iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The reliable way to keep ransomware from wiping out your recovery options is to maintain several copies of important data, including at least one encrypted copy that ransomware cannot reach through your everyday computer or account. For many households and small offices, that means completing a backup to a removable external drive, disconnecting the drive immediately afterward, and storing it securely. Keep another copy on a different medium, and regularly restore sample files to prove the backups are usable.
No backup arrangement makes recovery copies impossible to destroy. Isolation reduces what an attacker operating under a normal user account can reach; encryption protects confidentiality and limits tampering; restoration tests reveal whether the plan actually works.
What a ransomware-resistant backup actually is
Ransomware commonly encrypts files on the infected computer and then searches for storage the same account or machine can access. If a backup disk is permanently attached, a mapped network share is writable, or a synchronization service automatically mirrors changes, the attacker may be able to encrypt or delete the recovery data too.
Free tools Windows power users keep installed
One-click scans. No signup required.
A safer backup has four properties:
- Isolation: At least one copy is offline or otherwise unavailable to the ordinary account and device. A removable drive is offline only after it has been disconnected.
- Encryption: Backup contents are encrypted, and authorized people can recover the decryption key or recovery information through a separate secure route.
- Multiple copies: Important data exists in more than one place and, where practical, on more than one type of media.
- Proven recovery: You periodically restore files and check that they are complete, readable, and current.
The Cybersecurity and Infrastructure Security Agency (CISA) states the core practice plainly: Maintain offline, encrypted backups of data and regularly test your backups.
That advice appears in CISA’s Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches fact sheet.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
NIST’s ransomware guidance, updated February 3, 2025, likewise treats backup and restoration as a planned, implemented, and tested process, with copies isolated so ransomware cannot readily spread to them.
Build a 3-2-1 backup layout
CISA, the FBI, and the Australian Cyber Security Centre describe the 3-2-1 rule in their 2023 joint advisory:
- 3 copies of critical data in total.
- 2 media types, such as an internal disk plus a removable drive, or local storage plus a separate cloud backup.
- 1 copy offline or otherwise isolated from routine access.
This is a planning guideline, not a guarantee. Three copies that all share one administrator account, one building, or one untested backup process can still fail together. The value comes from independence: an attacker or hardware failure that affects one copy should not automatically affect the others.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Copy | Typical location | How ransomware might reach it | What makes it useful |
|---|---|---|---|
| Working copy | Your computer or primary server | Usually fully reachable during an infection | Immediate access for normal work |
| Local backup | Another internal disk, network appliance, or backup server | Reachable if the same account has write or delete rights | Fast restoration of recently changed files |
| Offline or isolated copy | Disconnected removable drive or a separately controlled backup service/account | Lower reachability when credentials and connections are not present | Recovery option if online copies are encrypted or deleted |
For business-critical systems, document which copy is expected to survive a compromised administrator account, stolen credentials, hardware failure, or a site outage. The answer may require a second physical location in addition to the offline copy.
Rank #2
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Decide what needs protection
Start with an inventory rather than backing up every byte indiscriminately. Include files that are difficult or impossible to recreate:
- Personal documents, photographs, videos, financial records, and scans.
- Current work, source code, design files, databases, and project folders.
- Email exports, locally stored messages, browser bookmarks, and contact lists when they are not fully recoverable from an online service.
- Application data, configuration files, license information, and encryption certificates required to open the files.
- System images or rebuild materials for servers and specialist workstations where reinstalling and configuring software would take substantial time.
- The recovery information for the backup itself, including encryption keys, key-encryption passwords, and account-recovery codes.
Separate irreplaceable data from caches, downloads, and files that can be recreated. This keeps the backup within the available capacity and makes restoration priorities clear. Record the owner of each data set, how often it changes, and the maximum amount of recent work the owner could afford to lose. That maximum is the recovery-point target that should drive the schedule.
Compare storage approaches before choosing one
There is no single best medium. Compare each option by reachability during an attack, encryption and key recovery, restoration speed, capacity, update reliability, and whether restoration has been tested.
Recommended Free Tools
| Approach | Isolation from a normal user account | Speed and capacity | Update reliability | Main caution |
|---|---|---|---|---|
| Removable external hard drive or SSD | Strong when disconnected; none while attached | High capacity and usually fast local restores; SSDs are generally faster and more shock-resistant than hard drives | Depends on someone connecting it and completing the job | It does not provide encryption, scheduling, or testing by itself. Keep more than one drive if rotation is needed. |
| Online backup service with separate access controls | Can be strong when the backup account is separate, write-restricted, versioned, or retention-locked; ordinary synchronization is not isolation | Restore speed depends on the internet connection and provider; capacity depends on the plan | Can be automatic, but a failed job or exhausted quota still needs review | Verify that encrypted or deleted local files cannot immediately overwrite every recoverable version. |
| Network share or backup server on the same network | Weak if infected devices and users have write or delete permissions | Often fast for local restores and large data sets | Usually easy to schedule | Use it as one layer, not as the only isolated copy. Restrict permissions and protect the server separately. |
| Cloud synchronization folder | Not isolated: synchronization can propagate ransomware changes | Convenient for current files; full recovery may be slow or limited by version retention | Highly automatic | Do not treat synchronization alone as a backup. Confirm independent versions, retention, and a separate recovery path. |
An external drive is a practical physical example because it can be removed from the attack path. The drive must still be encrypted, kept in a safe place, and included in a tested routine; plugging it in permanently turns it into another online target.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Set up an encrypted offline backup
The following sequence works for a home computer or a small office. Names of menus vary by operating system and backup application, but the security decisions are the same.
- Prepare the destination. Choose a drive with enough free capacity for the selected data plus several backup versions. Label it with an inventory name rather than a sensitive description. If the drive will be rotated, prepare a second drive before the first is put into service.
- Enable encryption before copying data. Use the backup program’s encrypted-backup setting or an encrypted volume supported by the operating system. Choose a unique, long passphrase and do not save it in a text file on the same drive.
- Capture the recovery information separately. Store the passphrase or recovery key in an approved password manager, hardware-backed key store, or another protected record accessible to authorized people. Keep an emergency copy through a separate secure route, such as a locked physical record or a separately protected account. Anyone who can obtain both the drive and its key can read the backup; anyone who loses the key may be unable to restore it.
- Select the data set and versions. Include the inventory from the previous section, hidden application data where necessary, and files currently being edited. Configure versioning if the software supports it so an accidentally encrypted or deleted file is not represented by only one new copy.
- Run the backup while the source is trusted. Let the job finish, review its log, and check that the expected folders and file counts were included. A message that the job started is not proof that every file was copied.
- Safely eject and disconnect the drive. Use the operating system’s eject control, wait for activity to stop, unplug the cable, and remove the drive from the computer. Do not leave it connected for convenience or allow it to remain mounted through a network appliance.
- Store it away from routine access. Protect the drive from theft, fire, moisture, and unauthorized handling. For organizations, keep a rotated copy in a separate protected location so one incident cannot destroy every copy.
- Record the result. Note the backup date, covered systems, encryption-key location, software version, and any warnings. This record should not contain the decryption secret itself.
Keep encryption keys recoverable but separate
Encryption creates a recovery dependency: the backup is safe from casual disclosure, but unusable without its key. Treat key management as part of the backup design rather than an afterthought.
- Give access only to people who must restore the data, and document who those people are.
- Keep at least one recovery path independent of the backed-up files and the computer that created them.
- Test the key by decrypting a sample restore; a key that was mistyped, replaced, or tied to a retired account is a backup failure.
- When staff leave or responsibilities change, revoke old access and issue new recovery credentials without deleting the only working key.
- For shared business backups, establish a second authorized custodian so one unavailable person cannot block restoration.
Choose a schedule from the loss you can tolerate
Official guidance says to back up regularly, but no single interval fits every reader. Set the interval by asking how much new work could be recreated after an incident. A project that changes hourly needs a tighter recovery-point target than an archive edited once a month.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use a layered routine when practical:
- Run an automatic local backup frequently enough to capture active work.
- Create or rotate the isolated copy on a separate cadence that matches the value and change rate of the data.
- Keep historical versions long enough to reach a point before an attacker first entered the environment. Ransomware may remain undetected, so the newest copy is not always the cleanest one.
- Review job logs, available capacity, and the age of the last successful isolated copy instead of assuming a scheduled task completed.
When a removable drive is used, rotating two or more drives prevents the only offline copy from being connected every time a new backup is made. Keep the drive that was not just updated disconnected while the other one is in use.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Do not mistake cloud synchronization for an isolated backup
Synchronization is designed to make the same files available on multiple devices. If ransomware encrypts a local folder and the synchronization client treats those changes as legitimate, encrypted files can be uploaded and may replace unaffected cloud versions. Deletion can propagate in the same way.
A cloud-based recovery copy can be part of a sound plan when it has independent version history, retention controls, separate credentials, and a recovery process that an infected endpoint cannot alter. Verify those properties in the service’s documentation and test them. Do not call the copy offline unless the account or storage is genuinely isolated from ordinary access.
Use a separate administrator identity for backup management where possible, restrict everyday users to the minimum permissions needed, and avoid storing persistent backup credentials on every workstation. Isolation is about reachability, not whether the provider’s servers are physically somewhere else.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTest restoration, not just backup completion
CISA recommends regular availability and integrity checks, and NIST recommends planning, implementing, and testing restoration. A green status icon proves only that a software job reported success; it does not prove that the right files, versions, and keys are available.
Best Value
- USB-C and USB 3.1 compatible.Specific uses: Business, personal
- Innovative style with refined metal cover
- Password protection with 256-bit AES hardware encryption
- Formatted for Mac
- Pick representative files. Include a small document, a large media file, a recently changed project file, and any unusual format that is important to your work.
- Restore to a separate location. Use a test folder or spare device rather than overwriting the live files. Keep the test environment away from a suspected infection.
- Verify integrity. Open each file with its normal application, check that it is not truncated or corrupted, and compare names, sizes, dates, and expected folder structure.
- Verify completeness. Confirm that hidden application data, permissions, databases, and configuration needed for a real recovery are present, not just the visible documents.
- Measure the process. Record how long it took to locate the copy, retrieve the key, restore the data, and make it usable. Compare that result with the time your household or business can tolerate being offline.
- Exercise a larger recovery when the stakes justify it. Organizations should practice rebuilding a workstation or server from system images and documented installation materials, not merely opening one file.
- Fix and retest failures. Resolve missing permissions, expired credentials, insufficient capacity, unreadable media, or stale versions immediately, then repeat the restore.
Keep a dated test record showing which copy was used and what was restored. A failed test is valuable when it happens during a planned exercise rather than during an extortion event.
What to do when ransomware is discovered
Do not connect an offline backup drive to an infected computer. The first objective is to stop the malware reaching additional systems and copies.
- Disconnect the affected computer from wired and wireless networks and remove accessible shared drives, following your organization’s incident procedure.
- Leave known-good offline media disconnected and do not sign in to backup administration from a suspected device.
- Preserve relevant alerts, ransom notes, timestamps, and system details for your incident-response team or qualified responder. Do not assume that paying or obtaining a decryptor will restore every file.
- Identify a clean system, reset compromised credentials through a trusted process, and determine which backup version predates the intrusion.
- Restore into a rebuilt or verified-clean environment, then apply required updates and security controls before reconnecting normal users.
- After recovery, review how the attacker reached online backups and change permissions, account separation, retention, and testing practices accordingly.
Additional controls for organizations and operational technology
Businesses should define recovery priorities, owners, retention periods, and approval steps before an incident. Include system images, software installers, configuration exports, certificates, and licensing records where a bare-metal rebuild would otherwise stall. Ensure backup administration does not depend on the same identity provider, workstation, or network segment that ransomware can compromise.
NIST’s June 2026 SP 1339 focuses on operational technology (OT), such as industrial control environments. Its isolation and restoration principles are relevant to organizations running OT, but the guide is not a blanket home-user prescription. OT teams must account for safety, deterministic operation, vendor support, maintenance windows, and the risk of restoring an image that is incompatible with physical equipment.
Common backup mistakes and their fixes
| Mistake | Why it fails | Correction |
|---|---|---|
| Leaving the only backup drive attached | The same ransomware process may encrypt or erase it. | Eject and disconnect the drive after each job; rotate multiple drives when possible. |
| Relying on synchronization alone | Encrypted or deleted files can synchronize to every device. | Add an independently retained, isolated copy and test historical restoration. |
| Saving the encryption key only on the backup | A lost or damaged drive also loses the ability to decrypt it. | Keep authorized recovery information separately and test it. |
| Checking only that a job says “successful” | The job may have skipped files, run out of space, or produced unreadable media. | Review logs and restore representative files on a schedule. |
| Using one account for work and backup administration | Stolen everyday credentials may permit deletion of every copy. | Separate backup administration, limit permissions, and protect recovery credentials. |
| Updating every copy at the same moment | One malicious or corrupted change can become universal. | Keep version history and maintain at least one copy outside the normal write path. |
| Backing up only documents | Recovery can stall because applications, databases, settings, or certificates are missing. | Inventory the materials needed to make the restored data usable. |
A practical baseline to implement now
For a straightforward starting point, inventory irreplaceable files, create three total copies across at least two media types, encrypt the backup, and keep one copy disconnected or independently controlled. Store its recovery key separately, choose a schedule based on acceptable data loss, review each job, and restore sample files at regular intervals. Expand the plan with rotated media, separate locations, system images, and a rehearsed rebuild process as the cost of downtime increases.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
