iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A backup job marked “successful” is not proof that you can recover from ransomware. A recovery-ready backup must remain available to the recovery team, be protected from unauthorized deletion or alteration, contain the required point in time, and restore into a clean environment where files and priority services actually work.
Test those properties deliberately: define what must be recovered and how quickly, inspect who can reach and change each copy, restore representative data away from production, validate applications and dependencies, measure the result against your recovery objectives, and fix every gap. CISA summarizes the core practice as: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” CISA StopRansomware Guide
What makes a backup ransomware-ready?
Ransomware readiness has four separate tests. A copy must be available when production systems are unavailable; protected from an attacker who has stolen production credentials; complete and accurate for the required recovery point; and usable when restored with its operating system, applications, identity services, configuration and dependencies.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Availability: The recovery team can locate the copy, authenticate to it and retrieve it even if the production network, directory service or management console is compromised.
- Integrity: The data has not been encrypted, deleted, silently changed or corrupted. Retention and immutability settings match the period in which an attacker could operate.
- Coverage: The set includes critical files, databases, virtual machines, configurations, secrets, identity data and other items required to deliver the service. File copies alone do not recreate an application environment.
- Recovery: A restore produces readable data and a functioning service, within the time and data-loss limits agreed with the service owner.
These properties must be demonstrated in an exercise. A green status in backup software normally says only that a job completed; it does not prove that the copy is isolated, that the selected recovery point predates an intrusion, or that a database and its application can start together.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Set the scope and success criteria before touching a copy
Run the exercise as a controlled recovery test, not as an ad hoc file download. Involve the people who own the systems, identity, security, networking and business processes. Write down the result that counts as a pass before the restore starts.
List the services and dependencies
Start with services whose loss would stop the organization or create unacceptable harm. For each service, record:
- the data sets and databases it needs;
- servers, virtual machines, containers or endpoints that host it;
- operating-system images, application binaries, licenses and configuration;
- identity, DNS, certificate, key-management, storage and network dependencies;
- integration endpoints and any hardware or vendor access required to operate it;
- the person authorized to declare the service recovered and test its critical workflow.
Include configuration and identity information explicitly. Restoring documents without the directory, permissions, application settings or encryption keys can leave the business unable to use those documents.
Agree on recovery-point and recovery-time objectives
Set two measurable limits with each service owner:
- Recovery point objective (RPO): the maximum acceptable age of recovered data, such as 15 minutes or four hours.
- Recovery time objective (RTO): the maximum acceptable time from recovery authorization to a usable service.
Compare the objectives with the actual copy frequency and the time needed to retrieve and process a restore. NIST gives an illustrative warning in SP 1800-11: an organization processing thousands of transactions per hour may find a once-daily backup inadequate. That is a workload example, not a universal schedule; your transaction rate and tolerable loss determine the required frequency.
Define pass/fail checks
Examples of observable pass criteria include:
- the selected copy is from a time before the simulated compromise;
- all named data sets and required configuration are present;
- representative files open without repair prompts or unexplained changes;
- database consistency checks complete and the application’s critical workflow succeeds;
- the recovered service meets the agreed RPO and RTO;
- the recovery segment cannot be reached by infected production hosts.
Inspect whether ransomware could reach or alter your copies
Map every backup copy, management plane and credential path before the restore. A copy is not isolated merely because it is hosted by a different company or appears in a separate console.
Classify each copy
For every location, record whether it is online, offline, logically isolated, physically disconnected, cloud-hosted or immutable. Note the retention period, deletion process, replication path and the account that administers it. Check the actual configuration rather than relying on policy documents.
Test access and deletion controls
- Identify which production accounts, service principals and administrators can read, overwrite, shorten retention or delete backups.
- Verify multifactor authentication, separate administrative identities and least-privilege roles for backup management.
- Determine whether a compromised workstation or server can reach the backup network, storage endpoint or management API.
- Confirm that an attacker cannot use the same directory, password vault or single sign-on session to control both production and backups.
- Check audit logs and alerting for unusual restore, deletion, retention or key-management activity.
Understand isolation and immutability trade-offs
CISA recommends an offline or otherwise isolated copy, encryption and, where appropriate, immutable protection. Cloud immutability can introduce compliance constraints, configuration mistakes and significant costs, so verify the retention mode, legal hold behavior, recovery account and deletion authority in your environment. The CISA advisory on Play ransomware likewise emphasizes offline backups, regular restoration maintenance and encrypted immutable coverage.
Encryption protects confidentiality and helps prevent unauthorized use of a stolen copy; it does not by itself make a backup recoverable. Document where encryption keys live, who can retrieve them during an outage and how key recovery works without the normal production identity system.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Choose a representative recovery point
Select a copy that exercises the risks you actually face. For an incident drill, use a point before the simulated compromise. Include more than a convenient text file when the environment contains databases, virtual machines, application configuration or large file shares.
Record the backup identifier, timestamp, retention status and the reason it was selected. If several generations exist, test an older point as well as the newest one: a recent copy may already contain encrypted files, damaged configuration or an attacker’s persistence. Do not overwrite the original backup while preparing the exercise.
Restore in a clean, isolated recovery environment
Use a dedicated recovery segment, clean test hosts or an approved disaster-recovery site. Keep it separated from production and from any system suspected of compromise. Restrict outbound connections to only the services needed for validation, and prevent restored systems from contacting untrusted hosts.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →CISA warns that recovery systems must not be reinfected during the process. Do not reconnect a restored machine to the production network simply to make testing easier. If the exercise is part of a live incident, preserve evidence and follow the organization’s incident-response authority before powering on or modifying affected systems.
- Prepare the segment. Build or verify clean hosts, network controls, DNS and time services. Establish an administrator account that is not dependent on compromised production credentials.
- Retrieve the copy. Authenticate through the protected backup path, record who approved access and preserve the backup’s metadata and audit trail.
- Restore the platform. Recover the operating system, virtual machine or container base, required drivers and security configuration before loading application data.
- Restore identity and dependencies. Provide the minimum directory, certificates, keys, DNS, storage and network services needed by the application. Use recovery procedures that do not trust an infected domain controller or credential store.
- Restore data. Recover representative databases, file sets and configuration, noting throughput, errors, skipped objects and any manual steps.
- Start services in dependency order. Bring up identity and infrastructure first, then data services, application tiers and user-facing workflows.
- Capture evidence. Record timestamps, commands or console actions, logs, approvals and the exact recovered point so another team can reproduce the result.
Validate that recovered data and services are usable
Validation must go beyond “the restore completed.” Check content, consistency and function separately.
Check files and records
- Open representative documents, images, archives and exports from each critical data set.
- Compare names, sizes, timestamps, permissions and expected record counts with trusted inventories.
- Look for missing directories, truncated files, unexpected extensions, encryption notes or unexplained changes.
- Where your system already provides integrity checks, compare recovered values with trusted records. There is no single checksum method that fits every application, so use the method appropriate to the data and document it.
Check databases and applications
- Run the database engine’s consistency or recovery checks and inspect logs for errors.
- Verify that application configuration points to the restored database and storage rather than production endpoints.
- Execute the business-critical workflow: for example, authenticate a test user, create and retrieve a record, process a representative transaction and produce a required report.
- Confirm scheduled jobs, integrations, permissions, certificates and service accounts work with the recovered data.
NIST’s recovery guidance stresses trusting the accuracy and precision of recovered data, not simply the existence of files. The NIST ransomware tips recommend planning, implementing and testing backup and restoration while isolating backup copies from ransomware.
Measure the exercise against RPO and RTO
Create a timeline from recovery authorization through a usable priority service. Record:
- time to identify and access the correct copy;
- time to provision or clean the recovery environment;
- transfer and restore duration for each data set;
- the timestamp of the newest usable recovered data;
- people, permissions, hardware, software, licenses and vendor assistance required;
- errors, omissions, manual workarounds and unresolved dependencies.
Compare the recovered timestamp with the agreed RPO and the elapsed recovery time with the RTO. A failure can be caused by an old copy, insufficient backup frequency, slow retrieval, missing infrastructure or an application that cannot be rebuilt—not only by corrupted data. Assign each gap an owner and a due date, then rerun the affected part of the exercise.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Compare backup approaches by recovery properties
No single architecture is universally best. Evaluate the complete design using copy frequency, restore time, validation, isolation, system coverage, compatibility, compliance, operating effort and cost.
| Approach | Potential strength | Questions the ransomware test must answer | Common limitation to investigate |
|---|---|---|---|
| Offline external drive | A physically disconnected copy can be unreachable while systems are compromised. | Is it encrypted? Who controls the drive and key? Are drives rotated safely? Can the team restore from it without the normal network? | Manual handling, limited capacity or stale copies can increase data loss and recovery time. |
| Cloud-to-cloud backup | Can provide geographically separate storage and automated copies. | Can production credentials delete or alter the copy? What are the provider’s retention, export, retrieval and authentication controls? | Shared identity, API access, provider dependencies, egress time and configuration errors may undermine isolation. |
| Immutable storage | Retention controls can prevent alteration or deletion during a defined period. | Is immutability actually enabled for every critical set? Who can change retention? How are keys and compliance holds handled? | Misconfiguration, regulatory constraints and significant storage or retrieval costs can matter. |
| Managed backup service | Specialists may operate monitoring, retention and recovery processes. | What systems and dependencies are covered? How is access separated? Can the provider demonstrate a restore and meet your RPO/RTO? | Contract scope, provider access, compatibility and reliance on an external recovery team require verification. |
Use the same restore and validation criteria for each approach. A design that looks resilient on paper but cannot produce a clean, tested service is not ready.
Can ransomware encrypt your backup?
Yes. If backup storage, agents, management consoles or credentials are reachable from compromised production systems, an attacker may encrypt, delete or alter copies. An online backup that shares an administrator account or directory with production can be affected even when its storage is physically elsewhere.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Reduce that exposure by combining controls rather than relying on one label:
- maintain at least one offline or strongly isolated copy;
- use separate administrative identities and multifactor authentication;
- limit backup APIs and network paths from production;
- encrypt data and protect key-recovery procedures;
- use immutable retention where its configuration, compliance and cost are acceptable;
- monitor and review deletion, retention and restore events;
- test that the recovery team can operate when production identity services are unavailable.
Isolation is a design property that must be verified in the actual environment. A cloud account, secondary site or separate console is not automatically independent.
Using an external hard drive for an offline copy
An external hard drive for offline backups can be one practical way to hold a disconnected copy, especially for small environments. It is not a complete ransomware defense and does not replace a tested recovery plan.
- Use encrypted storage and keep the recovery key in a controlled, separately recoverable location.
- Connect the drive only for the approved backup or restore window; disconnect it afterward.
- Restrict who can handle, transport and erase the drive, and maintain a rotation and retention record.
- Keep more than one generation when feasible so a newly encrypted copy does not replace the last clean one.
- Periodically restore representative data from the drive in an isolated environment and record the result.
Protect the drive from theft, damage, malware on the workstation used to copy it and accidental overwriting. Capacity, copy speed and manual procedures should be selected from the service’s RPO and RTO, not from a generic device size.
Common failed tests and how to fix them
The newest backup contains encrypted or altered data
Stop treating recency as quality. Identify the last known-good point, preserve affected copies for investigation and review retention length, anomaly detection and backup access logs. Increase copy frequency or add protected generations if the resulting RPO is unacceptable.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
The restore is missing applications or configuration
Expand the backup boundary to include system images, application binaries, databases, identity, certificates, keys and documented dependencies. Add a build or recovery procedure and test the complete service rather than a file-only restore.
The team cannot authenticate during an outage
Create break-glass recovery identities, protect them separately, test multifactor and key-recovery procedures, and document the approvals required to use them. Ensure recovery does not depend on a directory service hosted only on the failed production network.
Restored files open, but the service fails
Run application-aware validation and dependency checks. Confirm database consistency, permissions, network names, certificates, queues, scheduled jobs and integrations. Have the service owner execute a real critical workflow and record the exact failing dependency.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe restore exceeds the recovery-time objective
Measure each phase rather than guessing. Options include more frequent incremental copies, faster retrieval, prebuilt clean capacity, prioritized service order, additional bandwidth or a different storage tier. Recalculate costs and compliance implications before changing architecture.
The exercise cannot be repeated
Turn the runbook into a versioned procedure with named owners, prerequisites, credentials, network diagrams, validation scripts or checklists, evidence requirements and rollback steps. Store it where the recovery team can access it during a production outage.
Make testing a continuing control
Repeat recovery exercises on a risk-based schedule and after material changes to applications, infrastructure, retention, identity, storage or backup configuration. Test a range of recovery points and include the people who would make the real recovery decisions.
NIST’s SP 1339 OT Backup Quick Start Guide (June 2026) recommends integrating backup management with change management, creating backups regularly, testing them and reviewing them during recovery exercises. Apply the same discipline to ordinary IT: a change that is not reflected in the backup scope or restore runbook is a recovery risk.
Recommended Free Tools
After every exercise, retain the timeline, recovered point, validation evidence, errors, decisions, owners and due dates. Close a gap only after the relevant restore has passed. Recheck live guidance from CISA and NIST because service settings, threat conditions and regulatory requirements change. This is general preparedness guidance; organizations should align the procedure with their incident-response plan and applicable legal or regulatory obligations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
