iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If a ransomware recovery company says it cannot restore your files, stop further work on affected devices, preserve the evidence, and check whether a decryptor matches your ransomware variant or whether clean backups are available. A second opinion may help identify options, but no provider can promise decryption; if neither a working decryptor nor usable backups exist, the files may not be recoverable.
Contain the incident and preserve evidence
Disconnect affected devices
Disconnect infected computers and storage devices from Wi-Fi and wired networks. Do not reconnect them just to test whether files open, and do not attach a backup drive to a compromised device. If this affects a business, school, or other organization, contact its incident-response lead and follow its response plan rather than making ad hoc changes. CISA recommends isolating affected systems and collecting relevant evidence.
Keep records of what happened
Save copies of the ransom note, encrypted file names and extensions, payment demands, attacker emails or URLs, and relevant logs. Keep your communications with the recovery company, too. Ask for a written account of what it examined, what methods it attempted, what changes it made, and what evidence or data it retained. Preserve original media where possible rather than allowing additional work to overwrite it.
Check whether a decryptor matches your ransomware
Decryptors are specific to ransomware families and sometimes to particular versions; there is no universal tool that unlocks encrypted files. Use clues such as the ransom note and file extension to identify the variant, then check the No More Ransom project’s Crypto Sheriff and catalog of free decryptors. A listed tool is relevant only if it supports your infection. Follow the tool’s instructions, and do not assume that removing malware will decrypt files: No More Ransom advises removing malware before using a decryptor and notes that removal alone does not restore encrypted data.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Report the attack
In the United States, you can report a ransomware incident to the FBI through a local field office or the Internet Crime Complaint Center (IC3); CISA also accepts incident reports and offers assistance. IC3 asks people to include details such as the ransomware variant, if known; file extension; cryptocurrency type and address; attacker email addresses or URLs; demand amount; and whether a payment was made. Keep the information you have even if you cannot identify every detail.
Outside the United States, report the incident to the appropriate national cybercrime authority. Notification requirements and deadlines can vary by country, sector, and organization, so check the rules that apply to your situation.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Look for clean backups before restoring
Check offline backups and backup snapshots that were not reachable from the infected systems. CISA recommends restoring from offline, encrypted backups; the FBI advises keeping backups disconnected from the systems they protect. If possible, have an incident responder confirm that the environment is clean before restoration. Restore to clean systems, prioritize the data you need most, and avoid reconnecting infected devices or exposing backups to them.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Decide whether to get a second opinion
An independent incident-response or digital-forensics provider may help contain the incident, investigate what happened, identify the variant, assess evidence, or plan a safe restoration. Those services are different from a promise to decrypt files. The cited government guidance does not endorse particular commercial firms or establish a universal recovery success rate.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Before handing over devices or data, ask the provider to put its scope and proposed methods in writing. Clarify what it has already tried, whether it will preserve original media, what evidence it will retain, how it will handle your data, what costs and conditions apply, and whether any claimed result is guaranteed. Treat a promise of certain recovery with caution.
Should you pay the ransom?
Payment does not guarantee that you will receive a working decryptor or get your data back. The FBI states: “The FBI does not support paying a ransom in response to a ransomware attack. Paying a ransom doesn’t guarantee you or your organization will get any data back.” Consider the risks with your incident-response team and relevant legal or regulatory advisers rather than treating payment as a dependable recovery method.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
When the files may not be recoverable
If no decryptor supports the ransomware variant and there is no clean backup or other usable copy of the data, recovery may not be possible. A forensic investigation can help establish what happened and whether other copies or restoration options exist, but it cannot guarantee that encrypted files can be decrypted. Keep the encrypted files and incident records if advised by your responders; they may remain useful if a suitable decryptor becomes available later.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
