iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To recover from ransomware, keep at least one current copy of important data that an infected device or compromised account cannot alter, and test that you can restore it. A connected backup can be encrypted or deleted along with the original files, while ordinary cloud synchronization can spread encrypted changes. Use protected backups, disconnect removable drives after backup, preserve the credentials needed to unlock your files, and practice restoring before an emergency.
What makes a backup useful against ransomware?
A backup is useful only if it preserves recoverable data outside the reach of the ransomware incident. If a backup drive is connected to an infected computer, or a backup account is accessible through compromised credentials, malware or an attacker may be able to alter or delete that copy too. CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario. Its #StopRansomware Guide was revised October 19, 2023, and presents recommendations from CISA, MS-ISAC, NSA, and FBI through the Joint Ransomware Task Force.
Translate that guidance into three controls: keep a protected copy beyond the everyday device or account, disconnect removable media when a backup session is over, and periodically restore sample files to verify that the copy is usable. Encryption protects the contents of a backup from unauthorized reading; it does not by itself protect the backup from deletion or encryption by malware. Isolation from everyday access and a tested recovery process matter just as much.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Coverage: The copy includes the files and systems you would actually need after an incident.
- Separation: An infected device or compromised account cannot readily rewrite or erase every copy.
- History: Earlier clean versions remain available when newer files have been encrypted or overwritten.
- Recoverability: You can retrieve the data, unlock it, and restore it in a practical timeframe.
No single storage format guarantees all four. A removable drive can be offline between sessions but can fail, be lost, or become outdated. An online backup may be convenient yet exposed through an account or connected system. Select arrangements by checking how each copy is protected, how old versions are retained, and how recovery works—not simply by asking whether an app says “backup complete.”
#1 Best Overall
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How is backup different from cloud synchronization?
Synchronization keeps files aligned across locations or devices. That is convenient for ordinary work, but it can also propagate an unwanted change: if ransomware encrypts files on a synced computer, the encrypted versions may sync to the cloud and replace unaffected copies. CISA cautions that automated cloud backups may not be sufficient when local encrypted files overwrite cloud versions. A sync service should therefore not be assumed to provide an independent, recoverable backup.
Version history, recycle bins, or restore points may offer a way back, but the protection depends on the service and account configuration. Before relying on one, determine whether it retains prior versions after mass changes, how long those versions remain available, whether an administrator or user can permanently delete them, and how you would restore a whole set of files. Do not assume a restore point exists for every file or is retained indefinitely.
Cloud data may need protection too. CISA recommends considering cloud-to-cloud backups for cloud resources, rather than treating one cloud account as an automatic second copy of another. For Microsoft 365 specifically, Microsoft documents a workflow for selecting a OneDrive or SharePoint restore point manually or using a tool-recommended express restore point. That is a product-specific example, not proof that every account, file, or plan is covered by default. Check your own plan’s scope, retention, access, and restoration behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose a backup arrangement that ransomware cannot easily reach
Compare options against your threat and recovery needs. The following are general characteristics, not product rankings: the cited guidance does not rank consumer vendors or establish prices, capacity, speed, or a best service.
Rank #2
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Approach | What it can provide | What to verify |
|---|---|---|
| Removable external hard drive or SSD | A local copy that can be disconnected after backup, applying CISA’s offline-backup recommendation. | Disconnect it when the session is finished; check that enough capacity is available; keep another protected copy where possible; and test restoration. A single drive can fail, be lost, or become stale. |
| Cloud sync with version history or restore points | Convenient access and, depending on the service, a possible route to earlier versions. | Whether encrypted changes can overwrite current files, how long prior versions are retained, what can delete them, how account access is protected, and how to restore files or folders. |
| Managed backup service | May provide scheduled copies and recovery features, depending on the service and configuration. | Which devices, data, and cloud resources are covered; whether malware or an account holder can alter or delete backups; version retention; credential recovery; and a tested restore workflow. |
| Cloud-to-cloud backup | A separate backup path for data held in cloud services, as CISA recommends considering for cloud resources. | Coverage of the specific source account and data, protection from deletion or compromise, retention, administrator access, and the steps and time required to restore. |
For an individual or household, a practical starting point is a regular backup to removable storage that is disconnected afterward, plus a separately protected copy for especially important data if feasible. For a small organization, map critical systems and cloud services before selecting a tool: a backup of employee documents will not restore a business application, its configuration, or a dependent system unless those are included. Microsoft identifies offline or immutable backup gaps, untested enterprise restores, and missing backups of critical systems as preparedness weaknesses in its ransomware preparation guidance.
Build a backup plan for your devices
1. List the data and systems you cannot afford to lose
Make an inventory by device and account. Include personal documents, photos, work files, and other records you would need to continue normal activity. For a business, include critical services and systems as well as the data they use. Identify dependencies: a file may be backed up, but recovery can still be blocked if the application, configuration, account, or system required to use it is not recoverable.
Decide what must be restored first and what can wait. A household might prioritize identity and financial records, work files, and irreplaceable personal media according to its own needs. An organization should set priorities based on critical services and dependencies rather than assuming every device can be restored at once. CISA’s response guidance calls for restoration according to critical-service priorities.
Recommended Free Tools
2. Select a protected destination
Choose a destination that is not continuously writable from every device you are trying to protect. For removable media, connect the drive for the backup and then disconnect it. For online storage or a managed service, review protection against deletion or alteration, version retention, account security, and recovery access. If the backup relies on an administrator account, protect that account and know how its access can be recovered.
Rank #3
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Capacity depends on the amount of data you need to preserve; the cited guidance does not specify a universal drive size or a preferred drive type. A drive’s capacity, price, and speed should be selected for your own workload, while its security depends on how it is used. One disconnected drive is not a complete strategy if it is your only copy, the only copy is old, or you have never confirmed that its contents can be restored.
3. Configure and run the backup
Use the backup capability appropriate to your device or service, and confirm the intended files and systems are included. Settings and labels differ among products, so do not assume that a default setup captures all user folders, external drives, cloud accounts, application data, or system information. Check the actual coverage report or file list after the first run. If a service offers version history or restore points, verify its retention and restore behavior rather than relying on its name.
Encrypt backups containing sensitive data when the method supports it, and store the encryption password or recovery key securely outside the backup itself. CISA’s guidance on protecting data stored on devices calls attention to safely storing secrets needed to access protected data. A backup you cannot unlock is not a usable recovery copy.
4. Disconnect, separate, and protect access
When a removable backup finishes, safely eject and unplug it. Avoid leaving the drive attached between backup sessions: it then remains accessible to the everyday device and may be exposed if that device is compromised. Store the disconnected media somewhere secure and accessible to the people who would need it during recovery.
Rank #4
- 【Versatile Storage Expansion – For Gaming, Work & Everyday Use】 Running out of space on your PS5 or Xbox Series X/S? This external hard drive lets you store and play PS4 / Xbox One games directly, instantly freeing up your console’s internal storage for next‑gen titles. At the same time, it handles work file backups, media libraries, and cross‑device data transfers with ease. One drive, all your needs. *（Note: PS5 / Xbox Series X|S games cannot be run or stored directly from the external hard drive. However, by offloading your PS4 / Xbox One games, you can free up valuable space for newer titles.）*
- 【Patented Silicone Sleeve – Data Protection You Can Count On】 Worried about drops? We’ve got you covered. The patented built‑in silicone sleeve acts like a shock‑absorbing armor, cushioning your drive against bumps and falls. Whether it’s important work documents, precious family photos, or hard‑earned game saves, your data deserves this level of protection.
- 【Plug & Play, Compatible with Computers & Consoles】 No complicated setup—just plug in and go. Works seamlessly with Windows, Mac, and Linux computers, as well as PS4, PS5, Xbox One, and Xbox Series X/S. Process files at the office, back up data at home, or enjoy gaming in your downtime—one drive handles all your devices, simply and hassle‑free.
- 【USB 3.0 Ultra‑Fast Transfer – No More Waiting】 Tired of watching progress bars crawl? With USB 3.0 speeds up to 5Gbps, large files transfer in seconds. Whether you’re moving work documents, transferring hundreds of gigs of games, or backing up a year’s worth of photos, you get more done in less time.
- 【Sleek, Lightweight, and Ready to Go】 Weighing just 0.16 kg—lighter than a can of soda—this compact drive features a stylish mirror‑and‑frosted finish. Toss it in your bag and go, whether you’re heading to the office, visiting a friend for a gaming session, or giving a presentation on the road.
For account-based backups, secure the account with appropriate access controls and keep recovery methods available to an authorized person. Separate backup credentials from everyday access where the service permits it. For organizations, identify who can administer backup infrastructure and who can restore data; protect those credentials and document how to regain access if the usual administrator is unavailable.
5. Test the restore, not just the backup job
Periodically choose representative files and restore them to a separate location. Open them and check that they are intact and usable. For a business, test the end-to-end recovery of critical systems and their dependencies, not only an individual file. Microsoft specifically identifies untested enterprise restores as a weakness in ransomware preparedness. A successful status message from a backup job proves that a job ran; it does not prove that the right data was included, that old clean versions remain, or that a person can complete recovery.
Record what you tested, where the copy resides, what credentials or keys are required, and any restore steps that were unclear. Use a failed or confusing test to fix coverage, access, or instructions before an incident. Repeat tests often enough to account for changes in devices, data, accounts, and service settings.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Protect the keys and access needed for recovery
Backups may be encrypted, and files or systems may need credentials to become usable again. Store recovery keys, passwords, and account recovery information in a secure place that is separate from the data they unlock and available to an authorized person during an emergency. Consider what happens if the primary device is lost or the usual account holder is unavailable. CISA’s device-data guidance supports safely storing the secrets required to access protected data.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Do not record a key only on the computer whose data it unlocks, or keep the only copy inside the backup that requires that key. That creates a circular recovery problem. For an organization, define an approved way for the recovery team to obtain secrets without making them broadly accessible to everyday users. Test the access process as part of restore exercises; finding a password manager or key is not enough if nobody can unlock it in the recovery situation.
What to do if ransomware is active
Do not treat a backup as permission to immediately reconnect, wipe, or restore an affected device. First contain the incident so the affected system cannot communicate with or contaminate clean systems. CISA’s response checklist calls for isolating affected systems, restoring from offline, encrypted backups, and avoiding reinfection of clean systems during recovery. Follow the incident response guidance relevant to your circumstances; a business may need a qualified incident response team to verify containment and system cleanliness before restoration.
- Isolate affected devices and systems. Follow incident-response instructions to keep them from communicating with clean systems. Do not connect a backup drive to a device that may still be infected.
- Determine what is affected and what must return first. For an organization, identify critical services and dependencies, and set restoration priorities. Avoid restoring everything in an arbitrary order.
- Confirm the restore source is protected and clean. Choose a suitable offline or otherwise protected backup and an appropriate earlier restore point if the service provides one. Confirm that credentials and encryption keys are available.
- Restore only after the target systems are ready. Do not restore over an affected system before containment and cleanliness have been addressed. A business should involve qualified responders where needed to reduce the risk of reinfection.
- Validate the result. Check that restored files open and that critical systems work as expected before relying on them. Keep the backup protected while recovery proceeds.
The detailed sequence can vary with the incident and the systems involved. CISA’s October 2023 #StopRansomware Guide contains response and recovery guidance; organizations should align restoration with their incident-response plan and critical-service priorities.
Common backup failures and how to prevent them
- The only drive stays plugged in. Disconnect removable media after each backup so it is not continuously reachable from the everyday device.
- Cloud sync is mistaken for an independent backup. Check whether the service retains clean versions after mass changes and how to restore them; consider a separate backup path.
- The backup is incomplete. Review actual coverage by device, data location, cloud account, and critical system. A successful run does not confirm that unselected data was included.
- Old versions are unavailable when needed. Establish how long version history or restore points remain and whether they can be deleted through the same compromised account.
- The backup can be unlocked only with a lost key. Store passwords and recovery keys securely and separately, and exercise the access procedure.
- The organization has never rehearsed recovery. Test restoration of files and critical systems, including dependencies, and revise the plan when the test exposes gaps.
- A clean backup is restored onto an unclean system. Isolate affected systems and address containment before restoration; do not reconnect them in a way that risks contaminating clean systems.
Sources and product-specific scope
The central recommendations here come from CISA’s #StopRansomware guidance and its device-data protection advice. Microsoft Learn provides two narrower examples: preparation weaknesses identified for organizations, and a Microsoft 365 Backup restore workflow for OneDrive or SharePoint. The latter describes selecting a restore point manually or using a tool-recommended express restore point; it should not be read as a claim that every Microsoft 365 account or file is automatically covered. Check the current coverage, retention, access, and restore workflow for any service you use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
