Abstract: Aspects of the present disclosure provide systems, methods, and computer-readable storage media that support providing secure backup and recovery of files from edge devices during ransomware attacks or other cyberattacks. Secure data, such as medical records, may be stored at one or more networked storage nodes and backup images (e.g., snapshots) may be stored at a disconnected storage node (e.g., an air-gapped storage node) that is isolated from the networked storage nodes. Application programming interface (API) calls may be managed and monitored to detect an alarm state (e.g., a ransomware attack), and based on the alarm state, storage and retrieval from the networked storage nodes may be stopped. Additionally, a recent backup image from the disconnected storage node may be retrieved for use in performing system recovery operations.