iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
After a ransomware incident, follow your incident-response plan, coordinate communications, isolate affected systems, determine the blast radius and critical dependencies, notify the right people, preserve evidence, and restore only verified backups in a clean environment. Do not treat this checklist as a substitute for your organization’s response plan, qualified incident responders, legal counsel, or regulator-specific advice.
The order matters. Isolation limits continued encryption and unauthorized access; disciplined triage prevents you from restoring a compromised system; and documented decisions support legal, insurance, operational, and technical follow-up.
What to do in the first hour
Use the first hour to stop additional damage and establish a controlled response. Avoid ad-hoc fixes that destroy evidence or spread the compromise.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Activate the incident-response and communications plans. Name an incident lead, technical lead, communications owner, executive decision-maker, and scribe. Move sensitive coordination to an out-of-band channel such as phone calls if attackers may be monitoring email, chat, or shared drives.
- Isolate suspected systems. Disconnect affected endpoints and servers from wired and wireless networks, or take affected network segments offline at the switch level when several systems are involved.
- Record what you know. Note the first alert time, visible ransom notes, affected hostnames, user reports, unavailable services, and actions already taken. Preserve the original notes and timestamps.
- Escalate and notify according to the plan. Contact leadership, IT and security staff, managed security providers, the cyber insurer, and designated legal and communications contacts.
| Immediate action | Purpose | Important caution |
|---|---|---|
| Activate the plan | Creates authority, roles, and a decision record. | Use an out-of-band channel if normal systems may be monitored. |
| Isolate systems | Stops or limits spread and further encryption. | Do not power off first if network disconnection is possible; volatile evidence may be lost. |
| Capture initial facts | Preserves a reliable timeline and supports scoping. | Do not edit ransom notes, logs, or screenshots. |
| Notify response stakeholders | Brings in the authority and expertise needed for technical, legal, and public decisions. | Use the notification plan rather than broadcasting unverified details. |
1. Activate the incident plan and control communications
Open the organization’s incident-response case and assign one person to coordinate decisions. The coordinator should maintain a timeline containing observations, hypotheses, actions, approvals, and outstanding questions. Record who authorized network shutdowns, account resets, restoration, notifications, and public statements.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Use communications that attackers cannot easily observe
Ransomware operators may monitor compromised mailboxes, collaboration tools, remote-management consoles, or file shares. Coordinate urgent isolation by phone or another trusted channel when appropriate. Do not place sensitive recovery plans, credentials, or forensic details in an account that may be compromised.
Separate facts from assumptions
Label each entry as confirmed, suspected, or unknown. A ransom note proves that a system displayed the note; it does not by itself prove which data was copied, which accounts were used, or whether every server is encrypted. This distinction keeps leadership and external notifications accurate.
2. Isolate impacted systems without destroying evidence
CISA’s joint ransomware guide gives the central instruction: “Determine which systems were impacted, and immediately isolate them.” Apply that instruction as broadly as the evidence supports.
Endpoint and server isolation
- Disconnect affected devices from Ethernet and Wi-Fi.
- Disable network paths between affected and unaffected segments when several systems or subnets are involved.
- Block known malicious addresses, domains, remote-access paths, and compromised accounts through approved controls.
- Keep a record of each isolated host, interface, time, and person who performed the action.
If multiple systems are encrypting files or showing ransom notes, taking the network offline at the switch level may be necessary. Coordinate the outage with the incident lead and the owners of health, safety, production, and other critical services.
Cloud and virtual resources
For cloud resources, preserve a point-in-time volume snapshot before making changes when your response team can do so safely. Keep the snapshot protected from deletion or alteration and document its identifier, creation time, and access permissions. Suspend exposed services or credentials through your approved process rather than deleting resources that may contain evidence.
When powering down is unavoidable
Powering down can stop activity, but it can also destroy memory contents, active network connections, encryption keys, and other volatile evidence. CISA treats shutdown as a fallback when network shutdown or physical disconnection is not feasible. If a device presents an immediate safety risk or cannot otherwise be isolated, document why it was powered down and who approved it.
3. Determine scope, dependencies, and restoration priorities
Do not begin broad restoration until you understand what was affected and what must come back first. Identify the initial breach, systems showing encryption or tampering, accounts used during the intrusion, data repositories that may have been accessed, and systems believed to be unaffected.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Build an impact map
- Systems: endpoints, servers, hypervisors, identity services, network devices, cloud workloads, and backups.
- Data: encrypted files, deleted or altered data, sensitive records, and data that may have been copied.
- Dependencies: identity, DNS, time services, databases, storage, applications, network routes, and vendor connections.
- Operational effects: health and safety functions, revenue-generating processes, customer services, regulatory operations, and internal productivity.
- Known unaffected assets: systems checked by an appropriate method and kept separate from the compromised environment.
NIST’s data-integrity guidance emphasizes identifying the source and affected systems and collecting enough information for impact analysis. “No alert” is not the same as “verified clean”; record the method and confidence level for every system classified as unaffected.
Set an explicit restoration order
| Priority | Typical systems | Decision question |
|---|---|---|
| 1 — Health and safety | Clinical, life-safety, emergency, or industrial-control functions. | Could delay or failure create immediate risk to people? |
| 2 — Core identity and infrastructure | Authentication, network services, storage, and management systems required by higher priorities. | Can the service be rebuilt in a clean, isolated way? |
| 3 — Critical operations and revenue | Production, transaction, customer-support, and legally required services. | Which dependencies must be restored first for useful operation? |
| 4 — Supporting services | General file shares, collaboration, reporting, and lower-impact applications. | Can the business operate safely while this remains unavailable? |
Adjust the order to your organization’s actual dependencies. Keep the list of systems believed unaffected alongside the impact map so they are not accidentally connected to a contaminated segment.
4. Notify internal contacts and seek qualified assistance
Follow the notification plan rather than improvising a distribution list. Involve the incident lead, executive leadership, IT and security teams, system owners, privacy or compliance staff, communications personnel, legal counsel, and the cyber insurer when applicable. A managed security provider or qualified incident-response firm may provide specialized access and expertise; document who has authority to make changes.
Government reporting and assistance in the United States
CISA’s joint guide identifies the organization’s incident contacts, the local FBI field office, the FBI Internet Crime Complaint Center (IC3), and the local U.S. Secret Service field office as reporting or assistance routes. Use the current contact details in your response plan and verify local requirements. Federal assistance and reporting are distinct from hiring a paid commercial provider.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCoordinate public statements
Only the designated communications owner should approve external statements. State what is confirmed, what services are affected, what customers or employees should do, and where updates will appear. Do not disclose unverified claims about data theft, the attacker, a decryptor, or the restoration date.
5. Contain the compromise and preserve useful evidence
Containment is more than unplugging encrypted computers. Identify the initial access path and accounts that could permit continued access, then close or restrict those paths through a controlled change process.
Evidence to preserve when feasible
- System images and memory captures from a representative sample of affected devices.
- Authentication, endpoint, firewall, VPN, cloud, and other relevant logs.
- Ransom notes, malware samples, file extensions, hashes, and indicators of compromise.
- Cloud volume snapshots and records of administrative actions.
- The incident timeline, screenshots, alerts, and copies of communications used to make decisions.
Limited log retention can erase the evidence needed to identify the initial breach. Export relevant logs to protected storage and record their time zone, collection method, and chain of custody. Avoid repeatedly booting or modifying a system selected for forensic capture.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Restrict ongoing access
Reset or disable accounts identified as compromised, beginning with privileged, service, remote-access, and identity-administration accounts. Revoke active sessions and tokens where appropriate, rotate exposed secrets, and remove unauthorized persistence. Perform these changes with responders who understand the environment; a hurried reset can lock out recovery services or destroy useful evidence.
Ask about decryptors carefully
Law enforcement or qualified responders may know whether a decryptor exists for a particular ransomware family. Do not assume a tool will work, and never run an unverified decryptor against the only copy of data. Test any tool on a forensic copy, confirm its provenance, and preserve originals.
6. Prepare a clean recovery environment
Recovery is safe only when the destination and the data are trustworthy enough for the intended use. CISA warns against reinfection during recovery, and NIST recommends planning, isolating, and regularly testing backup and restoration procedures.
Validate the backup source
- Use offline or otherwise isolated backups that attackers could not alter through the compromised environment.
- Confirm encryption, access controls, retention, and the date of the last known-good copy.
- Check backup integrity and whether required applications, configurations, permissions, and dependencies are included.
- Compare multiple recovery points when the compromise date is uncertain.
- Have qualified incident responders assess whether backup infrastructure itself was accessed.
The existence of a backup does not prove that it is complete, unmodified, or free of the attacker’s persistence. Keep the original backup protected while working from a verified copy.
Build and isolate the recovery zone
Use a clean recovery VLAN or equivalent isolated environment. Rebuild or reimage systems from trusted media, apply security updates, establish secure administrative access, and enable logging before reconnecting production dependencies. Add only systems that have passed the organization’s validation checks. Restore identity and foundational services in the order required by dependent applications, while keeping unnecessary connectivity disabled.
Free tools Windows power users keep installed
One-click scans. No signup required.
Restore in controlled waves
- Document the service, backup version, owner, dependencies, and acceptance test.
- Restore into the isolated recovery environment, not directly into the suspected compromised network.
- Scan and inspect the restored system, accounts, scheduled tasks, remote-access tools, and configuration.
- Run functional, integrity, and security tests with the service owner.
- Connect only the approved dependencies and monitor for renewed encryption, unusual authentication, or outbound traffic.
- Record the result and rollback plan before beginning the next wave.
7. Handle breach notification with jurisdiction-specific advice
Ransomware can involve availability loss, unauthorized access, data exfiltration, or all three. Notification duties depend on the organization’s location, sector, affected data, contracts, and incident facts. Follow the notification requirements in your plan and consult counsel and the relevant regulator; a general checklist cannot determine every organization’s legal obligations.
Preserve the facts counsel will need: affected systems and dates, categories of data, evidence of access or exfiltration, containment actions, restoration status, and decisions about notification timing. Do not promise that an incident is “only encryption” until an appropriate investigation supports that conclusion.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
8. Decide how to address ransom demands
Do not adopt a universal rule to pay or refuse payment. The decision belongs to incident leadership, legal counsel, the insurer, and law enforcement, based on safety, sanctions and legal exposure, operational necessity, the reliability of any claimed decryptor, and the possibility that payment will not restore data or prevent publication.
Preserve the ransom note and wallet or contact details as evidence. Do not contact the attacker independently of the approved response process, and do not send funds or test a decryptor without documented authorization and specialist advice.
9. Verify recovery and watch for reinfection
A system is not recovered merely because users can log in. For each restored service, test data integrity, authentication, authorization, business workflows, backups, logging, monitoring, and connections to other services. Have the service owner sign off on the acceptance criteria.
Monitor after reconnection
- Watch for renewed file encryption, mass file changes, disabled security tools, and unusual administrative activity.
- Review authentication for impossible travel, unexpected privilege use, new accounts, and service-account anomalies.
- Monitor DNS, firewall, proxy, cloud, and endpoint telemetry for connections to known or suspicious infrastructure.
- Keep heightened logging and alerting in place for a defined period after restoration.
- Maintain a rollback path and keep clean recovery copies disconnected until the environment is stable.
10. Document lessons and improve the plan
After critical services are stable, conduct a structured review while the timeline and decisions are still fresh. Include technical staff, business owners, leadership, communications, legal, and any external responders who participated.
Questions the review should answer
- How did the attacker gain initial access, and which control should have blocked or detected it?
- Which accounts, systems, data stores, and dependencies were involved?
- Which isolation, backup, logging, or communications steps worked or failed?
- How long did detection, containment, notification, and restoration take?
- What evidence, authority, staffing, or vendor access was missing?
- Which recovery assumptions proved wrong?
Update the incident plan, network diagrams, asset inventory, contact lists, backup procedures, access controls, monitoring rules, and restoration runbooks. Exercise the revised recovery plan and test restores regularly. NIST’s ransomware guidance also recommends keeping response resources and contacts current. Organizations may share useful indicators and lessons with CISA or a sector information-sharing organization when approved by leadership and counsel.
Common mistakes and safer alternatives
| Mistake | Why it causes trouble | Safer alternative |
|---|---|---|
| Powering off every machine immediately | May destroy volatile evidence and obscure the attack path. | Disconnect or isolate first when feasible; shut down only when necessary and document the reason. |
| Restoring directly into production | Can reinfect clean data and systems. | Use a clean, isolated recovery environment and restore in tested waves. |
| Assuming backups are safe because they exist | Backups may be encrypted, altered, incomplete, or reachable by the attacker. | Verify integrity, isolation, encryption, provenance, and recovery-point suitability. |
| Resetting accounts without coordination | Can destroy evidence or disable dependencies needed for recovery. | Prioritize compromised and privileged accounts through the incident-change process. |
| Making an early public claim about data theft | Investigations may later contradict the statement. | Communicate confirmed facts, uncertainty, and next update channels. |
| Using an unverified cleanup or decryption tool | It may fail, damage data, or introduce additional malware. | Obtain specialist or law-enforcement guidance and test only on copies. |
Preparation that makes recovery possible
Ransomware recovery is faster when the organization has already defined critical services, dependencies, restoration owners, acceptance tests, out-of-band contacts, and evidence-handling procedures. Maintain offline or isolated, encrypted backups and regularly perform test restores.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →External storage can be one component of an offline-backup design, but it is not a ransomware cleanup tool, decryption device, or universal enterprise recommendation. Before using any removable storage, confirm compatibility, encryption, access control, backup verification, physical protection, and safe isolation from production systems.
Quick Recap
Key points to retain
- Isolate affected systems immediately, coordinating the action across technology and communications teams.
- Prefer network shutdown or disconnection over powering down when preserving volatile evidence matters.
- Let scope, dependencies, and health, safety, revenue, and critical-service needs determine restoration order.
- Restore verified data from offline or isolated, encrypted backups into a clean environment.
- Determine notification duties with jurisdiction-specific legal and regulatory advice.
- Finish with documented lessons, updated procedures, current contacts, and recovery exercises.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
