Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The safest ransomware recovery is a controlled sequence: isolate affected systems, determine whether the compromise is still active, identify backups that attackers could not alter, rank services by business impact, restore into a clean environment, and verify every system before reconnecting it. A completed backup job is not proof that the copy is recoverable; only a protected backup that passes a restore test can support a recovery decision.
This guide follows the recovery practices in CISA’s joint #StopRansomware Guide, updated in May 2023, and adapts them for a business team that must make decisions under pressure. Recovery can return availability without proving that no data was viewed or copied, so treat restoration and data-exposure investigation as separate workstreams.
What ransomware recovery actually involves
Ransomware recovery is more than copying files back to a server. You must answer four different questions:
- Containment: Are infected or compromised systems still able to reach other hosts, storage, or backup repositories?
- Scope: Which endpoints, servers, cloud resources, accounts, and data stores were affected, and when did the intrusion begin?
- Recoverability: Which backup copies are both complete and protected from the attacker’s access, deletion, or encryption?
- Safe restoration: Can you rebuild and reconnect services without reintroducing the malware?
Do not treat a visible backup catalog, a successful nightly job, or a recent snapshot as sufficient evidence. Ransomware often attempts to locate and destroy accessible backups. A copy that exists but was writable from a compromised account may be unusable.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Availability is only one outcome. During recovery, preserve evidence and investigate possible unauthorized access separately. Restoring a database does not establish that its records were never exfiltrated.
First priority: contain the incident
Isolate affected systems
Use your incident-response authority to identify and isolate every confirmed or suspected affected system. Disconnect endpoints and servers from production networks when practical, and prevent communication between infected segments. If several systems or subnets appear affected, taking the network offline at the switch level may be appropriate while the team determines the scope.
Isolation should include backup infrastructure, administration workstations, virtualization management, and other systems that hold privileged credentials. Do not reconnect a machine merely because its files have been encrypted rather than deleted; the underlying compromise may still be active.
Protect cloud evidence
For cloud resources, take volume snapshots for later forensic review when your response plan and provider controls allow it. Preserve the original snapshot and restrict access to a small investigation group. A snapshot is evidence first, not automatically a clean recovery source.
Record decisions and preserve evidence
Start an incident timeline that records observed symptoms, isolation actions, snapshot identifiers, backup locations, and the people authorizing each change. Avoid wiping or rebuilding systems before the team has captured the evidence needed to understand how the attacker entered and whether other systems were involved.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Determine whether the compromise is still active
Review detection and prevention tools
Before restoring anything, examine alerts, endpoint detections, identity logs, firewall records, email-security events, and other available telemetry for signs of earlier stages of the attack. CISA warns that a ransomware event can follow an unresolved compromise. If you restore while an attacker still has access, the newly restored system can be encrypted again.
Map the affected environment
Create a system-by-system inventory with the hostname or cloud identifier, owner, function, network segment, data held, observed symptoms, and current isolation state. Include dependencies such as directory services, DNS, time services, authentication, storage, virtualization, line-of-business applications, and external connections. Mark uncertainty explicitly rather than assuming an unreported system is clean.
Set a recovery decision point
Define who can declare the environment ready for restoration. That decision should require an agreed scope assessment, evidence review, and a documented plan for monitoring restored systems. If the team cannot establish that a system is clean, rebuild it from a known-good image instead of placing the old installation back on the network.
Set restoration order by business criticality
Use a predefined critical-asset list, updated for the current incident, to decide what comes back first. CISA’s criteria include health and safety, revenue generation, and other critical services and their dependencies. The most visible application is not always the first dependency to restore; an application may require identity, networking, storage, or database services before it can operate.
Example restoration tiers
| Tier | What belongs here | Recovery decision |
|---|---|---|
| 1 — Safety and essential operations | Systems whose loss could affect health, safety, legally required operations, or emergency functions. | Restore first, after the clean environment and foundational dependencies are ready. |
| 2 — Revenue-critical services | Core systems that accept orders, deliver contracted services, process transactions, or support customers. | Restore immediately after Tier 1 and its prerequisites. |
| 3 — Business dependencies | Identity, DNS, storage, virtualization, databases, network services, and management systems required by higher tiers. | Restore in dependency order, even when the service is not customer-facing. |
| 4 — Lower-priority functions | Internal tools, archives, development systems, and convenience services that do not block critical operations. | Restore after critical services are stable and verified. |
Document the reason for each priority, the owner who accepts the risk, and the dependency that must be available first. This prevents the recovery team from selecting systems solely by backup age or by whichever administrator is available.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Decide whether a backup is safe to use
Check protection, not just existence
Prefer copies that were offline or otherwise isolated from production credentials and systems, encrypted, and protected against unauthorized deletion or overwrite. The relevant question is whether ransomware could reach the backup at the time of the attack. A repository mounted continuously to production should receive more scrutiny than a copy disconnected between backup operations.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRecord for each candidate copy:
- Its creation time and the period of business activity it contains.
- Where it is stored and which accounts or systems could write to it.
- Whether the storage was offline or isolated when the incident occurred.
- Whether encryption keys and access controls remain available to the recovery team.
- Whether a previous restore test demonstrated that the data and required metadata are usable.
Test a copy in isolation
Do not perform the first restore directly into production. Stage a representative copy in a controlled recovery network, inspect the restored operating system and applications, and look for unexpected executables, scheduled tasks, accounts, or configuration changes. A successful file copy proves only that bytes could be read; it does not prove that the system is clean or that the application can use the data.
Understand removable-drive limits
An external hard drive for offline backups can be part of a sound design when it is encrypted, large enough for the required data, compatible with the backup software, and disconnected when it is not actively being used. CISA specifically advises not leaving an external drive connected between backup operations because ransomware could then access, delete, or corrupt it. A removable drive is therefore one component of an offline strategy, not a complete recovery plan. Test that the drive can actually be read and restored before an emergency.
Prepare a clean recovery environment
Use a recovery VLAN or equivalent isolation
Restore into a clean recovery VLAN or another controlled network that is separated from infected production segments. Limit routes and administrative access to what the restoration team needs. Keep systems there until they pass security and functional checks; do not use a temporary network as a reason to skip investigation.
Rebuild from golden images
Maintain regularly updated golden images for critical systems. Use them to rebuild operating systems and standard configurations rather than restoring a potentially compromised installation. Keep the images themselves protected from production credentials and test that they boot and can receive required updates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Preserve all recovery materials
Recovery may require more than user data. Keep offline copies, where appropriate, of infrastructure-as-code templates, source code or executables, configuration exports, software installers, and license agreements. Without these materials, a database backup may be intact but the application that reads it may not be reproducible.
Restore business data step by step
- Assign the recovery authority. Name the incident lead, technical restoration lead, business owners for each critical service, and the person authorized to reconnect systems. Keep a written change log.
- Select the candidate backup set. Choose the latest copy that meets the protection and integrity checks. If the newest copy is suspicious, select an older known-good set and document the resulting data gap.
- Build the isolated foundation. Deploy clean golden images and establish only the necessary network, identity, storage, and monitoring services inside the recovery environment.
- Restore foundational dependencies. Bring up services in dependency order, such as authentication, name resolution, storage, virtualization, and databases, before dependent applications.
- Restore a representative sample. Recover a small but meaningful set of files, records, and application components first. Confirm that permissions, timestamps, relationships, and required metadata are preserved.
- Inspect the restored systems. Apply current security updates where the rebuild process permits, review startup items and scheduled tasks, and use available detection tools to check for signs of compromise.
- Restore the prioritized data set. Proceed through the critical-asset list, recording what was restored, from which copy, by whom, and with what result. Keep the original backup read-only whenever possible.
- Run business validation. Have each service owner test representative workflows, not merely whether a process starts. Check that users can access the right data, transactions behave correctly, and integrations reach only approved endpoints.
- Reconnect in controlled stages. Move one service or dependency group at a time from the recovery network toward production. Monitor authentication, network, endpoint, and application telemetry after every stage.
Verify integrity before reconnecting systems
Verification has both a technical and a business part. Technically, compare restored files or records with the backup catalog and available integrity information, confirm that databases complete consistency checks, and ensure that applications can read their required data. Investigate missing objects, unexpected changes, broken permissions, and unexplained differences instead of silently accepting them.
Business owners should verify the records and workflows that matter to their operations: recent orders, customer cases, financial entries, production schedules, or other representative transactions. Ask owners to sign off on what was tested and what remains unavailable. A system can be technically healthy while still missing a critical data set.
Keep restored systems under heightened monitoring during the staged reconnection. A new alert, unexplained outbound connection, or reappearance of encryption activity is a reason to isolate the system again and reassess the recovery source.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen no backup can be trusted
If every accessible copy was altered, deleted, or exposed to the attacker, stop treating the backup catalog as a recovery guarantee. Preserve the affected media and cloud snapshots for forensic work, identify any genuinely isolated copies, and determine what can be rebuilt from golden images and other offline recovery materials.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Incident-recovery services, managed backup services, or disaster-recovery support may help with specialist capacity, but evaluate them by operational evidence rather than a promise of instant recovery. Ask how they isolate backups from production credentials, protect against deletion or overwrite, test restores, cover system images and dependencies, and support restoration in a clean environment. Confirm the provider’s scope, access controls, retention terms, and ability to work with your incident investigators before granting access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Design backups for the next incident
Protect copies from production compromise
Maintain offline, encrypted backups of critical data and separate them from ordinary production administration. Apply deletion and overwrite protections where the technology supports them, and limit who can change retention or encryption settings. Keep the access path to backup administration out of the same compromised environment you are trying to recover.
Test restoration, not just backup jobs
Schedule restore exercises that cover files, databases, complete systems, and the dependencies needed to operate them. Measure how long each exercise takes, what staff and licenses it requires, and which steps fail. Update the critical-asset list and recovery order when the business or its dependencies change.
Recommended Free Tools
Maintain rebuild artifacts
Keep current golden images and protected copies of infrastructure-as-code templates, source code or executables, configuration, and license agreements. Test that these materials are available without relying on the production identity system that may be unavailable during an incident.
Use removable media deliberately
If you use an external hard drive for offline backups, encrypt it, label its contents and creation date, verify capacity, and define who may connect it. Disconnect it immediately after the backup or restore operation. Rotate and test multiple copies so one failed device does not become the only recovery path.
Compare recovery approaches with practical criteria
| Approach | Questions to ask | Common limitation |
|---|---|---|
| Offline removable media | Is it encrypted, disconnected between operations, large enough, compatible, and regularly restore-tested? | Manual handling, device failure, and incomplete coverage of systems or dependencies. |
| Isolated backup repository | Can production credentials reach it? Are deletion, overwrite, and retention controls protected? Are restores exercised? | It may still be compromised if administrative access or network paths are shared. |
| Cloud or volume snapshots | Were snapshots taken before compromise, protected from the attacker, and preserved for forensic review? | A snapshot can preserve an infected state or be deleted if controls are not isolated. |
| Managed backup or disaster-recovery service | Does the service provide isolation, encryption, tested restores, clean-environment recovery, and clear incident access procedures? | Service scope, credentials, retention, and recovery times vary; verify them contractually and technically. |
| Golden-image rebuild | Are images current, clean, available offline, and accompanied by software, configuration, and license artifacts? | Images rebuild systems but do not replace the business data that must be restored separately. |
Common recovery mistakes and corrections
- Restoring immediately after encryption: Correct it by isolating systems and reviewing logs and detections first.
- Assuming the newest backup is best: Correct it by checking whether the copy was reachable or altered during the intrusion, then use the newest protected copy that passes testing.
- Restoring directly into production: Correct it by using a clean recovery VLAN or equivalent controlled environment.
- Bringing applications back before dependencies: Correct it by mapping and restoring identity, storage, databases, and network services in dependency order.
- Leaving a backup drive attached: Correct it by disconnecting removable media whenever it is not actively being used.
- Checking only whether files exist: Correct it by having technical and business owners validate integrity, permissions, workflows, and representative transactions.
- Rebuilding without required artifacts: Correct it by keeping golden images, infrastructure-as-code, software, configuration, source or executables, and licenses available offline.
- Ending the incident at the first successful login: Correct it by monitoring staged reconnection and documenting unresolved data or exposure questions.
Close the incident and improve the plan
After services are stable, document what happened, which backups were usable, what data was lost or delayed, how long each restoration stage took, and which controls failed. Update response plans, critical-asset lists, dependency maps, backup retention, access controls, and restore procedures based on those findings.
Where appropriate, share relevant indicators of compromise and lessons with CISA or your sector’s information sharing and analysis center. Sharing should follow your legal, privacy, and contractual requirements, but timely indicators can help other organizations identify related activity.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
