PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start by isolating affected devices, then check for a decryptor that matches the ransomware, restore from a known-clean backup or unaffected cloud version, and report the incident. Recovery is not guaranteed: decryptors exist for some variants, but if there is no working decryptor or clean copy, the available guidance does not support promising that encrypted files can be recovered.
What recovery options are available?
Choose a route based on what happened to the files and what clean copies exist. A ransomware decryptor reverses encryption only when it supports the specific variant; backups and cloud history restore copies from before encryption. Deleted-file recovery is a different process and does not decrypt files.
| Recovery route | When it may help | Key limitation |
|---|---|---|
| Matched decryptor | A reputable tool specifically supports the ransomware variant. | Tools are available for some variants, not all. |
| Backup | A clean copy from before the attack is available. | Backups that were connected or accessible during the attack may have been encrypted or deleted. |
| Cloud version recovery | The service retained an unaffected earlier version. | Available versions depend on the account and its stored history. |
| Deleted-file recovery | Files were deleted from local storage and may still be recoverable. | It does not decrypt ransomware-encrypted files. |
What should you do first?
Contain the incident
Disconnect affected computers from Wi-Fi and wired networks when feasible. If multiple devices or network segments appear affected, an organization may need to take the network offline at the switch level. Organizations should follow their incident response plan, identify critical systems, review logs, and preserve relevant evidence. Encryption may be accompanied by data theft, so restoring files alone may not resolve the incident. CISA’s StopRansomware guide was revised October 19, 2023.
Recommended Free Tools
Keep the evidence
Retain the ransom note and record the encrypted file extensions and other incident details. Do not delete encrypted files or assume the extension alone identifies the ransomware. These details can help a qualified responder or a decryptor service identify what happened.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How can you check for a decryptor?
-
Use No More Ransom’s Crypto Sheriff to check whether a solution is known. It accepts encrypted file samples up to 1 MB and information from the ransom note. Submitting a sample shares it with the service under its stated terms; do not upload material that could expose sensitive contents unless you have assessed that risk or consulted a responder.
-
If you identify the ransomware, look in the decryption tools directory for a tool that explicitly covers it, and follow that tool’s instructions. Do not try a tool merely because its name resembles the file extension or ransom note. No More Ransom explains that decryption can be possible in some cases, including when malware authors made an implementation mistake, but it does not promise a tool for every variant.
Rank #2
Sale
WD 5TB My Passport, Portable External Hard Drive, Black, backup software with defense against ransomware, and password protection, USB 3.1/USB 3.0 compatible - WDBPKJ0050BBK-WESN- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How should you restore files from backups or cloud history?
Restore from a clean backup
After the malware has been removed and the incident contained, restore from a known-clean backup in a clean recovery environment. Prioritize critical systems and data. CISA recommends offline encrypted backups and regular testing: ransomware may locate and delete or encrypt backups that remain accessible. Cloud sync alone is not proof of an independent, clean backup.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check OneDrive recovery
For OneDrive, follow Microsoft’s instructions for detecting ransomware and recovering files. Microsoft’s process includes cleaning affected devices before restoring files, to reduce the risk of immediate re-encryption. Check the current instructions and the versions available in the account.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Is Windows File Recovery a ransomware decryptor?
No. Windows File Recovery is intended to recover deleted files from local storage, not decrypt files that ransomware has encrypted. Microsoft advises minimizing use of the computer when trying to recover deleted data. If deleted-file recovery may matter, avoid installing recovery software onto the affected drive, as writing new data can reduce the chance of recovering deleted files.
Should you pay, and what if recovery is not possible?
The FBI says it does not support paying a ransom and warns that payment does not guarantee that victims will get their data back. CISA also advises consulting law enforcement about possible decryptors. If no working, matched decryptor or clean, unaffected copy exists, the available guidance does not establish a reliable way to recover the files. Preserve the encrypted files, ransom note, and incident details for qualified analysis rather than treating a payment as a guaranteed recovery method.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
If attackers also stole data, file restoration does not address the separate risk that the data could be disclosed or used for further extortion. The No More Ransom Q&A discusses ransomware recovery; CISA’s guide covers incident response and recovery considerations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How do you report the attack or get response help?
In the United States, the FBI says victims can contact their local field office or report through IC3. CISA advises consulting federal law enforcement about possible decryptors. Organizations should consider a qualified incident responder to help with containment, evidence preservation, restoration planning, and assessing possible data exfiltration. See the FBI ransomware guidance and CISA’s response guidance.
How can you make future recovery more reliable?
Keep offline encrypted backups and test that they can be restored, following CISA’s backup guidance. A backup that is disconnected except while backing up is less exposed to ransomware running on a connected computer; backup testing helps establish whether the copies are usable when needed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
