Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If ransomware has encrypted files on your computer, disconnect the affected device from Wi-Fi and unplug its Ethernet cable if it has one. Keep the ransom note, avoid using the device for sensitive tasks, and do not rush to pay. Recovery may be possible from a known-clean backup or a free decryptor for the specific ransomware variant, but neither is guaranteed.

What to do first

  1. Disconnect the affected computer from networks. Turn off Wi-Fi and unplug Ethernet. The goal is to limit further spread to shared files or other devices. If several computers or business systems are affected, do not improvise a network-wide shutdown: use the organization’s incident plan and qualified IT or security responders. CISA’s #StopRansomware Guide is written for organizations and recommends immediate isolation of affected systems.
  2. Do not power off automatically if evidence may matter. CISA cautions that shutting down can destroy evidence held in volatile memory; it recommends doing so only when the device cannot otherwise be disconnected. For a consequential business incident, get qualified responders involved promptly.
  3. Preserve the ransom note. Photograph or screenshot it and keep related messages. These details may help identify the ransomware and support reporting or a decryptor check. Do not assume a note is genuine just because it claims to come from law enforcement or another trusted organization.
  4. Avoid sensitive activity on the affected computer. Do not use it for banking or enter passwords. If you have reason to believe credentials were stolen, use a different, clean device and seek qualified advice before changing important passwords. Organizations should include identity and access containment in their incident response.

Should you pay the ransom?

The FBI’s position is clear: “The FBI does not support paying a ransom in response to a ransomware attack.” Payment does not guarantee that the attacker will restore your files, and it may encourage further attacks. Treat any promise of successful recovery as uncertain, not as a dependable outcome. See the FBI’s ransomware guidance for its victim advice and reporting options.

How to choose a recovery option

First consider whether a known-clean backup is available, then whether a free decryptor exists for the identified variant. The amount and sensitivity of the affected data, and whether other systems are involved, also affect whether specialist help is needed.

Option When it may help Important limitation
Restore from a clean backup You have an offline or otherwise known-clean copy of the affected files. Restore only after containing the infection and making sure the system is safe; reconnecting infected systems or backup media too soon can reinfect clean systems.
Check for a free decryptor You can identify the ransomware variant and a tool exists for it. Tools are variant-specific, and one may not exist for your case. No More Ransom offers a decryptor lookup.
Get specialist incident-response help The incident affects a business, public service, multiple devices, or sensitive data. Containment, evidence handling, eradication, recovery, and any required notifications may need to be coordinated; a consumer repair approach may not be enough.

Restore from backup

If you have a backup that you know was not exposed to the infection, restore from it only after containment and a safe recovery plan. CISA recommends restoring from offline encrypted backups while taking care not to reinfect clean systems. Do not connect a backup drive to a computer that may still be infected.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Sale
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
  • Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Check for a decryptor

No More Ransom recommends checking for a free decryption tool once the ransomware variant has been identified. A decryptor may not be available for that strain, so do not assume encrypted files can be unlocked this way.

Understand what cleanup can and cannot do

Removing the malware is not the same as decrypting files. As No More Ransom explains, “Removing the ransomware will not decrypt your files, but it will let you carry out the following steps without new files becoming encrypted.” A malware scan or cleanup may help prevent additional encryption, but it is not a file-unlocking method.

Rank #2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
  • Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Report the incident

In the United States, the FBI advises victims to contact a local FBI field office or submit a report through IC3. CISA’s organizational guide also lists CISA, the FBI, and the U.S. Secret Service as reporting or assistance routes. Reporting contacts and requirements vary by country; outside the United States, use the appropriate national authorities. Organizations should follow their incident plan and assess applicable breach-notification obligations.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Prepare backups for the future

A portable external hard drive can be used to keep a physical backup copy, but it is not a decryption tool and cannot by itself recover files already encrypted. Keep backup media disconnected when it is not in use, as No More Ransom advises. Only reconnect it when the computer is confirmed safe for recovery.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Quick Recap

SaleBestseller No. 1
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$119.99
Bestseller No. 2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$229.99
Bestseller No. 3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$119.80
SaleBestseller No. 4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$159.99
Best Value
Sale
UnionSine 500GB Ultra Slim Portable External Hard Drive HDD-USB 3.0
  • [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
  • 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
  • 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
  • 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
  • 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Rank #4
Sale
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue
  • Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
Rank #3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
  • Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.