iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To recover reliably from ransomware, keep at least three copies of critical information on two different types of storage, with at least one copy offline and preferably immutable. Separate backup administration from everyday accounts, retain older versions, and test full restores—not just whether a backup job reports success. A backup is useful only if you can recover clean, complete systems within the time your organization can tolerate.
What makes a backup design resilient to ransomware?
A ransomware-resilient backup is a recoverable copy that an attacker cannot easily encrypt, delete, or alter using access to production systems. It also contains what you need to rebuild and operate—not only user files, but applications, identity systems, configurations, trust infrastructure, and recovery documentation.
The Federal Bureau of Investigation’s 3-2-1 formulation calls for at least three copies of critical data, on two different media types, with one copy offline and immutable. “Offline” means separated from routine network access; “immutable” means retention controls prevent alteration or deletion during a defined period. These protections address a common failure: backups that are continuously reachable from an infected device or compromised administrator account.
Use 3-2-1 as a design baseline, not a guarantee. A copy can exist yet be incomplete, unreadable, too slow to restore, or contaminated by a compromise that began before the backup was made. Isolation, version history, access controls, and successful recovery exercises all matter.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What should you include in the backup plan?
Start by listing the services that must return, what they depend on, and the order in which they can be restored. That inventory prevents a common gap: saving the data while omitting the systems, credentials, or configuration needed to use it.
Inventory and prioritize
List critical services, data stores, applications, identity systems, configurations, and dependencies. Rank them according to safety, revenue, and operational impact. Identify the teams or people who own each item and who can authorize its restoration. The result should make clear what must return first and what can wait.
- Record where production data and its backups live, including cloud resources and systems managed by third parties.
- Document which identity and trust services systems depend on, and what must be rebuilt if those services are compromised.
- Identify network, asset, and application dependencies, plus software installers and licenses needed for a rebuild.
- Note retention requirements and any systems or data that are easy to overlook, such as new cloud resources.
Set recovery targets
Define a recovery-point objective (RPO): how much recent work the business can afford to lose. Define a recovery-time objective (RTO): how long a service can remain unavailable. These targets help determine backup frequency and restore priorities; they are operational choices, not universal numbers.
Free tools Windows power users keep installed
One-click scans. No signup required.
For example, a service that can tolerate losing only a short interval of changes needs backups or protected recovery points more frequently than a system whose data changes infrequently. A service with a strict time-to-recovery requirement also needs a practical way to restore quickly, not merely a retained copy. Measure actual recovery time in exercises and compare it with the target.
How do you set up a 3-2-1 backup step by step?
Build the plan in layers: decide what must be recoverable, choose retention and frequency, create separated copies, protect administration, and prove that restoration works. Adjust it when systems, identities, cloud resources, or retention needs change.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Inventory the recovery scope. List critical data, applications, identity and trust systems, configurations, infrastructure templates, and documentation. Map dependencies and rank services by safety, revenue, and operational impact.
- Choose backup frequency and version history. Set a schedule based on the RPO for each service. Keep historical versions so that a newly encrypted or corrupted file does not replace the only usable copy.
- Create three copies across two media types. Count production data and two backup copies, and make sure the backup copies are not all on the same kind of storage. A local backup can enable faster recovery; a separate offline or immutable copy provides another barrier against compromise.
- Isolate at least one copy. Keep one copy offline and preferably immutable. For a home or small-office setup, an encrypted removable drive can serve as an offline copy if you disconnect it when the backup job finishes. For cloud storage, verify that retention controls are actually enabled and protected.
- Separate backup administration. Use dedicated backup administrator accounts, MFA, and least privilege. Keep at least one copy outside the production account or network boundary, and use protected management devices and deletion controls where available.
- Prepare to rebuild. Back up golden images, infrastructure-as-code or configuration templates, software installers and licenses, plus network and asset documentation. A full image restore may not be safe after compromise, so clean rebuild materials matter.
- Write the recovery plan. Document who can authorize a restore, where clean recovery systems are located, which services come first, and how credentials and trust services will be rebuilt.
- Test and improve. Verify integrity, restore individual files, and run full system or service recovery exercises. Record elapsed recovery time and failures, fix the issues, and update the plan after each exercise or incident.
Which storage design should you choose?
For many home and small-office users, a removable drive is a practical offline copy; larger or more automated environments may use immutable cloud storage. A combined design—local storage for faster restores and a physically separate or cloud copy for isolation—can address both speed and resilience.
| Design | Ransomware isolation | Recovery speed | Recovery-point frequency | Geographic resilience | Administration and testing | Capacity, cost, and dependence |
|---|---|---|---|---|---|---|
| Disconnected external drive | Strong while disconnected; ransomware may reach it while it is connected. Encrypt it and store it securely. | Local access can support restores without downloading from a remote service; actual recovery time depends on the data and hardware. | Depends on how often backup jobs run and the drive is connected; no universal interval is stated in CISA guidance. | Depends on where the drive is stored. A drive kept beside the computer does not provide physical separation from local hazards. | Simple for a small setup, but requires a disciplined connection, backup, disconnection, and rotation routine. File and full-system restores still need testing. | Capacity and cost are not stated by CISA. A single drive can be a single point of failure, so it should not be the only backup copy. |
| Immutable or object-lock cloud storage | Can protect retained objects from alteration or deletion when immutability is correctly configured. Verify account separation, MFA, versioning, and lock state. | Depends on restore throughput and the provider’s recovery process; check both before relying on it for time-sensitive recovery. | Depends on the backup schedule and versioning configuration; no universal interval is stated in the cited guidance. | Can provide geographic separation, but the actual arrangement depends on the service and configuration. | Supports automation and retention controls, while adding account, access, and configuration management. Test restores, not just backup completion. | Capacity, storage pricing, and egress cost are not stated by Microsoft’s cited guidance. Dependence on one cloud account or provider should be considered. |
| Combined local and separate copy | Can pair a fast local copy with an offline, physically separate, or immutable copy. The protection depends on maintaining separation and access controls. | A local copy may support faster recovery; the separate copy offers another recovery path if local storage is compromised. | Set schedules and versioning to meet each service’s RPO; no fixed interval is prescribed by the cited guidance. | Can improve geographic resilience if the second copy is stored away from production; location and provider choices determine the result. | Requires coordinating multiple copies and testing both local and remote restore paths. Document who manages each one. | Capacity and cost are not stated by the cited guidance. It reduces dependence on a single copy, account, or location if configured accordingly. |
When selecting a design, ask whether an attacker who controls a production device or account could also delete the backup, whether a clean restore can meet your recovery target, and whether your team can operate the design under pressure. For cloud storage, check immutability lock state, account separation, MFA, versioning, restore throughput, egress cost, and the provider’s recovery process. Microsoft describes online immutable storage as a way to keep business-critical objects in a WORM (Write Once, Read Many) state; the setting must be configured and verified for your environment.
Is an external hard drive enough?
An external drive can be one useful backup copy, particularly for a home or small office, but a drive left connected is not an offline copy. CISA advises: “Avoid leaving the external drive connected when not actively backing up as the connection could be used by ransomware to gain access to the drive and delete or corrupt your backups.”
Encrypt the drive, label rotation dates, and store it in a physically secure place. Disconnect it after the backup finishes. If you rotate drives, keep track of which copy is current and where it is stored. Do not treat one drive as the entire plan: hardware can fail, and ransomware can reach connected storage. Maintain another independent copy and test restores from the drives you rely on.
Why is cloud sync not the same as a backup?
Synchronization keeps locations aligned; it does not necessarily preserve a clean, independent recovery point. If encrypted local files are synced, the encrypted versions can propagate to the cloud folder. A synchronized folder alone therefore should not be treated as ransomware protection.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
For cloud-based protection, look for version history, isolation from production administration, and immutable retention. Confirm that the retained version predates the compromise and that authorized people can restore it. A cloud copy can add geographic separation, but only if account access, deletion controls, and recovery procedures are part of the plan.
How do you protect backups from administrator compromise?
Backups need their own access boundary. If everyday or production administrator credentials can modify or erase every copy, an attacker who steals those credentials may be able to target the backups too.
- Use separate accounts for backup administration rather than everyday accounts.
- Require MFA and grant only the permissions needed for each role.
- Use protected management devices for sensitive backup administration.
- Keep at least one copy outside the production account or network boundary.
- Use deletion controls or object-lock retention where available, and verify that the controls are active.
- Document how to secure backup administration and rotate compromised credentials during recovery.
These measures reduce the chance that one compromised account or network segment can reach every recovery copy. They do not remove the need to verify restore points: choose and scan a point that predates the compromise before putting restored systems back into service.
How do you test whether a backup will restore?
A successful backup-job notification proves that a job ran; it does not prove that the data is complete, readable, or recoverable within your target time. The FBI, Microsoft, and NIST all emphasize testing recovery, with NIST SP 1339 published June 17, 2026.
- Verify integrity. Check that backup data is readable and that the expected files or systems are present.
- Restore individual files. Choose representative files and restore them to a safe location. Confirm that they open and contain the expected data.
- Exercise a full recovery. Restore a system or service in a clean recovery environment. Include dependencies, configurations, applications, and identity or trust components needed to operate it.
- Measure elapsed time. Record how long recovery takes, including the work needed to prepare clean infrastructure and validate the service. Compare the result with your RTO.
- Record failures and remediate. Note missing data, inaccessible accounts, slow transfers, unclear instructions, or other blockers. Assign owners and correct them.
- Repeat after change. Revisit the plan when new systems, identity changes, cloud resources, or retention requirements alter what must be restored.
A useful exercise tests both the data and the human process: who has authority, who can reach the clean recovery environment, and whether the runbook works without relying on compromised systems. Test the offline or immutable copy too; the easiest copy to access is not necessarily the one you will need during an incident.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
What should you do during ransomware recovery?
Do not reconnect affected systems simply to begin restoring them. Isolate the incident, identify a known-clean point, rebuild in a clean environment, and restore services in priority and dependency order.
- Isolate affected systems. Separate affected endpoints, servers, accounts, and network segments. Avoid reconnecting them merely to start restoration.
- Preserve evidence and determine scope. Keep relevant evidence and establish the intrusion timeline and systems involved.
- Secure access. Revoke or rotate compromised credentials and secure backup administration before using recovery copies.
- Select and validate a restore point. Choose a point in time that predates the compromise. Scan it and confirm it is complete and readable.
- Rebuild clean infrastructure. Reimage or rebuild systems as needed, including identity and trust services when they were affected. A full image restore may not be safe in every situation.
- Restore priority services first. Work in a segmented recovery environment, follow the documented service and dependency order, and monitor telemetry for signs of reinfection.
- Restore remaining systems and update the plan. Continue in dependency order, document lessons learned, and adjust controls, backup coverage, or procedures as needed.
How often should you back up, and how long should you retain copies?
There is no single schedule or retention period that fits every system. Set backup frequency from the amount of recent change the business can tolerate losing, and set retention to preserve enough history to recover a point before encryption or corruption is discovered.
Define the requirements service by service, then confirm the configured schedule and retention actually meet them. Review those settings when data changes, cloud resources are added, or regulatory and operational retention requirements change. The cited guidance does not prescribe a universal number of days or a universal backup interval.
Frequently Asked Questions
Can a network-attached storage device count as an offline backup?
Not while it remains reachable over the network: that leaves it exposed to attacks that can reach network-accessible storage. Treat it as a backup copy, but add a separate offline or immutable copy and test its recovery path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should I keep backups in the same cloud account as production?
At least one copy should be outside the production account or network boundary, so a compromise of production access does not automatically expose every copy. The cited guidance does not prescribe a particular provider or account architecture.
Is there a standard ransomware recovery success rate for backups?
CISA’s reviewed guidance provides no universal recovery success rate or broadly applicable performance statistic. The meaningful measure for a specific environment is whether its tested restore works and how long it takes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
