The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Keep at least one recent copy of irreplaceable files somewhere the infected device cannot readily alter or delete. For files stored locally, CISA recommends either a removable external hard drive or a properly vetted cloud service. Disconnect an external drive as soon as the backup finishes. For ransomware resilience, use offline, encrypted copies, retain recoverable older versions where possible, and regularly prove that you can restore a usable file. If malware is found, restore only from a clean backup and avoid reconnecting the infection to clean systems or backup media.
What a malware-safe backup actually protects
A backup is useful only when it is both separate from the device being protected and recoverable after that device is compromised. Copying files to another folder on the same computer does not meet that test: malware with access to the computer can usually reach the copy as well.
Start with the files that would be difficult or impossible to replace. Typical examples include personal documents, tax or legal records, family photographs, creative work, source code, project folders, saved exports, and device-specific data that is not stored elsewhere. Make a written inventory so a stressful cleanup does not depend on memory.
CISA advises backing up frequently, but it does not prescribe one interval for every person. Set the schedule by the amount of work you can afford to lose. Someone editing a project every day needs more frequent copies than someone who changes a small archive once a month. The important requirement is that the latest copy is recent enough to be useful and is not continuously exposed to the computer being protected.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choose a destination: removable drive or cloud service
Both a removable external hard drive and a properly vetted cloud service can be valid destinations for locally stored files. They protect against different failure modes, so compare them before choosing one or use both if your risk justifies it.
| Question | Removable external hard drive | Vetted cloud service |
|---|---|---|
| How isolated is the copy? | Strong isolation is possible when the drive is connected only during a backup and then safely disconnected. | The service is separate from the computer, but an account or continuously synchronized client can still expose files to malware. |
| Can older versions survive encryption or overwrite? | Only if you keep separate historical copies or the backup software provides protected versions; a simple mirror can reproduce deletions and encrypted files. | Check that the service retains prior versions and offers a recovery process. Do not assume synchronization is historical backup. |
| How are copies updated? | You control when the drive is connected and the copy is run. | Updates may be automatic, but automation can also copy damage quickly. |
| Has restoration been tested? | You must connect the drive and open restored files on a clean system. | You must test account access, version selection, download, and file integrity. |
| What access must be preserved? | Keep the drive, any encryption passphrase, and recovery information available through a safe method. | Keep the account credentials, multifactor recovery method, and any encryption recovery key retrievable outside the infected device. |
CISA does not rank named cloud providers in this guidance. Features, retention periods, and recovery controls change, so verify the current terms of a service before trusting it with your only copy.
Build the backup before malware appears
1. Inventory irreplaceable data
List locations rather than relying on a single “Documents” folder. Include desktop files, photo libraries, local email archives, browser-exported passwords or keys where appropriate, application project folders, and data stored on removable media. Separate files that can be downloaded again from files that exist nowhere else.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
2. Decide how much history you need
A current copy helps after hardware failure, but ransomware can encrypt the current files and then synchronize that damage. Preserve older, recoverable versions when the destination supports them. For a removable drive, this can mean keeping dated backup sets instead of replacing one mirror every time. For cloud storage, read how version retention, deleted-file recovery, and account-wide restore work; the service must be able to return an earlier state, not merely the latest synchronized state.
3. Protect the destination
For ransomware resilience, CISA recommends offline, encrypted backups. “Offline” means malware cannot reach the copy through an active connection; a drive sitting attached to the computer does not qualify while it is mounted. Encryption protects the contents if the drive or account is stolen, but it also creates a recovery obligation: store the passphrase or recovery key somewhere safe and retrievable without the infected computer.
4. Set a repeatable schedule
Choose a trigger you can follow, such as the end of a major work session or a regular calendar reminder. A schedule that is consistently completed is safer than an ambitious plan that is forgotten. After each run, record the date, destination, and whether the verification step succeeded.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
External-drive procedure: copy, verify, disconnect
A removable drive is useful only if its connection time is limited. CISA specifically warns against leaving it attached when it is not actively being used for backup because ransomware may use that connection to delete or corrupt backups.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Prepare a clean destination. Use a drive with enough capacity for the selected files and any historical sets you intend to retain. If the drive is encrypted, confirm that you know the unlock method before an emergency.
- Connect it only for the backup. If the computer is already showing signs of infection, do not use that computer to create or update the only backup. Copy from a system you have reason to believe is clean, or obtain specialist help when the situation is unclear.
- Copy the inventory. Use your chosen backup software or a deliberate file copy. Include hidden project data or application-specific folders when they are part of the work you need to recover.
- Verify the result. Check that the expected folders exist, that file counts or sizes are plausible, and that representative documents, photographs, and project files open. A completed copy operation is not proof that every file is readable.
- Safely eject the drive. Close files and use the operating system’s eject or safely-remove command so pending writes finish.
- Disconnect and store it safely. Keep the drive offline when it is not actively backing up. Protect it from loss, theft, heat, moisture, and accidental damage, and keep the encryption recovery information separate from the drive.
If you maintain more than one dated drive, rotate them so a single failed, lost, or recently connected drive does not eliminate every historical copy. Do not reconnect all copies at once to a computer that may still be compromised.
Cloud backup and synchronization are not the same thing
A cloud service can keep a copy away from a damaged computer, but an ordinary synchronization folder is not automatically a safe historical backup. CISA cautions that automated cloud backups may synchronize encrypted local files and overwrite unaffected copies. The result can be a remote copy that faithfully preserves the damage.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Before selecting a service, confirm these controls in its current documentation:
- Recoverable prior versions for individual files and, ideally, a broader point-in-time restore.
- A retention period long enough for you to notice an attack before the useful version expires.
- A way to restore without relying on the infected computer’s synchronization client.
- Account recovery and multifactor options that remain available if the computer and its password store are unavailable.
- Encryption details and a clearly documented recovery-key process.
Run a small restore test from the service rather than treating a successful upload indicator as proof of recoverability. Download a representative file to a clean location, open it, and document the steps and credentials needed to repeat the process. Do not infer a provider’s current features from general marketing language; verify the exact plan and region you use.
Make ransomware recovery dependable
Keep a copy malware cannot reach
An offline drive is disconnected between backup sessions. A cloud account with versioning can provide separation, but a constantly mounted synchronization folder remains reachable through the local account. Design the process so at least one recent copy is outside the attack path at the time an incident occurs.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Encrypt without losing the key
Encryption is part of CISA’s ransomware guidance, but encrypted data is useless if the only key is on the infected computer. Store the passphrase or recovery key in a separate, protected method that authorized people can retrieve. Test that method during a normal restore exercise, not for the first time during an emergency.
Test availability and integrity
CISA recommends regularly testing both availability and integrity. Availability means you can reach the destination, authenticate, unlock it, and obtain the files. Integrity means the restored files are complete and usable rather than zero-byte, partially copied, or encrypted by the incident. Test different file types and at least one older version when historical recovery is part of your plan.
Document what “done” looks like
Write down the backup locations, schedule, version-retention behavior, restore steps, credentials or recovery methods, and the person responsible for each action. A short runbook prevents a cleanup from turning into a guessing exercise, especially when the person who normally manages the files is unavailable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat to do when malware is discovered
Do not assume an attached backup is clean just because it was created before the warning appeared. Malware may have been present earlier, or the backup may have been modified through an open connection. Treat every destination according to its connection history and the evidence available.
- Stop making changes that could spread the damage. Disconnect the affected device from networks and unplug attached backup drives. Do not reconnect every backup to “see what is there.”
- Preserve the backup evidence. Keep disconnected drives untouched until you can assess which dated copy predates the infection and has passed an integrity check. For cloud storage, use the provider’s version or recovery controls from a clean system.
- Use a clean system for account access and restoration. Enter cloud credentials, unlock backup media, and download restored files from a device you have reason to trust. If you cannot establish that, obtain qualified incident-response help before handling critical backups.
- Select a clean, usable version. Prefer a copy created before the suspected compromise and verify representative files. A backup that contains encrypted or suspicious files is not a clean restore point.
- Clean or rebuild the affected device before normal use. The exact order depends on the malware and device. CISA’s detailed ransomware recovery guidance is primarily organizational, so consumer sequencing can vary; do not restore files in a way that reintroduces the infection.
- Restore cautiously. Bring back essential data first, scan and inspect it on the clean environment, and keep the original backup untouched until you have confirmed the restored working set.
For a business device, shared system, extortion demand, or suspected data theft, preserve relevant evidence and involve an incident-response professional. Do not let the urgency of recovering files cause you to overwrite the only clean copy.
Common backup failures and their fixes
| Failure | Why it fails | Fix |
|---|---|---|
| The only copy is another folder on the same computer. | The same malware, disk failure, or account compromise can reach both locations. | Use a separate external drive or vetted cloud destination. |
| The external drive stays connected permanently. | Ransomware can use the active connection to delete or corrupt it. | Connect for the job, verify, safely eject, and disconnect. |
| A sync folder is called a backup. | Encrypted or deleted local files may be synchronized and overwrite the remote state. | Confirm version history and point-in-time recovery, then test a restore. |
| The backup ran but no file was ever restored. | Unreadable files, missing permissions, expired versions, or lost keys may remain undiscovered. | Schedule restore tests and document the exact recovery path. |
| The encryption key is stored only on the infected device. | The protected copy cannot be unlocked when it is needed. | Keep recovery information retrievable through a separate safe method. |
| Every backup is updated immediately after an infection. | The newest copy may preserve the malware’s encryption or deletions. | Stop, isolate media, identify an earlier clean version, and restore from that copy. |
| The plan depends on one person’s memory. | During an incident, nobody knows the destination, password-recovery route, or restore order. | Maintain a concise written inventory and recovery runbook. |
A practical decision checklist
- Have you listed the files that cannot be replaced or downloaded again?
- Is at least one recent copy separate from the computer that normally holds the originals?
- If you use a drive, is it disconnected except during backup and verification?
- If you use cloud storage, have you confirmed historical versions and a restore path rather than assuming synchronization is enough?
- Are important copies encrypted, with the recovery key available through a separate safe method?
- Have you opened restored examples of each important file type?
- Can you access the backup account or unlock the drive from a clean system?
- Do you know which dated copy you would choose if today’s files were encrypted?
- After an infection, can you restore without reconnecting a possibly infected device to clean systems or backup media?
The central safeguard is procedural, not a particular brand or application: maintain a recent, separate copy; limit its exposure; preserve usable history; and prove through restoration that the copy is available and intact. That approach keeps malware cleanup from becoming the event that destroys the data you were trying to save.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
