Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you suspect ransomware, disconnect the affected device from wired, Wi-Fi, and mobile networks, then contact the right technical responders. Don’t reflexively shut it down, wipe it, or restore files: those steps can destroy useful evidence or complicate recovery. For a single home computer, disconnect its network access and keep backup drives unplugged. For an organization, coordinate containment through its incident-response plan.
What to do first
- Isolate affected devices. Unplug Ethernet, turn off Wi-Fi, and disconnect other network links, including mobile connections. If several systems may be affected, an organization’s response lead should coordinate isolation; attackers may move between systems, so shutting down one device at a time may not contain the incident. CISA’s #StopRansomware Guide recommends identifying impacted systems and isolating them immediately. If organizational email or messaging may be compromised, use a separate communication channel, such as phone calls.
- Keep backup media disconnected. Do not plug in external drives or connect other removable storage to a suspected infected device. Keep backups separate until responders can verify how and where to restore them.
- Contact the appropriate help. Home users can use a separate, trusted device to seek reputable technical support. Organizations should activate their incident-response plan and contact internal IT or security staff and relevant external responders.
Should you turn off the computer?
Not automatically. When feasible, disconnecting network access is generally preferable to powering down because shutdown can destroy volatile-memory evidence and other infection artifacts. CISA says to power down if you cannot disconnect the device from the network; the UK National Cyber Security Centre’s guidance for disruptive attacks likewise treats disconnecting versus shutting down as a decision for the response team. If the device cannot be isolated or malicious activity is continuing, get qualified advice promptly and follow your organization’s incident plan where applicable.
Preserve evidence and keep a record
Do not delete ransom notes, suspicious files, logs, or related messages. Avoid improvised fixes such as installing an unverified decryptor, deleting files, or restoring onto an affected system. A decryption tool may not work for the particular ransomware, and using the wrong tool can make matters worse; CISA advises consulting trusted guidance for the variant and law enforcement about possible decryptors.
For an organizational incident, preserve evidence that may disappear quickly, such as memory, Windows Security logs, and firewall log buffers, where possible. Record the incident timeline, affected systems, decisions, actions, and information that could not be captured. Keep those notes somewhere other than a potentially compromised system. The Counter Ransomware Initiative’s organizational guidance highlights careful recordkeeping for reviews, lessons learned, and possible regulatory evidence.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Who should you contact and how do you report it?
Organizations should involve incident leadership, internal IT or security, relevant stakeholders, and their cyber insurer as applicable. Check policy requirements before engaging an outside provider if insurance coverage may apply. For a complex incident, a qualified incident-response provider can help determine the scope of compromise, collect evidence, contain attackers, and plan recovery.
In the United States, CISA identifies its own reporting channels, local FBI field offices, the FBI’s Internet Crime Complaint Center (IC3), and U.S. Secret Service offices as routes for assistance or reporting. The FBI’s ransomware guidance provides reporting information. In the UK, follow the reporting channels identified by the NCSC’s ransomware guidance. Elsewhere, contact your national cyber authority and local law enforcement.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Should you pay the ransom?
Payment does not guarantee that you will recover your files, regain access to devices, or end the compromise. It also does not establish that stolen data will be deleted. The FBI says it does not support paying a ransom; CISA and the UK NCSC also warn that payment cannot guarantee recovery and may encourage further attacks. The Counter Ransomware Initiative advises organizations to assess what data may have been compromised, verify claims about stolen data, and consider possible harms and legal requirements rather than assuming criminals will honor promises.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor an organization, any payment decision belongs with leadership and appropriate technical, legal, insurance, and law-enforcement advisers. The decision may also depend on the organization’s circumstances and applicable law.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How to recover without reintroducing the attacker
- Establish what was affected. Identify impacted systems and accounts, including email, administrator, remote-access, identity, and cloud accounts. Investigate how the attacker got in and look for persistence before reconnecting systems.
- Plan credential changes carefully. Secure or reset exposed credentials in coordination with responders. An unplanned reset can lock people out of accounts or systems needed for recovery.
- Verify the backup and destination. Use offline or otherwise isolated backups and check that they are free of malware. Restore in a clean environment, and do not connect unverified devices to the recovery network. CISA recommends offline, encrypted backups; the UK NCSC advises restoring only when you are confident the backup and receiving device are clean.
- Rebuild, restore, and monitor. Rebuild or wipe infected devices as appropriate, install current software on a clean network, and prioritize critical services when planning the sequence. Monitor systems after reconnection. Recovering files alone does not show that the device or wider environment is secure.
When weighing recovery options, consider whether they preserve evidence and contain the attacker, whether both the restore point and destination are known clean, what effect they will have on critical services and people, and whether the compromise and exposed credentials have been addressed. There is no universal restoration sequence for every incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the next steps differ by situation
One home computer
Disconnect the device from its networks and leave backup drives unplugged. Use a separate trusted device to find reputable technical support rather than downloading tools onto the suspected computer. The UK NCSC’s 2017 WannaCry guidance for home users and small businesses is specific to that outbreak; its advice about disconnecting affected devices and keeping backups detached is useful here only as a general principle consistent with broader guidance.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Small business
Involve the IT provider and insurer as applicable, and use the incident plan if one exists. Keep the ransom note and incident records for investigation and reporting. Do not restore a machine onto a network that may still contain an attacker.
Free tools Windows power users keep installed
One-click scans. No signup required.
Multiple systems or a larger organization
Coordinate containment, evidence preservation, reporting, and service priorities through incident leadership. Use out-of-band communications if organizational channels may be compromised, and involve specialized incident-response support where available. A decision to disconnect or power down a system should account for continuing malicious activity, containment options, and the value of evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
