iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not start by restoring files. Ransomware recovery begins with containment: isolate affected devices, determine how far the intrusion spread, preserve evidence, and activate your incident-response plan. Only after you have a clean recovery environment and a verified backup should you restore critical services. Reconnect systems in a controlled sequence so the attacker’s access or malware cannot encrypt the replacement data.
This approach follows the CISA-led #StopRansomware Guide and NIST recovery guidance. A decryptor may exist for a particular ransomware variant, but neither agency promises one for every incident. Independent recovery from clean backups is the safer path when it is available.
What safe ransomware recovery involves
Ransomware can deny access to files, applications, servers, and sometimes entire networks. Some incidents also involve data theft, credential theft, or destructive activity, so “getting the files back” is only one part of recovery. A safe process must achieve five things:
- Stop the malware and the attacker’s access from spreading.
- Identify affected systems, accounts, data, and dependencies.
- Preserve logs and other evidence before routine cleanup destroys them.
- Restore prioritized services from a known-clean recovery point.
- Reconnect systems only after they have been checked and hardened.
CISA’s joint guide, updated in September 2023, summarizes the restoration principle this way: “Reconnect systems and restore data from offline, encrypted backups based on a prioritization of critical services.” Read the full guidance at CISA’s #StopRansomware Guide. NIST’s SP 1800-11 focuses on data integrity and recovery from ransomware and other destructive events.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Do not assume that paying produces a complete or safe recovery. Payment-versus-independent-recovery is a dilemma whose legal, financial, and operational consequences depend on the facts and jurisdiction. The official guidance used here does not make a universal recommendation to pay or not pay. It does establish a safer technical sequence: contain, investigate, choose a clean recovery point, restore, and verify.
First response: isolate before you restore
The first minutes determine whether one encrypted workstation becomes a network-wide outage. Use your approved incident-response plan if you have one. If you do not, use the following order while contacting qualified incident responders.
1. Isolate the affected devices
- Disconnect visibly affected computers, servers, and storage appliances from Ethernet and Wi-Fi. Physical disconnection is often faster than trying to identify every malicious process.
- If several systems, VLANs, or subnets are involved, take the affected network segments offline at the switch level. CISA notes that broad isolation may be necessary when multiple systems appear compromised.
- Disable compromised remote-access paths, such as VPN accounts or remote-management sessions, according to your response plan. Avoid making broad account changes that erase useful evidence unless containment requires it.
- Do not reconnect a device merely to see whether it still works. A system that looks normal may retain an active attacker session or a scheduled encryption task.
For a home computer, unplug the network cable or turn off Wi-Fi and Bluetooth, then leave the device powered as directed by a qualified responder. For a business, isolate first and coordinate changes through the incident lead so one team does not accidentally reconnect a system another team has quarantined.
Recommended Free Tools
2. Protect backups and unaffected systems
Immediately separate backup repositories, removable media, and administrative workstations from the affected network. Do not mount an offline backup on a suspected machine to “check” it. Preserve the original backup and use a disposable or newly rebuilt system for examination. If your backup platform has immutable or offline copies, prevent ordinary administrator accounts from altering or deleting them.
3. Avoid destructive cleanup
Do not reformat disks, delete ransom notes, run an unverified “decryptor,” or restore over the original evidence before you know what happened. Those actions can destroy volatile artifacts and make it harder to determine whether the attacker still has access. If a life-safety issue requires immediate shutdown, follow your emergency procedures and record who made the decision and when.
Establish the incident scope and restoration priorities
Recovery is not a race to bring devices back in arbitrary order. CISA recommends prioritizing critical services and their dependencies on a clean network. Start with a written inventory and mark uncertainty explicitly.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Build an affected-system inventory
- List encrypted, unavailable, suspicious, and apparently unaffected endpoints, servers, virtual machines, cloud resources, and network appliances.
- Record hostnames, IP addresses, owners, business functions, operating systems, and the last known-good time.
- Identify which accounts, administrator credentials, service accounts, and remote-access tools were active during the suspected intrusion.
- Note the file extensions, ransom-note text, timestamps, and any malware or campaign name shown by security tools. These clues can help responders identify a variant, but a note’s claimed identity is not proof.
- Map dependencies: identity services, DNS, DHCP, databases, storage, line-of-business applications, communications, and backup infrastructure.
Rank services, not just computers
A service may require several systems to function. For example, restoring an application server before its identity provider, database, or storage can create a misleading “recovered” status. Make a priority list that considers:
- Health and safety: systems whose outage could endanger people or interrupt essential care.
- Revenue and essential operations: order processing, production, payment, customer support, and other functions that keep the organization operating.
- Dependencies: authentication, networking, databases, storage, configuration management, and monitoring needed by higher-priority services.
- Data sensitivity and legal duties: systems containing regulated or personal information may require additional containment and notification work.
- Recovery feasibility: the availability and integrity of a clean backup, replacement hardware, and tested restoration instructions.
Write the order down. The list is a control against pressure to restore the loudest user’s laptop first while a foundational service remains compromised.
Preserve evidence while investigating the scope
Ransomware response is also an investigation. CISA specifically warns that system memory and security logs can be volatile. Preserve them before they roll over or disappear.
Capture and retain what is practical
- Preserve relevant security, authentication, VPN, endpoint, firewall, cloud, and backup logs.
- Where feasible, obtain forensic images and memory captures from representative affected systems before rebuilding them.
- Export ransom notes, file samples, alert details, and timestamps without opening suspicious attachments or executing unknown files.
- Keep a chain-of-custody record: who collected each item, when, from which system, with what tool, and where the original is stored.
- Use a separate, access-controlled location for preserved evidence. Do not store the only copy on a system connected to the incident network.
Review security-tool telemetry for signs that the compromise began earlier than the first encrypted files. Look for unusual administrator logins, newly created accounts, remote-management activity, mass file renames, disabled security controls, and backup deletion attempts. The objective is to define the earliest trustworthy recovery point, not to prove a theory before restoration.
Bring in specialists when the stakes justify it
Digital forensics and incident-response professionals can help preserve evidence, identify persistence, and determine whether data was copied before encryption. Their work is especially important when regulated data, critical infrastructure, safety systems, or legal proceedings are involved. Select providers through your organization’s established vendor process; no service can guarantee decryption or complete recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
Report the incident and coordinate communications
Use your incident, legal, and communications plans rather than improvising public statements. CISA advises considering reports and assistance from:
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
- CISA
- Your local FBI field office
- The FBI Internet Crime Complaint Center (IC3)
- A local U.S. Secret Service field office
Those channels can help with intelligence, coordination, and possible decryptor information. Follow breach-notification and sector-specific requirements that apply to your location and the data involved. Do not promise customers, employees, or partners that files are safe until the investigation supports that conclusion. Keep an incident timeline and designate one person to approve external communications.
Check whether a decryptor exists, without relying on one
Provide law enforcement or a qualified responder with the ransomware note, file-extension examples, and other non-sensitive indicators. CISA recommends consulting federal law enforcement about a decryptor for the specific variant. Availability is not guaranteed, and a tool advertised for a similar name may be incompatible or malicious.
Before using any decryptor:
- Verify its provenance with law enforcement or a trusted security authority.
- Test it on copies of encrypted files in an isolated environment.
- Preserve the originals and document the tool version, settings, and results.
- Confirm that the tool does not require connecting the affected system to the internet or to the compromised network.
A decryptor, if one exists, does not remove the intrusion. You still need to eradicate attacker access, rebuild systems as appropriate, and validate the recovered data.
Compare recovery paths using the same safety criteria
Choose the path that best protects data integrity and prevents reinfection. The following comparison uses the criteria emphasized by CISA and NIST.
| Recovery path | When it is appropriate | Advantages | Risks and checks |
|---|---|---|---|
| Offline, encrypted backup | A backup predates the compromise and can be verified as clean and complete. | Independent of the attacker’s encryption and usually the most controllable option. | The backup may contain corrupted or already encrypted data. Validate its version, integrity, and scope before production use. |
| Immutable or otherwise protected backup copy | Retention controls prevented ordinary accounts from changing the copy. | Better resistance to deletion or tampering during the incident. | Immutability does not prove that the content is malware-free. Scan and test restoration in isolation. |
| Verified decryptor | Law enforcement or a trusted responder confirms it matches the variant. | May recover data when no usable backup exists. | It may fail, recover only some files, or leave the compromise in place. Work on copies and keep originals. |
| Rebuild and restore selectively | Systems are untrusted or backups are incomplete. | Removes hidden persistence instead of returning a compromised operating system to service. | Slower and dependent on installation media, configuration records, and clean credentials. |
| Recovery from a cloud or provider copy | The provider retains a separate, versioned copy that was not exposed to the incident. | Can restore capacity without using the affected local infrastructure. | Confirm the copy’s date, access controls, exportability, and data integrity; a synchronized encrypted copy is not a clean backup. |
For every option, ask five questions: Can the data be verified as clean and uncorrupted? Is the recovery environment sufficiently separate? Which service and dependency comes first? How will you prevent reinfection? Will the process preserve evidence needed for the investigation?
Prepare a clean recovery environment
Restore outside the compromised trust boundary. Depending on the incident, this may be a newly provisioned network, rebuilt servers, isolated virtual infrastructure, or a clean cloud tenancy. The exact design depends on your organization, but the controls are consistent:
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
- Use known-good installation media and current security updates.
- Change credentials from a clean administrative workstation, especially privileged and service-account passwords suspected of exposure.
- Apply least privilege and multi-factor authentication where supported.
- Restrict outbound and inbound network access to what restoration requires.
- Install endpoint protection, logging, time synchronization, and centralized monitoring before exposing restored services.
- Keep the recovery network separated from infected systems until responders approve a connection.
Do not treat a recently purchased external drive as a magic decryption device. An external drive bought after the attack cannot decrypt existing files; its useful role is maintaining a separate offline backup before an incident. CISA’s recommendation concerns the backup practice—offline and encrypted copies—not a particular brand or model.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRestore from a verified backup: an ordered procedure
- Select the recovery point. Identify the most recent backup that predates the intrusion and has no signs of corruption or unauthorized modification. NIST’s guidance emphasizes selecting the correct backup version and ensuring it is free of corrupted data.
- Verify the backup catalog and scope. Confirm that required databases, application data, configurations, keys, and user files are present. Check retention metadata, checksums or platform integrity results, and the backup’s encryption and access controls.
- Test on an isolated system. Restore a representative sample to the clean recovery environment. Open files, start applications, inspect database consistency, and check that timestamps and permissions are usable. A successful copy operation is not proof that an application is recoverable.
- Rebuild foundational services first. Restore the minimum clean identity, networking, storage, and management services needed to support the priority application. Avoid importing unknown scripts, scheduled tasks, or administrator profiles from an infected system.
- Restore the highest-priority service and its dependencies. Follow the documented order rather than restoring every server simultaneously. Keep each restored service isolated until its operating system, applications, credentials, and logs have been checked.
- Validate data and functionality. Have the service owner verify representative records, recent transactions, file permissions, integrations, and business workflows. Record what was tested and what remains unavailable.
- Enable monitoring before connection. Confirm that authentication, endpoint, firewall, backup, and application logs are flowing to a protected location. Set alerts for unusual encryption activity, privilege escalation, mass file changes, and unexpected remote access.
- Reconnect in stages. Add one dependency group at a time, beginning with the priority service. Watch telemetry and user reports after each connection. Stop and isolate again if suspicious activity returns.
- Preserve the original evidence and encrypted data. Do not overwrite affected disks or delete encrypted copies until legal, investigative, and business stakeholders agree that retention is no longer required.
NIST recommends planning and regularly testing backup and restoration procedures; a backup that has never been restored is an assumption, not a recovery capability. See NIST’s ransomware preparation tips for the testing principle and operational safeguards.
What to do when no clean backup is available
Do not immediately conclude that payment is the only option. First, preserve the encrypted originals and investigate all independent copies:
- Older offline media stored outside the affected network.
- Versioned snapshots that the attacker could not alter.
- Application exports, archival systems, paper records, or partner-held copies.
- Cloud storage versions that predate the intrusion and were not synchronized after encryption.
- Law-enforcement or trusted-responder decryptor information for the identified variant.
Reconstruct the most critical services from clean software and whatever trustworthy data exists. Mark gaps clearly so users do not mistake a partial rebuild for complete recovery. If payment is being considered, obtain legal advice, check sanctions and reporting obligations in the relevant jurisdictions, and understand that payment may not produce a working key or prevent data publication. The official guidance cited here does not establish a universal legal or financial answer.
Common recovery mistakes and how to correct them
| Mistake | Why it causes harm | Safer correction |
|---|---|---|
| Restoring while infected devices remain online | The attacker or malware can encrypt the restored data again. | Isolate first and use a clean recovery environment. |
| Trusting the newest backup automatically | The newest copy may contain encrypted, corrupted, or attacker-modified data. | Compare versions, establish a pre-incident date, and test a sample. |
| Rebuilding without preserving logs | Volatile evidence may be lost, obscuring scope and notification decisions. | Capture and retain relevant logs, images, and memory where feasible. |
| Restoring devices in user-request order | Applications fail when identity, databases, storage, or networking dependencies are missing. | Prioritize critical services and map dependencies. |
| Using an unverified decryptor | It may be ineffective, malicious, or destructive. | Confirm provenance and test only on copies in isolation. |
| Assuming restored files prove the incident is over | Persistence or stolen credentials can allow a second compromise. | Reset exposed credentials, monitor, and reconnect in stages. |
| Deleting encrypted files immediately | They may be needed for forensics, future decryptors, or validation. | Retain them under controlled access until the retention decision is documented. |
Guidance for home users and small organizations
Home computer
Disconnect the computer from all networks, avoid plugging the affected disk into another personal computer, and photograph or save the ransom note without opening unknown attachments. Contact your operating-system or security provider and, where appropriate, local law enforcement. Check backups that were physically disconnected before the incident. Restore only after the device has been securely rebuilt or professionally assessed; copying files back to the same compromised installation can reintroduce malware.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Small business
Name an incident lead, a technical lead, and a communications or legal contact. Isolate endpoints and shared storage, protect backup media, document affected services, and establish a clean administrative workstation. Prioritize the systems that support safety, revenue, identity, and customer commitments. If internal expertise is limited, engage incident-response and backup specialists while retaining control of credentials and evidence. Report through the channels recommended by CISA and meet applicable notification deadlines.
After restoration: make the next recovery easier
Close the incident with a documented review rather than simply declaring systems online. Record the initial access path if known, systems affected, decisions made, evidence preserved, restoration points used, validation results, downtime, and unresolved risks. Update the incident-response plan and exercise it with the people who will actually perform the work.
For ongoing resilience:
- Maintain multiple backup copies, including offline and encrypted copies, with access controls separate from ordinary administrator accounts.
- Test restoration on a schedule and after major infrastructure changes. Include applications, databases, configurations, permissions, and dependencies—not just file copying.
- Define recovery priorities, owners, and acceptable data-loss windows for each critical service.
- Keep current network diagrams, asset inventories, software installation media, license records, configuration exports, and emergency contacts.
- Monitor backup jobs and alert on unexpected deletion, retention changes, mass file modifications, and disabled security controls.
- Train users and administrators to report suspicious encryption, credential prompts, and remote-access activity quickly.
NIST’s ransomware publication index, updated June 11, 2026, lists IR 8374 Rev. 1 as final and SP 800-61 Rev. 3, released April 3, 2025, among its ransomware protection and response publications. The dates describe the publications, not a ransomware recovery success rate or average recovery time. See the index at NIST’s ransomware protection and response publications page.
Quick Recap
Ransomware recovery checklist
- Isolate affected devices and, when necessary, affected network segments.
- Separate backup repositories and clean administrative systems from the incident.
- Inventory affected systems, accounts, data, and dependencies.
- Preserve volatile logs, memory, images, ransom notes, and timelines where feasible.
- Report and coordinate with CISA, the FBI, IC3, the Secret Service, legal counsel, and required regulators as appropriate.
- Ask trusted authorities whether a decryptor exists for the specific variant; do not assume one is available.
- Select a pre-incident backup and verify that it is clean, complete, and uncorrupted.
- Build or designate a clean recovery environment.
- Restore critical services and dependencies in documented priority order.
- Validate data, applications, credentials, monitoring, and business workflows.
- Reconnect in stages and watch for reinfection.
- Document lessons learned and test the revised recovery plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
