PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Disconnect affected devices from networks, protect any backups that are still safe, and get the right technical help before attempting cleanup. Do not assume the ransom note shows the full extent of the breach, that rebooting will fix it, or that paying will restore your files.
What to do first: contain the incident
- Isolate affected devices. Disconnect them from Wi-Fi and unplug Ethernet cables. Do not connect backup drives or other removable storage to an affected device. If several business systems are involved, the IT or security lead may need to isolate a network segment or take the network offline; avoid making broad changes without someone who understands the organization’s critical systems.
- Alert the person responsible for the response. At a business, contact the IT/security lead or incident-response lead and follow the organization’s response plan. A home user without technical support should seek a reputable, independently verified technician or incident-response professional.
- Keep a basic incident record. Note when the attack was discovered, which devices or services appear affected, what the ransom note says, suspicious messages, and actions already taken. Preserve the note and related messages; do not delete files or make promises about recovery.
Should you turn off or restart the computer?
There is no universal shutdown instruction for every ransomware incident. A restart or shutdown may affect evidence that a specialist could need, while leaving a device connected may let an attacker continue communicating or spreading. Isolate it from networks first, then ask your IT/security lead or incident responder whether to leave it powered on or shut it down. Do not rely on rebooting as a way to remove the attacker.
Work out what may be affected—and preserve evidence
Treat the ransom note as an initial clue, not a complete account of the incident. Ransomware may follow an earlier compromise, and the affected scope can include accounts, cloud services, servers, or devices that do not yet show encrypted files. CISA’s joint #StopRansomware Guide, revised October 19, 2023, recommends assessing affected systems, reviewing logs and security detections, and identifying data and services that may have been exposed.
For a small business
Have the response lead and technical team identify affected and apparently unaffected systems, accounts, services, and dependencies. Triage first by health and safety, essential operations, revenue, and the services needed to restore other systems. Do not reconnect a device merely because it appears unaffected; establish that it is safe to use as part of the investigation and recovery plan.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For an individual
Record which devices and accounts show symptoms, such as encrypted files, a ransom note, or unusual account activity. If other devices share the same network or accounts, tell the technician or responder rather than assuming they are safe. Avoid signing in to sensitive accounts from a device that may be compromised until you have advice on a safe device and next steps.
Preserve what could help an investigation
Where technically feasible, preserve relevant logs and system images; specialists may also capture volatile evidence such as system memory. CISA’s forensic guidance advises preserving this evidence before remediation when possible. Evidence collection can require technical expertise, so do not delay containment or attempt complex collection yourself if doing so could worsen the incident. Keep affected devices isolated while the response team decides what to capture and how.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Report the attack and coordinate the response
In the United States, CISA’s guide identifies CISA, a local FBI field office, FBI IC3, and a local U.S. Secret Service field office as reporting or assistance options. Use each agency’s current official contact information when reporting. Reporting promptly can help authorities assess the incident and advise about assistance, including whether a decryptor may be available for the specific ransomware variant.
For a business
Activate the incident plan and coordinate the people who need to make decisions: IT/security, leadership, legal counsel, insurance contacts, and communications staff, as appropriate. Determine whether personal information or regulated data may be involved. Notification duties depend on the facts, jurisdiction, industry, and applicable law; seek jurisdiction-specific legal advice rather than assuming a single deadline applies to every business.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For a home user
Keep records of reports and case or incident numbers, and share them with your technical helper as appropriate. If the attack affects an employer, school, or service provider, notify its security or support contact through a separate, trusted device or channel.
Decide about ransom payment carefully
CISA, the FBI, and NSA strongly discourage paying a ransom. Payment can encourage further criminal activity and does not guarantee that attackers will provide a working decryption key, return data, or stop using stolen information. If you are considering payment, report the incident and consult law enforcement, legal counsel, and—in a business—relevant insurance and leadership contacts before taking action. Do not treat payment as a recovery plan.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Can you get your files back?
Possibly, but recovery depends on the ransomware variant, the condition of available backups, and whether systems and accounts can be restored safely. Do not assume a tool exists for your case. CISA advises asking federal law enforcement about decryptors that researchers may have released. A tool should be considered only when an official source confirms it is appropriate for the exact variant; a name in a ransom note alone is not enough to identify a safe or compatible decryptor.
Restore systems from a verified clean source
- Set recovery priorities. Identify essential services and the systems they depend on, then plan the order of restoration. A business should base priorities on safety and operational needs, not simply on which files are easiest to recover.
- Establish a clean recovery environment. Rebuild or prepare clean systems and a recovery network. Keep affected systems isolated, and do not add systems to the recovery environment until the response team believes they are clean.
- Verify the backup before restoring. Use a protected backup that has been checked for integrity and is believed not to contain the compromise. CISA recommends offline, encrypted backups and regular tests of backup integrity and restoration. A backup that is connected to the compromised environment or has not been tested may not be a dependable recovery source.
- Restore in planned stages. Bring back critical services in order, checking each stage before reconnecting it to other systems or the wider network. Keep a record of what was restored and any unusual activity that appears during recovery.
- Reset affected credentials and review access. Once systems are clean, follow incident-specific advice to reset compromised or potentially exposed credentials and review account access. For organizations, use least privilege and strengthen access controls as appropriate to the incident and identity provider.
If there is no verified backup, avoid repeatedly trying unverified recovery utilities or making changes that could destroy evidence. Ask a qualified incident-response or digital-forensics professional to assess available recovery options. CISA describes federal assistance and forensic support; that does not endorse a commercial provider. If hiring a provider, independently verify its incident-response experience, forensic preservation practices, scope, and cost.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Reduce the chance of a repeat incident
After recovery, document how the incident happened, what delayed response or restoration, and what worked. Update the response plan and test it. Review backup access so an infected device or compromised account cannot readily encrypt or delete every backup, and schedule restoration tests rather than relying only on a successful backup job.
- Keep critical backups encrypted and offline or otherwise separated from systems and accounts that could be compromised.
- Test that backups are intact and that the organization or household can restore from them.
- Review account access and permissions after recovery, including access that is no longer needed.
- Update incident contacts and response steps based on what the incident revealed.
This guidance is U.S.-centered. The CISA/MS-ISAC joint guide is aimed primarily at organizations, so individual users may need a trusted technician to apply its evidence, network, and restoration procedures safely. Reporting routes and legal notification rules differ by country and can change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
