iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not restore from a backup just because it exists. First contain the ransomware incident, investigate whether attackers still have access, and test that the chosen copy and recovery process work in a clean, isolated environment. Then restore from an offline, encrypted backup in the order your critical services require.
What backup verification can—and cannot—tell you
Verification has two separate jobs: establish that a backup is intact and recoverable, and assess whether restoring its contents could bring compromised or malicious material back into the environment. A successful storage integrity check or checksum can show that data matches an expected value; by itself, it does not prove the data predates the compromise or is free of malware.
CISA recommends keeping offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario. Its #StopRansomware Guide does not prescribe one universal scan or checksum that certifies every backup as safe. Use your incident response and recovery plans, and involve qualified incident responders when the environment is critical or managed.
Recommended Free Tools
Contain the incident before testing recovery
- Follow the incident response plan. Isolate impacted systems and coordinate isolation if multiple devices are affected. Use out-of-band communications when appropriate so response coordination does not depend on potentially compromised systems.
- Do not treat restoring as containment. Triage affected systems and check security alerts, endpoint tools, and logs for evidence of additional systems or earlier compromise. Precursor malware or signs of continued access need to be addressed before recovery proceeds.
- Preserve evidence where possible. CISA describes powering down as a fallback when a system cannot be disconnected, because doing so can destroy volatile evidence. Follow the approved response plan or responder guidance rather than improvising a shutdown.
Check the backup copy and the recovery procedure
Use an approved recovery path that is protected from the compromised environment. The following questions turn CISA’s general recommendation to test backup availability, integrity, and procedures into practical checks; they are implementation suggestions, not a prescribed CISA checklist.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Can the intended copy be accessed? Confirm that authorized staff can reach the specific backup version needed without relying on compromised credentials or systems.
- Is it protected from the incident? Confirm that the selected copy is offline or otherwise isolated from affected systems, and encrypted. Backups still reachable from compromised systems may be deleted or encrypted by ransomware.
- Does the backup system report an integrity check? Run the check supported by your backup system and investigate errors. A passing result is useful, but is not proof that the backed-up content is clean.
- Can the recovery procedure restore what the business needs? In an isolated, clean environment, test representative files, applications, and dependencies. Check that restored content is usable and matches expected versions and business requirements.
- Are recovery dependencies available through trusted channels? Confirm access to required credentials, encryption keys, system images, installers, and configuration information.
Regular recovery exercises should test the actual restoration procedure, not just whether a backup job completed. CISA recommends regular testing but does not set one test interval for every organization.
Restore in priority order to a clean environment
Use the incident response plan and business priorities to determine the order: systems that support critical services may need to come first, but their dependencies and the available clean infrastructure matter. CISA advises restoring from offline, encrypted backups according to critical-service priorities and warns against introducing anything but clean systems to a recovery VLAN.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Prepare an isolated recovery environment and verify that its systems are clean before using them.
- Restore the selected backup copy and required dependencies in the sequence established by your recovery plan.
- Check that restored systems and data meet operational and security requirements before proceeding to the next recovery stage.
There is no single restore order that fits every organization; the sequence depends on service priorities, system dependencies, clean infrastructure, and the incident response plan.
Assess systems before reconnecting them
Before returning restored systems to production, have the security and recovery teams assess them under the organization’s plan and confirm that the incident is contained. CISA’s checklist emphasizes avoiding reinfection, but its guide does not define one final scan that can certify every restored system as safe. Document lessons learned and update recovery procedures based on what the exercise or incident revealed.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
If you are recovering a personal device
Disconnect an external backup drive when it is not actively being used; a connected drive can be exposed to ransomware. If a personal device is managed by an employer or school, or the incident affects critical systems, contact the responsible IT or security team before restoring. For an unmanaged personal device, keep the recovery isolated and seek qualified help if you cannot determine whether the device or backup is compromised.
Quick Recap
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
