What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If ransomware has encrypted your files, first disconnect the affected device from networks, preserve the ransom note and encrypted files, and avoid experimenting with recovery tools. After the incident is contained and the system is cleaned or rebuilt, a verified clean backup is usually the most dependable recovery route. For business or multi-device incidents, get professional incident-response help before restoring data.
What to do first: contain the attack
Disconnect the affected computer from Wi-Fi and unplug its Ethernet cable. If attached or shared storage can be disconnected without interacting with suspicious prompts, isolate it too. Do not connect other devices or backup media to the affected system.
If several business systems or network segments are affected, ask IT or an incident-response professional to coordinate isolation; taking a network offline may be necessary. Use a phone or another device you believe is clean for response communications. CISA’s #StopRansomware Guide recommends coordinated isolation and out-of-band communication in organizational incidents.
Do not power off the computer as an automatic first step. CISA warns that shutting down can erase volatile-memory evidence, and advises doing so only when network disconnection is not possible. In a business or legally sensitive incident, ask a responder how to preserve evidence before changing the system’s state.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Preserve evidence and record what happened
Keep the ransom note, encrypted files, and any new file extensions or ransom instructions. Do not delete the note, rename files, or run cleanup utilities as a first reaction. Record when you noticed the attack, which devices and shared storage appear affected, and any contact details or deadlines in the note.
Organizations may need relevant logs, malware samples, indicators, system images, or memory captures. These can be difficult to collect safely; do not improvise on the only copy of important data. Ask an incident responder to preserve them. CISA’s guide includes evidence collection and preservation among its response steps.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Report the incident and get help when needed
Organizations should follow their incident response plan and contact appropriate authorities or CISA. Individuals in the United States can report to their local FBI field office or through the Internet Crime Complaint Center (IC3). If you are elsewhere, contact the relevant national cybercrime reporting authority.
Bring in an incident-response professional before attempting restoration if the attack affects a business, multiple devices, sensitive information, or systems you cannot confidently assess. Data theft may accompany encryption, so restoring files alone may not address exposure or notification obligations. CISA describes technical assistance and evidence analysis for organizations on request.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choose a recovery route based on what you know
| Option | When it may fit | Key caution |
|---|---|---|
| Restore a clean backup | A backup from before the attack exists and can be verified as clean. | Restore only after containment and remediation, using a clean system or network. |
| Variant-specific decryptor | The ransomware family is confidently identified and a trusted decryptor is known to apply. | Decryptors are not universal; an incorrect or untrusted tool can add risk. |
| Professional response | The incident is complex, affects business-critical systems, involves sensitive data, or evidence handling is uncertain. | Coordinate evidence preservation and restoration with the responder. |
| Pay the ransom | Payment is not a dependable recovery method. | The FBI does not support paying; payment does not guarantee usable files will be returned. |
Start with a clean backup
Look for a backup made before the attack and verify its integrity where possible. CISA recommends offline, encrypted backups that are tested regularly. Do not reconnect backup media to an affected device just to check it. First contain the incident, then make sure the destination system and recovery environment are clean so the restored files are not exposed to the same malware.
Consider a decryptor only for the identified variant
Some researchers or authorities may release decryptors for particular ransomware variants, for example when a flaw makes decryption possible. Ask law enforcement or a qualified responder whether a trusted tool exists for the identified variant. The available official guidance does not establish a general-purpose decryptor, and a tool that merely claims to work is not proof that it is legitimate or suitable.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Do not treat payment as a guarantee
The FBI says, “The FBI does not support paying a ransom in response to a ransomware attack.” It also warns that paying does not guarantee that victims will receive their data back. Report the incident rather than relying on a promised key or returned files.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRestore in a controlled order
- Confirm containment. Keep affected devices and storage isolated while the incident is assessed.
- Clean or rebuild the recovery environment. Do not restore onto a system that may still be compromised. For an organization, recover on a clean network and coordinate with IT or the incident responder.
- Prioritize critical services and files. Organizations should restore the systems needed to provide essential services first; home users should avoid reconnecting other devices or backup media until the affected system is assessed.
- Restore from a verified clean backup, if available. Keep the encrypted originals and incident notes until a qualified responder confirms they are no longer needed.
- Check the restored environment before normal use. Confirm that recovery completed and that systems remain clean before reconnecting them to shared storage or broader networks.
Why experimenting can make recovery harder
- Deleting notes or encrypted files can remove useful clues for identifying the ransomware or locating a matching decryptor.
- Shutting down without a reasoned plan may destroy volatile-memory evidence that a responder could use.
- Plugging backup media into an affected device can expose the backup to the incident before the system is contained.
- Restoring before remediation can put recovered files back into an environment where malware remains.
- Downloading an unverified decryptor risks adding another problem and may not work for the particular variant.
For the recovery sequence and organizational guidance, see CISA’s #StopRansomware Guide, revised October 19, 2023, and the FBI’s ransomware guidance.
Quick Recap
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
