The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Disconnect first, preserve evidence, and get qualified help. Unplug the affected computer from Ethernet and turn off Wi‑Fi (or isolate affected systems at the network level). Do not rush to shut the computer down: powering off can erase volatile evidence. Keep the ransom note, record what happened, report through the appropriate channel, and restore only after responders have contained the intrusion and verified a clean backup.
Do these things in the first minutes
- Isolate the affected device or network. On one home or small-office computer, unplug the Ethernet cable and disable Wi‑Fi. Disconnect attached network storage and any other device that may be reachable through the same network. For an organization, identify impacted endpoints, servers, and subnets and isolate them immediately. Network administrators may need to disable switch ports or take a segment offline. Coordinate containment over out-of-band phone or other communications if attackers could be monitoring email or collaboration systems.
- Do not click through the ransom note or run an unfamiliar “fix.” Photograph or copy the note without opening links or executable attachments. Do not install a decryptor, script, cleaner, or remote-access tool unless a qualified responder has verified it.
- Call the right people. An individual should contact a trusted, qualified incident-response or computer-forensics professional if the scope is unclear. An organization should activate its incident-response plan, notify internal IT/security leadership, and alert relevant managed-service, cloud, insurance, and legal contacts.
- Start a written timeline. Record when files were first noticed as encrypted, the device names, visible file-extension changes, suspicious messages, unusual logins, and every action taken. Preserve the original ransom note and any payment instructions.
The joint #StopRansomware Guide (September 2023) is principally organizational guidance. A person with one affected device should still isolate that device immediately, but should not attempt enterprise-scale forensics without appropriate expertise.
Should you turn the computer off?
Usually, containment comes before shutdown. CISA explains that a running system can hold volatile evidence in memory, and an abrupt shutdown may destroy infection artifacts useful to investigators. If you can disconnect the device from the network, leave it powered on and untouched while you obtain help.
Power down only when network disconnection is impossible or when a responder directs you to do so. CISA’s guidance says shutdown may be necessary if isolating the device or temporarily taking the network offline cannot be achieved. Do not keep experimenting after a shutdown; document the time and tell the responder exactly what happened.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Preserve evidence without making the incident worse
For everyone
- Keep the ransom note, readme files, screenshots, and contact addresses. Note the exact filenames and extensions added to encrypted files.
- Write down the date and time of discovery, what you were doing beforehand, and whether any files were deleted, renamed, or copied.
- Do not delete encrypted files, reformat disks, reinstall the operating system, or “clean” the machine before an expert assesses it.
- Do not pay or communicate with the attacker while you are still determining scope and legal obligations.
For organizations and responders
The October 2023 CISA/MS-ISAC guide (PDF version 3.1) identifies system images, memory captures, security and authentication logs, suspicious files, and indicators such as command-and-control addresses as potentially valuable. Collect them using approved forensic procedures so timestamps and integrity are retained. In a cloud environment, a volume snapshot can preserve a point-in-time copy for later examination; coordinate snapshots with the cloud provider and responders so you do not accidentally preserve an already-compromised state as your only copy.
Keep potentially affected machines isolated until investigators determine that accounts, remote-access paths, and management tools are safe. If the incident involves regulated, sensitive, or customer data, involve counsel early; notification deadlines and evidence-handling rules vary by jurisdiction and sector.
Who should you contact and where should you report?
Individuals
Contact your employer’s IT or security team if the device is used for work, school, or a shared service. Otherwise, seek a reputable incident-response or digital-forensics professional. If personal information, financial data, or someone else’s data may have been exposed, contact the relevant service providers and authorities rather than relying on a generic online “decryptor.”
Recommended Free Tools
Organizations in the United States
Follow your incident-response and communications plan, notify affected service providers, and consider reporting to the Cybersecurity and Infrastructure Security Agency (CISA), a local FBI field office, the FBI’s Internet Crime Complaint Center (IC3), or a local U.S. Secret Service field office. The FBI’s victim guidance says to contact a local field office or file a report through IC3: https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/ransomware. Reporting can provide investigative leads and may help identify a ransomware variant, but it does not replace containment or recovery work.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Organizations outside the United States should use their national cyber-incident authority and law-enforcement channels. The correct reporting and notification duties depend on location, industry, contracts, and the type of data involved; obtain jurisdiction-specific legal advice promptly.
Assume encryption may be only one part of the intrusion
Ransomware operators may first obtain credentials, establish remote access, disable security controls, steal data, or move laterally. Removing the encryption symptom without closing that access can lead to reinfection or a second attack.
- Triage the scope. List encrypted endpoints, servers, virtual machines, cloud volumes, shared drives, and backups. Identify systems that are running normally but were reachable from the compromised network.
- Review identity and security telemetry. Examine authentication, VPN, endpoint, firewall, email, cloud, and administrative-tool logs for the earliest suspicious activity. Preserve logs before retention limits overwrite them.
- Find the initial breach. Investigators should determine whether the entry point was a stolen password, exposed remote service, phishing message, vulnerable software, or another route. Reset credentials from a clean device, beginning with privileged, service, and remote-access accounts, under responder guidance.
- Block remaining access paths. Disable compromised accounts and tokens, remove unauthorized persistence, restrict remote administration, and segment affected systems. Keep systems isolated until these checks are complete.
- Assess data theft. Look for evidence that files were copied before encryption. This affects legal notifications, communications, and the order in which services can safely return.
Can encrypted files be recovered?
Sometimes, but there is no universal recovery method. Recovery depends on the ransomware family, the operating system and version, whether the attackers also destroyed backups, and whether a trustworthy decryptor exists. CISA advises consulting federal law enforcement about possible decryptors because some variants have known weaknesses or released tools. That advice does not establish that a tool exists for your case; availability changes as variants are analyzed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not trust a website or person who promises recovery without first identifying the variant and examining the system. A tool that works on one family can corrupt evidence or damage files from another. Ask a qualified responder to verify a decryptor’s provenance, test it on copies, and preserve originals.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Should you pay the ransom?
The FBI’s official position is explicit: The FBI does not support paying a ransom in response to a ransomware attack.
CISA, the FBI, and the NSA also discourage payment. Payment does not guarantee that criminals will provide a working key, stop publishing stolen data, or leave your systems alone. It can finance further attacks, and a transaction may create legal or sanctions issues depending on the actor, destination, and jurisdiction.
Do not make a payment decision in isolation. An organization should involve legal counsel, law enforcement, its insurer, executive leadership, and an experienced negotiator or incident-response firm where appropriate. Individuals should obtain legal and technical advice before communicating with an attacker. None of these consultations guarantees recovery; they help you understand risk and obligations.
Restore only after containment
Restoration is safer when responders have identified and closed the original access route. Reconnecting too soon can let an attacker encrypt restored files again or spread from a still-compromised account.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Prepare a clean environment. Use known-good, patched systems and a clean network segment. Do not use an encrypted workstation as the administrative console.
- Verify backups. Prefer offline, encrypted backups that were not continuously reachable from compromised accounts. Scan backup sets where possible and compare dates, scope, and integrity. Treat a backup drive purchased after encryption as a place to store future backups, not as a way to decrypt existing files.
- Prioritize services. Restore identity, communications, safety-critical, and other essential services according to the organization’s business-impact plan. An individual may prioritize irreplaceable personal records before convenience data.
- Rebuild rather than trust compromised systems. Reimage or replace systems when responders cannot establish that the operating system and administrative tools are clean. Apply security updates, enforce multifactor authentication where available, and change credentials from clean devices.
- Test before reconnecting broadly. Confirm that applications, permissions, backups, monitoring, and logging work. Reconnect in stages while watching for new encryption, suspicious accounts, or unusual outbound traffic.
Recovery may be incomplete if no clean backup exists and no usable decryptor is available. Preserve encrypted originals while options are assessed; future research or law-enforcement work may depend on them.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Individual device or organizational incident?
| Question | One affected personal device | Organization or multiple systems |
|---|---|---|
| Immediate scope | Unplug Ethernet, disable Wi‑Fi, and disconnect network storage. | Identify impacted hosts and isolate ports, segments, or subnets; coordinate through out-of-band communications. |
| Technical help | Trusted IT, digital-forensics, or incident-response professional. | Incident-response team, internal security, managed providers, cloud provider, insurer, and counsel. |
| Evidence | Preserve the note, screenshots, timeline, and device state; avoid untrained forensic tools. | Preserve images, memory, logs, suspicious files, indicators, and cloud snapshots using forensic procedures. |
| Reporting | Employer, service providers, and local authorities as relevant. | CISA, FBI field office or IC3, Secret Service field office, sector authorities, and required regulators. |
| Recovery priority | Protect irreplaceable records and restore from a verified clean copy. | Contain the intrusion, meet continuity priorities, rebuild clean systems, and restore in controlled phases. |
Prepare backups that can survive the next incident
Preparation cannot decrypt files already locked, but it can make the recovery decision far less desperate. CISA’s guidance on protecting stored data recommends backing up local-device data to an external hard drive and disconnecting that drive when it is not actively backing up: https://www.cisa.gov/resources-tools/training/how-protect-data-stored-your-devices.
| Backup approach | Isolation from a compromised account | Restore testing | Immutability and controls | Operational fit |
|---|---|---|---|---|
| Offline physical storage | Strong when disconnected except during controlled backups. | Requires scheduled manual test restores. | Physical separation provides practical protection; encrypt the drive. | Useful for individuals and small teams that can rotate drives securely. |
| Cloud or cloud-to-cloud backup | Depends on separate credentials, access controls, and whether the service is continuously reachable. | Automate and document test restores; verify that retention points are usable. | Some services offer immutable or locked retention, but configuration and compliance requirements must be evaluated. | Scales for organizations and distributed systems when administration is mature. |
Keep more than one recovery point, protect backup credentials separately, and test restoration before an emergency. Immutability is not a universal requirement or a substitute for access control, monitoring, and a tested recovery process.
After systems are back
- Document what happened, which systems and data were affected, decisions made, and restoration results.
- Update incident-response, contact, business-continuity, and communications plans using the lessons learned.
- Close the original vulnerability, remove unnecessary exposure, and verify that monitoring and alerting remain active.
- Where appropriate, share useful indicators with CISA or your sector information-sharing and analysis center (ISAC), while protecting personal and confidential information.
The right next step is determined by facts this checklist cannot supply: the ransomware family, affected operating system, location, evidence of data theft, and available backups. When any of those are unknown, keep the system isolated and obtain qualified incident-response help rather than guessing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
