protected data file currently in use is duplicated as an authentic backup file, while changing the current file's data appearance and separating the location of the authentic backup file from the original and current file, to camouflage its identity from an unauthorized intruder intending to modify or destroy the original file. A series of indica is generated and stored in a recovery address group or file. The indica represent the original current file and is used to reconstruct the authentic backup file and to write a restored file into the current protected data file. The recovery process may be initiated on a schedule or whenever the original current file is accessed or whenever an unauthorized use of the current file is detected and a comparison of the authentic backup file indicates the original current file has been modified. In this way, the authentic data saved from the original current file may be used to restore the protected data file as originally written and saved in the authentic backup.