PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Usually, no. U.S. government guidance discourages paying a ransomware demand because payment does not guarantee a working decryptor, full recovery, deletion of stolen data, or an end to the attack. It can also create sanctions and other legal risk. Treat payment as a last-resort decision considered only after containment, evidence preservation, recovery analysis, reporting, and a jurisdiction-specific legal review.
If systems are actively encrypted or data is being extorted, do not negotiate or transfer funds before qualified incident responders and counsel assess the incident. Isolate affected systems, protect clean backups, notify the FBI and/or CISA in the United States, and determine what can be restored without trusting the attacker.
What happens if you pay ransomware?
Payment is a transaction with a criminal actor, not a guaranteed recovery service. The attacker may provide no decryptor, provide one that fails or damages files, demand additional money, or continue using stolen credentials and access. If data was copied before encryption, payment also does not force the attacker to keep it private or delete every copy.
Free tools Windows power users keep installed
One-click scans. No signup required.
The 2025 #StopRansomware Guide, Part 2: Ransomware and Data Extortion Response Checklist states: “The authoring organizations do not recommend paying ransom.” The FBI’s ransomware guidance similarly emphasizes that payment does not guarantee recovery. No general, comparable statistic establishes how often payment produces successful recovery, so a percentage-based promise is not credible.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Payment can sustain criminal operations and may signal that an organization will pay again. It can also complicate investigations, accounting, insurance claims, and communications with customers or regulators. These risks remain even when a deadline, threatened publication, or apparent “proof” of decryption creates pressure.
Why a ransom payment cannot solve the whole incident
Decryption is uncertain
Attackers can lose keys, operate unreliable tooling, or intentionally send a partial decryptor. A decryptor may restore some files while leaving databases, virtual machines, cloud data, or backups unusable. It may also take so long to run that the organization still has to rebuild critical services.
Access and persistence may remain
Encryption is often one stage of a longer intrusion. An attacker may have created accounts, stolen credentials, installed remote-access tools, or left scheduled tasks behind. Paying does not remove those footholds. Responders must identify and eliminate persistence, reset credentials, patch exploited systems, and monitor for renewed activity.
Stolen data creates a separate problem
Modern ransomware incidents may involve copying personal, financial, health, legal, or proprietary information before encryption. A payment cannot be verified as a complete deletion, and the criminal can still publish, sell, or use the data. Breach analysis, notification decisions, and affected-person communications therefore continue even if files are decrypted.
The same criminal or another group may return
There is no enforceable service-level agreement with an extortionist. A payment may be shared among affiliates or brokers, and another actor may exploit the same unpatched weakness. Treat the incident as a compromise of the environment, not merely a locked-file problem.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What to do immediately—before discussing payment
Use your incident-response plan and an established escalation path. If you do not have one, document decisions and bring in qualified incident-response and digital-forensics specialists immediately.
- Declare and coordinate the incident. Assign an incident lead, legal contact, technical lead, communications owner, and executive decision-maker. Preserve notes, ransom messages, timestamps, logs, and contacts. Do not wipe or reimage systems before responders advise how to preserve evidence.
- Isolate affected systems. Disconnect compromised computers, servers, storage, and network segments from wired and wireless networks. CISA’s checklist says to determine which systems were impacted and isolate them; when many systems appear affected, taking the network offline at the switch level may be appropriate. Do not power off systems blindly if responders need volatile evidence, but stop the spread as quickly as safely possible.
- Protect identity and remote access. Disable known compromised accounts, revoke active sessions and tokens, rotate privileged credentials from a clean device, and suspend unnecessary remote-access paths. Coordinate these actions with responders so you do not destroy useful evidence or lock out recovery administrators.
- Contact authorities. In the United States, report promptly to the FBI and/or CISA. The FBI ransomware factsheet encourages victims to contact a local FBI field office. Reporting can support attribution, warnings to other victims, recovery assistance, and legal analysis, whether or not payment is being considered.
- Engage qualified responders and counsel. Use specialists who can scope the intrusion, identify exfiltration, validate backups, and build a clean recovery plan. Counsel experienced in cyber incidents and sanctions should direct legal communications and evaluate notification duties.
- Preserve the demand and payment instructions. Keep the original note, wallet address, email headers, chat logs, screenshots, file samples, and any “proof” archive. Do not click links or run attacker-provided programs on production systems.
Can you recover files without paying?
Often, the safest path is restoration from clean backups or reconstruction of affected services. Recovery must be controlled: restoring an infected backup or reconnecting a compromised administrator can reinfect otherwise clean systems.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Offline and protected backups
CISA recommends offline, encrypted backups and restoration testing. An external hard drive for offline backups can be one medium, but it should not remain connected when it is not actively being used. Keep backup credentials separate, restrict administrative access, and maintain multiple recovery points so an attacker cannot encrypt every copy.
Prioritized restoration
Restore the services that protect life, safety, revenue, and essential operations first. Build a clean recovery network, verify operating systems and applications, apply security updates, reset credentials, and scan backup sets before bringing systems back into production. Record which data is missing or stale so business owners can make informed workarounds.
Reconstruction and alternate operations
Some organizations can rebuild servers from trusted images, restore databases from replicas, recreate cloud workloads, or operate temporarily with manual procedures. These options may take longer than a proposed decryptor but provide greater confidence that the environment is clean and that the attacker no longer controls it.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How to compare recovery paths
| Decision factor | Questions to ask | Why it matters |
|---|---|---|
| Time to restore | Which option returns critical services first, and what dependencies must be rebuilt? | A fast-looking option can fail if identity, networking, or databases remain compromised. |
| Cleanliness | Can responders verify that systems and backups contain no malware or persistence? | Recovery that leaves an attacker inside can lead to renewed encryption. |
| Data completeness | How recent and complete are backups, replicas, and reconstructed records? | Compare the actual data gap, not just the number of systems restored. |
| Exfiltration exposure | What information was copied, and can it be contained or replaced? | Decryption does not undo disclosure risk. |
| Legal and sanctions risk | Would a proposed transfer involve a sanctioned party, intermediary, wallet, or jurisdiction? | A payment can create liability even when operations are under severe pressure. |
| Cost and operational impact | What are the costs of downtime, rebuilding, investigation, notification, and lost data? | Use a documented total-impact comparison rather than treating the demand as the only cost. |
The official guidance establishes these risks and practices but does not provide a universal ranking. Your responders and business owners must compare the options using facts from the specific incident.
Legal and sanctions considerations
In the United States, the Treasury Department’s Office of Foreign Assets Control (OFAC) issued an Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments on September 21, 2021. It warns that U.S. persons and businesses that make or facilitate payments can face sanctions risk when the recipient is sanctioned or a transaction otherwise has a sanctions nexus. The advisory discusses mitigation and prompt reporting as relevant factors, but it is explanatory and has no force of law by itself.
That does not mean every ransomware payment is automatically prohibited, and an apparently unsanctioned recipient is not automatically safe. Sanctions lists, payment routes, intermediaries, wallet ownership, counterparties, and applicable laws can change. A transaction may involve more than the victim and the extortionist, including a negotiator, exchange, insurer, bank, or cryptocurrency service.
For an actual incident, ask counsel to evaluate:
- the victim’s country, entity type, and connection to the United States;
- the payer, recipient, wallet, intermediary, and any known affiliates;
- current sanctions lists and any nexus created by the payment route;
- reporting obligations to law enforcement, regulators, customers, or business partners;
- data-protection and breach-notification duties for the information accessed or stolen;
- contractual deadlines and cyber-insurance conditions; and
- recordkeeping needed to show due diligence and incident mitigation.
Do not rely on an old sanctions check, an attacker’s claim about identity, or a negotiator’s assurance that a transfer is lawful. Obtain a current, documented legal opinion before any proposed transfer.
Reporting, privacy, and communications
Report whether or not payment is contemplated. Early reporting can help investigators connect infrastructure and victims, while a delayed report can reduce available evidence. Follow the reporting instructions from the FBI, CISA, and any regulator that has jurisdiction over your organization.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Separate confirmed facts from assumptions. Tell employees which systems are unavailable, how to report suspicious messages, and where approved updates will appear. Coordinate customer, partner, and media notices with counsel. If sensitive data may have been accessed, preserve evidence needed to determine whose information was involved and when.
Do not promise that payment will prevent publication, that all data was deleted, or that the attacker has left. Those statements cannot be verified merely from a decryptor or a criminal’s message.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When an organization is still considering payment
A payment discussion should occur only inside a documented incident process, not through an employee acting alone. The decision team should first record what has been contained, what evidence has been preserved, what backups and rebuild options exist, what data may have been stolen, and what authorities and counsel advise.
- Verify the legal path first. Obtain a current sanctions and jurisdiction review before negotiating a transfer.
- Model the no-payment path. Estimate restoration time, critical-service priorities, data loss, notification work, and security improvements required for a clean rebuild.
- Assume payment can fail. Keep the recovery program running; do not stop backup validation, rebuilding, or credential resets because a criminal promises a key.
- Limit exposure. Never provide additional credentials, personal data, or unrestricted network access to prove that a decryptor works.
- Document the rationale. Record who approved actions, what advice was received, what checks were performed, and how funds and evidence were handled.
These controls cannot turn payment into a reliable recovery service. They reduce avoidable harm while the organization evaluates an exceptionally risky option.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to prepare so payment is less likely to be considered
Preparation does not guarantee prevention, but it changes the decision from an emergency guess to a tested recovery process.
- Maintain offline, encrypted backups and test restoration on a schedule.
- Keep at least one backup copy disconnected from normal administrative credentials and networks.
- Define recovery priorities, maximum tolerable downtime, and acceptable data loss for each critical service.
- Document isolation, communications, evidence-preservation, law-enforcement, and executive-approval procedures.
- Use multifactor authentication, least privilege, timely patching, network segmentation, and monitored remote access.
- Prearrange contacts for incident response, legal advice, communications, and relevant regulators.
- Review cyber-insurance terms before an incident, including notice requirements, approved vendors, exclusions, and payment-related conditions.
Practice a ransomware exercise that includes unavailable backups, possible data theft, a sanctions check, and a communications deadline. The exercise should test whether the people who must act can reach clean systems and make decisions without using the compromised environment.
Bottom line for a live incident
Isolate first, preserve evidence, call qualified responders and authorities, validate clean recovery options, and obtain sanctions and jurisdiction-specific legal advice. U.S. federal guidance discourages paying because payment may fail to restore operations, may not protect stolen data, and can create additional legal and criminal-financing risks. A carefully documented recovery plan is the dependable path; a ransom transfer is not.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
