iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use several recoverable copies, including at least one copy ransomware cannot reach from production systems. Keep an encrypted offline or separately controlled copy, apply object lock or deletion protection where appropriate, restrict backup administration with least privilege and phishing-resistant MFA, monitor destructive actions, and regularly prove that clean systems can be restored. The 3-2-1 rule is a useful foundation, but it is not isolation by itself.
Why ransomware attacks backups
Ransomware does not need to encrypt every original file if it can destroy the recovery path. Malware or an intruder who obtains an administrator, cloud, service-account, or backup-console credential may delete backup sets, encrypt a mapped backup share, revoke access, alter retention settings, or remove the keys needed to decrypt data. A backup that is online, permanently mounted, synchronized, or administered with the same credentials as production can therefore be exposed to the same incident.
The U.S. Department of Health and Human Services Office for Civil Rights warned in its October 2022 cybersecurity newsletter: “Because some malware, including some ransomware variants, are known to delete or otherwise disrupt online backups, regulated entities should consider maintaining at least some of their backups offline and unavailable from their networks.” That advice is aimed at healthcare organizations, but the technical risk applies to any environment in which an attacker can reach the backup system.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesProtection is a combination of copy design, isolation, access control, monitoring, and recovery practice. No single product setting makes every copy safe.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Start with recovery priorities, not storage products
Before choosing media or cloud features, decide what must be recovered and in what order. A useful inventory includes:
- Business data, databases, file shares, email, and records.
- Applications, virtual machines, containers, and operating-system images.
- Network, identity, security, and device configurations.
- Licenses, encryption keys, certificates, scripts, and other recovery dependencies.
- Dependencies such as DNS, directory services, hypervisors, storage, and external providers.
For each important service, set a recovery time objective (how quickly it must return) and a recovery point objective (how much recent data loss is acceptable). These are business decisions, not promises made by a backup vendor. A system that must be restored in hours may need a local, rapidly accessible copy as well as a slower isolated copy for resilience.
Keep an emergency asset list, recovery procedures, and essential contact details somewhere that does not depend on the normal identity provider, file share, or collaboration system. If those systems are compromised, responders still need to know what to restore and how to access the recovery environment.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBuild a copy strategy that an attacker cannot erase in one action
Use 3-2-1 as a starting point
HHS OCR reproduces CISA’s 3-2-1 strategy: maintain three copies of data (one primary and two backups), on two different media types, with at least one backup copy offsite. The numbers are a planning rule, not an outcome statistic or a guarantee of ransomware isolation.
Three copies can still share one cloud account, one administrator, one encryption key, or one network path. Two media types can both be online and writable. An offsite copy can remain remotely manageable by the same compromised credentials. Add an explicit isolation requirement to the rule: at least one copy must be unreachable, or deletion-resistant, from ordinary production credentials.
Separate fast recovery from disaster recovery
A local snapshot or continuously replicated repository can provide rapid recovery from an accidental deletion or hardware failure. It should not be the only copy, because ransomware may reach it through the same network or administrative plane. Pair fast local recovery with an offline, isolated, or enforced-immutable copy that survives a compromise of production.
Account for keys, software, and hardware
Encrypted backups are useful only if authorized responders can obtain the keys. Protect key backups separately, document who can release them, and ensure that restoring the data does not require a server or license that no longer exists. CISA guidance discusses offline encrypted backups, golden images, retaining hardware where necessary, and using more than one cloud arrangement; these choices must be balanced against operational complexity and vendor lock-in.
Recommended Free Tools
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Keep at least one copy offline or separately controlled
Offline removable media
An external hard drive or other removable medium can provide a practical offline copy for a household or small organization. Disconnect it after the backup completes, store it separately from the computer, and protect it from theft, fire, moisture, and unauthorized access. It provides remote-deletion resistance only while it is disconnected and controlled independently.
A drive that remains attached, a mapped network share, or a synchronized folder is not offline. Malware running with the user’s or system’s permissions may be able to encrypt or delete its contents. Rotate more than one removable device when possible so that a recent copy and an older known-good copy are not exposed at the same time.
Isolated network or account
When offline operation is impractical, place the repository in a separately administered account, tenant, network segment, or security boundary. Block ordinary production systems from writing to it except during a controlled backup window. Use separate credentials for backup software and storage administration; do not reuse a domain administrator account for both production and backup control.
Isolation is meaningful only if the emergency account, management interface, and recovery network are also protected. An attacker who compromises the identity provider or a cloud account with unrestricted rights may still reach a technically separate repository.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use immutable retention and delete protection carefully
Cloud and storage platforms may offer object lock, immutable retention, write-once-read-many behavior, snapshots, legal holds, or delete protection. These controls can prevent an administrator or application from deleting objects before a defined retention period expires. Check the exact behavior of the service you use; features and limits differ by provider and edition.
Document the answers to these questions before enabling a lock:
- Who can create, shorten, suspend, or bypass a retention policy?
- Can an attacker delete the storage account, container, project, or subscription?
- Can an administrator revoke encryption keys or disable logging?
- Are retention settings versioned and independently auditable?
- What happens when retention expires, and can accidental deletion be recovered?
- Do regulatory, privacy, or contractual rules limit how long data may be retained?
CISA recommends delete protection or object lock for applicable cloud resources, while warning that immutable storage can create compliance limitations and significant cost when misconfigured. Test retention in a nonproduction account, calculate storage growth, and make policy changes require a separate approval path.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Lock down backup identities and control planes
A backup repository is only as protected as the accounts that can administer it. Apply least privilege to backup consoles, cloud projects, service accounts, storage keys, and recovery environments. A process that only writes new backup objects should not also be able to delete old ones or change retention.
- Use phishing-resistant multi-factor authentication for backup administrators, cloud administrators, VPN access, email, and other accounts that reach critical systems.
- Use separate administration accounts rather than everyday email or workstation accounts.
- Prefer short-lived, narrowly scoped credentials and rotate long-lived secrets.
- Require an independent approval or break-glass procedure for retention changes, repository deletion, key revocation, and bulk exports.
- Restrict management interfaces by network, device posture, and administrative time window.
- Keep emergency credentials offline or in a protected vault, and test that they work without relying on a compromised directory.
Backups should also be protected from the workstation used to manage them. A compromised administrator laptop can defeat otherwise strong storage settings.
Log and alert on actions that precede backup destruction
Collect audit events from the backup application, storage platform, identity provider, and key-management service. Retain logs outside the account or system that generated them so an attacker cannot erase the evidence with the backups.
Alert on events such as:
- Mass deletion, unusual deletion volume, or deletion outside a maintenance window.
- Retention-policy, object-lock, snapshot, or lifecycle changes.
- New administrators, disabled MFA, new access keys, or changes to service accounts.
- Large restoration, export, or download activity.
- Backup jobs suddenly failing, shrinking, running from a new host, or producing unusual data volumes.
- Encryption-key disablement, rotation outside policy, or failed authorization attempts.
Define who receives each alert and what action they take. An alert without an on-call owner is not a recovery control. CISA’s LockBit advisory and broader ransomware guidance emphasize monitoring administrative activity and protecting critical accounts.
Verify that recovery works and that the data is clean
A completed backup job proves that a process ran; it does not prove that the files are complete, uncorrupted, decryptable, or restorable after an identity-system outage. NIST guidance calls for conducting, maintaining, and testing backups, while HHS OCR advises periodic test restorations and regular review of backup logs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run representative restoration tests
- Select representative files, databases, applications, and system images, including at least one large and one recently changed item.
- Restore them into an isolated test environment rather than overwriting production.
- Verify checksums, application consistency, permissions, timestamps, and database integrity.
- Start the restored service and test dependencies such as authentication, DNS, network access, and certificates.
- Record elapsed time, staff actions, missing prerequisites, and the exact recovery point used.
- Fix the defects and repeat the test until the documented recovery time and data-loss objectives are realistic.
Test the failure of normal access
Include scenarios in which the domain controller, cloud identity provider, VPN, management workstation, or primary network is unavailable. Confirm that responders can reach the isolated copy, obtain keys, boot a golden image, and follow instructions without using compromised credentials.
Integrate backups with change management
After major application, network, or operational-technology changes, update the backup scope and recovery procedure. NIST’s 2026 operational-technology update calls for regular backups, testing, integration with change management, and review during recovery exercises. Industrial environments may require additional safety and downtime controls before restoring a controller or workstation.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Compare protection approaches by the risks they address
| Approach | Protection against remote deletion | Restore characteristics | Main trade-offs |
|---|---|---|---|
| Attached local backup | Low if production credentials or malware can write to it | Usually fast for large restores | Simple and inexpensive, but shares local attack paths |
| Disconnected removable media | High while physically disconnected and separately stored | Slower; depends on available hardware and manual handling | Requires rotation, labeling, secure storage, and periodic readability checks |
| Separate network or cloud account | Medium to high, depending on credential and management-plane separation | Can be fast if bandwidth and capacity are sufficient | Requires identity, networking, logging, and account-governance discipline |
| Immutable object lock or retention | High for objects during enforced retention; not necessarily for the whole account or keys | Often convenient, but restore speed varies by service and data volume | Retention mistakes, compliance conflicts, and unexpected storage charges are possible |
| Snapshots or replication | Variable; an attacker may alter or delete reachable snapshots | Often fast for recent points | Useful for availability, but should not be the only ransomware-resistant copy |
Evaluate every design by attacker reachability, type of isolation, restore speed, volume capacity, integrity verification, operational workload, cost, retention and compliance limits, and concentration in one vendor or account. There is no universal ranking because the right balance depends on data volume, recovery objectives, staffing, connectivity, and applicable rules.
Common mistakes and how to correct them
“We have three copies, so we are safe.”
Check whether all three copies use the same credentials, network, cloud account, and encryption keys. Add an offline or independently administered copy and test deletion controls.
“The backup drive is connected for convenience.”
Disconnect it after the job, rotate media, and verify that at least one older copy remains untouched while a new copy is being created.
“The cloud provider makes it immutable.”
Confirm who can change retention, delete the account, revoke keys, or bypass a lock. Enable independent audit logs and perform a controlled deletion test before relying on the feature.
“The dashboard says every job succeeded.”
Restore files and complete systems, check integrity, and measure the full process. Investigate small backup sizes, skipped objects, repeated warnings, and sudden changes in job duration.
“The administrator account has MFA.”
Use phishing-resistant MFA and separate privileged accounts. Review service accounts, API keys, recovery codes, and break-glass paths, which may otherwise bypass the normal administrator’s protection.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →“We can restore once the incident is over.”
Practice while normal identity, network, and collaboration services are unavailable. Keep recovery instructions, keys, hardware requirements, and contacts accessible through an independent path.
A practical implementation sequence
- Inventory critical data, systems, configurations, dependencies, and encryption keys.
- Assign recovery order, recovery-time objectives, and recovery-point objectives.
- Map every existing copy, its location, media, credentials, retention, and deletion path.
- Design for at least three copies, two media types, and one offsite copy, then add explicit offline or immutable isolation.
- Create separate backup and storage administration identities with phishing-resistant MFA and least privilege.
- Enable object lock, snapshots, or delete protection only after documenting retention, bypass, compliance, and cost behavior.
- Disconnect or isolate one copy and protect its physical location, network, account, and keys.
- Send audit logs to an independently protected destination and alert on destructive or policy-changing actions.
- Restore representative data in an isolated environment; verify integrity, dependencies, and recovery time.
- Repeat tests after major changes and include backup recovery in incident-response and operational-technology exercises.
What to do when ransomware is suspected
- Isolate affected endpoints and servers according to the incident-response plan; avoid spreading the malware through shared drives.
- Do not connect offline media or log in to the recovery repository from a potentially compromised workstation.
- Preserve logs and evidence, and suspend suspicious accounts or keys through a controlled process.
- Determine which recovery points predate the compromise and scan or validate them before restoration.
- Restore into a clean, isolated environment first, then rebuild identity, security controls, and dependencies before reconnecting production.
- Document what was restored, what data may be missing, and which credentials, keys, and retention policies must be replaced.
Healthcare covered entities and business associates should align these steps with HIPAA obligations and applicable HHS guidance. Other organizations should apply their own contractual, privacy, records-retention, and breach-notification requirements; the technical principles do not by themselves establish a universal legal rule.
Quick Recap
Final checklist
- At least one current copy cannot be reached from ordinary production credentials.
- Offline media is actually disconnected and stored securely.
- Cloud or network retention cannot be silently shortened by one compromised administrator.
- Backup, storage, key-management, and identity logs are retained independently.
- Phishing-resistant MFA protects privileged and recovery accounts.
- Restoration has been tested with clean systems, realistic dependencies, and unavailable normal access.
- Recovery instructions, keys, hardware, and contacts remain available during an identity or network outage.
- Copies, retention, and recovery procedures are reviewed after significant changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
