Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most reliable protection combines isolation, encryption, restricted administration, retention controls, and tested restores. Keep at least one backup copy offline or otherwise separated from the computers, networks, accounts, and credentials most likely to be compromised. Configure versioning, soft delete, or immutability where the service supports it, and regularly prove that the files or systems can actually be restored.
A synchronized folder is not automatically an independent backup: a deletion or encrypted file can synchronize to every connected copy unless version history, retention, or deletion protection is enabled.
What a ransomware-resistant backup system must do
Ransomware protection is not just a matter of creating more copies. An attacker who can reach the backup account, storage location, or management console may be able to encrypt, overwrite, or delete every copy. Accidental deletion creates a similar problem when synchronization or broad permissions propagate the mistake.
A useful design gives you several independent chances to recover:
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Isolation: at least one copy is offline or separated from routine production access.
- Confidentiality: backup data is encrypted at rest and in transit where the service provides those controls.
- Access separation: backup administration is not controlled by the same everyday credentials used to run production systems.
- Historical recovery: versioning, retention, soft delete, or immutable storage preserves earlier states.
- Operational proof: restore exercises confirm that the data is complete, readable, and usable.
CISA summarizes the core practice this way: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.”
Start by defining what must be recoverable
Make an inventory before choosing storage or retention settings. A backup that contains only user documents may not be enough to rebuild a service after an incident.
List data and systems by recovery importance
- Business records, customer or patient data, financial files, and legal documents.
- Databases, shared files, mailboxes, source code, executables, and licensing materials needed to operate applications.
- Operating-system images, application installers, infrastructure definitions, network diagrams, and configuration files.
- Identity, security, and access configurations needed to administer restored systems.
- Critical-system “golden images” that provide a known-good starting point for rebuilding machines.
Record who owns each item, how frequently it changes, how long it must be retained, and how quickly it must be available after an outage. Those answers determine whether a local copy, cloud service, or hybrid arrangement is appropriate.
Choose an arrangement with genuine separation
There is no universally best medium. Compare each arrangement by how well it separates copies from production credentials, how it handles deletion, how quickly it can restore, and what it costs to store and retrieve.
| Arrangement | Isolation and deletion risk | Recovery characteristics | Best fit and cautions |
|---|---|---|---|
| Disconnected external storage | Strong physical separation when disconnected between backup sessions; vulnerable while attached and if the device is lost, damaged, stolen, or fails. | Can provide fast local restores without internet or retrieval charges; capacity and manual handling limit scale. | Useful for an offline copy. Encrypt it, label it, store it securely, and maintain another recovery option for important data. |
| Cloud backup service | Always-connected storage can be exposed through compromised credentials unless accounts, permissions, retention, and deletion controls are configured. | Automation, geographic separation, version history, and managed restore workflows may simplify recovery; download time and retrieval charges can matter. | Suitable when automated copies and remote recovery are needed. Verify the provider’s actual retention, soft-delete, immutability, and restore behavior. |
| Hybrid arrangement | Combines an offline or separately administered copy with an online copy; each still needs its own access and retention safeguards. | Local copy can accelerate common restores while remote storage helps with site loss or physical damage. | Often appropriate for high-value data, provided both paths are monitored and tested rather than assuming one protects the other. |
For cloud designs, separation can mean different accounts, subscriptions, regions, or providers. Microsoft’s architecture guidance describes independent copies across administrative and regional boundaries. CISA also advises considering cloud-to-cloud backup when the risk of losing access to one service is significant.
Keep at least one copy offline or isolated
An offline copy cannot be encrypted or erased through the normal network path while it is disconnected. “Isolated” can also mean a storage account, subscription, vault, or network segment that production systems cannot administer or routinely reach.
Using removable or external storage
- Connect the encrypted storage only during a controlled backup window.
- Run the backup and verify that the job completed without errors.
- Safely eject or power down the device.
- Store it in a secure location protected from unauthorized access, fire, water, and other local hazards.
- Rotate copies when the data’s importance requires protection from a single device failure.
An external hard drive is a category-level option, not complete protection. It can be lost, damaged, stolen, or fail, and a drive left permanently connected is exposed to the same ransomware event as the computer it backs up.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Using isolated cloud storage
Use a separate administrative boundary where practical. A production administrator should not automatically be able to delete every recovery copy. Separate accounts or subscriptions, distinct authentication, restricted network paths, and a different region can reduce the chance that one compromised identity destroys both production and backups.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Isolation is effective only if routine workflows respect it. Do not mount an isolated repository as an ordinary writable drive, reuse production administrator passwords, or grant broad “owner” permissions merely to simplify setup.
Encrypt backup data and control the keys
Encryption protects the contents if a device or storage account is accessed without authorization. Apply encryption to removable media and use the backup service’s encryption controls for cloud data. Protect encryption keys separately from the backup files; an attacker who obtains both can read the data, while a lost key can make a perfectly intact backup unusable.
Use least privilege
- Give backup operators only the permissions needed to run jobs and perform approved restores.
- Keep deletion, retention-policy changes, and key-management privileges with a smaller administrative group.
- Use separate backup administration or service accounts rather than sharing production administrator credentials.
- Require multi-user approval or other dual-control features for destructive operations when available.
- Enable multifactor authentication and monitor sign-ins, permission changes, failed jobs, and deletion attempts.
AWS documents access policies for backup vaults; the exact permissions and account design are AWS-specific, but the principle is general: an identity that can write backups should not automatically be able to erase or shorten their retention.
Understand the protection controls before enabling them
Versioning, soft delete, retention, and immutability solve related but different problems. Read the service documentation for what is protected, for how long, and which administrators can change the setting.
| Control | What it preserves or blocks | Important limitation |
|---|---|---|
| Versioning | Keeps earlier versions of an object when it is changed or overwritten. | Storage can grow, and versioning alone may not prevent an administrator or attacker from deleting versions. |
| Soft delete | Retains deleted recovery data for a defined recovery window so it can be undeleted. | The window, protected objects, and recovery procedure are service-specific. |
| Retention policy | Requires data to remain available for a specified period. | Changing or shortening the policy may be possible unless an immutable lock is applied. |
| Immutability or object lock | Prevents modification or deletion during a configured retention period. AWS describes this as write-once, read-many (WORM) storage. | Incorrect duration or scope can create cost and recovery problems; a locked policy may be irreversible during its retention period. |
| Deletion protection | Blocks or adds friction to destructive actions such as deleting a vault or recovery point. | It does not necessarily preserve every prior version or protect data outside the covered resource. |
These controls are complementary. Version history can recover an earlier file, while immutability can stop an attacker from removing that history. Neither replaces an isolated copy or a tested recovery plan.
Azure Backup example: soft delete and immutable vaults
Microsoft’s Azure Backup documentation says soft delete retains deleted backup data for a configurable period of up to 180 days, with 14 days documented as the default in the material reviewed. Those figures apply to Azure Backup, not to backup services generally. Microsoft recommends not disabling the feature.
Microsoft also describes immutable Azure vaults that protect backup data from deletion or modification during the configured retention period. Before locking immutability, validate the retention policy, legal requirements, storage growth, and restore process. Microsoft warns that a locked policy cannot be reversed during that retention period.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →AWS Backup Vault Lock example
AWS describes immutable storage as WORM and documents AWS Backup Vault Lock as a control that can prevent backup deletion or retention changes. Account structure, governance mode, compliance requirements, and configuration details determine the actual behavior, so treat Vault Lock as an AWS-specific implementation rather than a universal setting.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Set retention deliberately
Retention should reflect the time an incident may remain undiscovered, the organization’s legal or contractual duties, and the time needed to investigate and recover. A short window may expire before you notice a slow-moving compromise; an unnecessarily long immutable window increases storage costs and limits cleanup.
Before locking an immutable policy, verify:
- The minimum retention period meets business and regulatory requirements.
- Backups are restorable throughout the period and can be accessed by an independent recovery team.
- Storage growth and retrieval costs are acceptable.
- Expired data will be removed safely without deleting still-needed versions.
- Administrators understand which actions become impossible until the lock expires.
Use a documented exception process for emergencies, but do not create an exception that lets the same compromised administrator bypass the protection.
Monitor backup jobs instead of trusting a green status
A successful job report proves only that the software reported success. It does not prove that the expected files were included, that the backup is readable, or that the system can be rebuilt.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchReview these signals
- Job completion, duration, throughput, and unusual changes in data volume.
- Skipped files, permission errors, agent failures, and storage-capacity warnings.
- Changes to backup schedules, retention, encryption keys, vault settings, and administrative permissions.
- Unexpected deletions, failed authentication, and access from unfamiliar locations.
- Alerts that remain unresolved rather than being acknowledged and forgotten.
Send important alerts somewhere an attacker who controls production email or monitoring cannot easily suppress. Keep an independent record of configuration and job history for incident investigation.
Test restores on a schedule
Restore testing is the only dependable way to learn whether a backup meets the recovery requirement. Test in a safe environment so the exercise cannot overwrite production data.
- Select representative recovery points. Include recent data, older versions, and a point from each critical system or data class.
- Restore to an isolated location. Use a clean test account, network, or machine and prevent accidental connections to production.
- Check integrity. Open files, query databases, boot restored images, and verify permissions and application dependencies.
- Measure the result. Record how long discovery, download, restoration, and validation took, including any manual steps.
- Document defects. Capture missing files, broken credentials, unavailable keys, incompatible versions, or undocumented configuration.
- Correct and repeat. Update the backup job or recovery runbook, then perform another restore to confirm the fix.
Test both individual-file recovery and full-system recovery where those are separate procedures. A restored file is not evidence that a complete service can be rebuilt, and a bootable image is not evidence that current business data is present.
Build a recovery runbook before an incident
Write the sequence while systems are healthy. Include contacts, approvals, authentication methods, recovery priorities, and the location of encryption keys and documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
The runbook should state:
- Which systems are restored first and which dependencies they require.
- Who can authorize use of isolated backups and who can approve emergency access.
- How to obtain a clean administrative workstation and prevent reinfection.
- How to identify a known-good recovery point rather than restoring encrypted or corrupted data.
- How to rebuild identity, networking, applications, and configurations.
- How to validate restored data with business owners before returning systems to service.
- How to preserve logs and evidence if ransomware is suspected.
Keep a copy of the runbook offline or in an independently protected repository. If it exists only on the compromised network, it may be unavailable when needed.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Common failure modes and fixes
“The backup is a synchronized folder”
Problem: Deletions and encrypted files propagate to every synchronized destination.
Fix: Add version history, retention, soft delete, or immutable storage, and maintain a separate offline or isolated copy.
“The external drive is always plugged in”
Problem: Ransomware can encrypt or delete the drive through the infected computer.
Fix: Disconnect it after each controlled backup and protect it physically and cryptographically.
“One administrator controls production and backups”
Problem: One stolen credential can destroy both environments.
Fix: Separate accounts or administrative boundaries, apply least privilege, require multifactor authentication, and use approval controls for destructive actions.
“Immutability was locked without review”
Problem: An incorrect retention period can create unexpected cost or prevent legitimate deletion during the lock.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fix: Validate policy, capacity, legal requirements, and restore procedures before locking; remember that the lock may be irreversible during the retention period.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
“Every job succeeds, but recovery fails”
Problem: Jobs may omit files, preserve unusable configurations, or rely on undocumented keys and dependencies.
Fix: Schedule representative restores, validate usability, measure recovery time, and update the runbook after each exercise.
“The only copy is in one building or one region”
Problem: Fire, theft, flooding, account loss, or a regional outage can remove both production and recovery data.
Recommended Free Tools
Fix: Add a geographically or administratively separate copy and test access to it.
A practical implementation checklist
- Inventory critical data, systems, configurations, source materials, executables, licenses, and golden images.
- Define recovery priorities, acceptable restoration times, and retention obligations.
- Create more than one recovery copy when the data’s importance warrants it.
- Ensure at least one copy is offline or isolated from routine production access.
- Encrypt removable and cloud backup data, and protect keys independently.
- Separate backup administration from production administration; grant only required permissions.
- Enable multifactor authentication, monitoring, and alerts for access and configuration changes.
- Configure versioning, soft delete, retention, deletion protection, or immutability based on the service’s documented behavior.
- Review storage growth, retrieval cost, recovery windows, and the consequences of an immutable lock.
- Run scheduled file and full-system restore exercises in a safe environment.
- Record results, correct failures, and keep the recovery runbook and an administrative copy of its instructions independently protected.
How to decide between local, cloud, and hybrid protection
Choose according to the failure you are trying to survive, not simply the storage medium.
| Question | Local offline copy | Cloud copy | Hybrid answer |
|---|---|---|---|
| Could compromised production credentials delete it? | Low while disconnected; high while attached. | Depends on account separation, permissions, and vault controls. | Use separate administration for both paths. |
| How quickly can a common restore finish? | Often quickly on the local network. | Depends on bandwidth, provider retrieval, and region. | Use local data for speed and cloud data for broader disaster coverage. |
| What happens after a site disaster? | The device may be lost with the site unless stored elsewhere. | Remote storage can survive local damage, subject to account and regional availability. | Keep the offline copy in a different secure location and test remote access. |
| How much operational work is required? | More manual connection, rotation, inventory, and testing. | More configuration and ongoing review of service controls and billing. | More components to monitor, but less dependence on one failure mode. |
The right design is the one whose isolation, retention, cost, and restore speed match the data’s consequences and your ability to operate it under stress.
Bottom line
Protect backups as a separate security system, not as another folder on the production network. Keep an encrypted offline or isolated copy, separate the people and credentials that administer it, preserve historical versions with carefully reviewed retention controls, and regularly restore real data in a safe test environment. Those measures address both ransomware and ordinary deletion without relying on a single feature or vendor default.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
