Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Disconnect first, then get qualified help. Unplug affected computers from wired and Wi‑Fi networks, isolate any wider network that may be involved, and avoid reconnecting backup storage. Do not rush to restore or pay: attackers may still be operating, a ransom does not guarantee decryption, and restoring into a compromised environment can encrypt clean systems again. Preserve the ransom note and other evidence, report the incident through the appropriate channels, and recover only after responders are confident that both the backup and the receiving systems are clean.
The first 15 minutes: contain the incident
Ransomware is an active security incident, not merely a file-format problem. Encryption may be continuing, stolen credentials may let an intruder move through other machines, and an attacker who notices defensive actions may change tactics. Your first objective is to stop communication between affected systems and the rest of the environment.
1. Disconnect affected devices
- On each visibly affected computer, disconnect the Ethernet cable. If it uses Wi‑Fi, turn off Wi‑Fi or enable airplane mode.
- Disconnect network-attached storage, shared drives, mapped volumes, and removable backup devices that are not required for evidence collection.
- If several computers, servers, or subnets are affected, have an administrator isolate those segments at the switch, firewall, or wireless-controller level. Use a separate, trusted channel—such as a phone call or an out-of-band messaging system—to coordinate, because email and internal chat may be monitored or unavailable.
- Do not sign in to unaffected systems with credentials that were used on an infected device until responders advise you. Reused or stolen credentials can spread the compromise even after the original encryption stops.
For a home user, disconnect the affected computer and any attached drives from the router. Leave unrelated devices off the local network if you cannot determine whether shared folders or accounts were reached.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Do not power off reflexively
If you can isolate a machine by disconnecting its network connections, that is usually preferable to an immediate shutdown because memory may contain useful evidence. The joint CISA, MS‑ISAC, FBI, and NSA ransomware guide warns that volatile information, including memory and logs with short retention periods, can disappear when a device is powered down.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Powering off can still be appropriate when network isolation is impossible and the device is actively spreading the infection. In an organization, follow the incident-response plan and let qualified responders choose between live containment, controlled shutdown, and forensic acquisition. A home user who cannot safely disconnect a machine should remove its network connection if possible, then seek professional assistance before experimenting with cleanup tools.
Get responders involved and report the attack
Organizations should activate their incident-response and communications plans immediately. Notify the internal security or IT team, managed service providers, cyber-insurance contact, and legal counsel according to the plan. A responder can determine whether the event includes data theft, credential compromise, or only local encryption; those distinctions affect notification duties and recovery order.
U.S. reporting routes
For incidents in the United States, the CISA ransomware guidance identifies CISA, a local FBI field office, the FBI Internet Crime Complaint Center (IC3), and the U.S. Secret Service as reporting or assistance options. The FBI specifically directs victims to IC3 or a local field office. Reporting promptly can help investigators connect campaigns and may reveal a variant-specific decryptor or other intelligence. Use the current contact details on each agency’s official site rather than relying on an old phone number or saved bookmark.
Outside the United States
Other countries use different national cyber agencies, police channels, data-protection regulators, and sector-specific reporting requirements. Contact your country’s cyber-incident authority and local law enforcement, and ask your insurer or legal adviser which notifications are mandatory. Do not assume that a U.S. reporting route is available to you.
Preserve evidence before deleting anything
Keep the ransom note, extortion email, chat transcript, wallet address, payment instructions, file-extension changes, and any stated deadline. Photograph or export messages if the attacker portal may disappear. Record the time encryption was discovered, the first device noticed, usernames that were logged in, systems that became inaccessible, and the names of shared folders or cloud services involved.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Do not reformat drives, run registry cleaners, delete event logs, or use a random “decryptor” before responders have collected what they need. Preserve relevant firewall, endpoint, authentication, cloud, and backup logs for as long as your systems retain them. If an organization has a logging platform, export copies to an isolated location. The goal is not to investigate the whole breach yourself; it is to prevent useful evidence from being overwritten while help is engaged.
Decide what the ransom demand means—and what it does not
A ransom note is an adversary’s claim, not proof that payment will restore your data. The FBI says it does not support paying a ransom. CISA states that payment does not guarantee file recovery and can encourage additional criminal activity. Criminals may provide a broken key, demand more money, return later, or publish data even after payment.
For a business, treat any payment discussion as a legal, operational, and insurance decision rather than a technical shortcut. Consult law enforcement, an experienced incident responder, legal counsel, and the insurer before communicating with the extortionist or transferring funds. Check sanctions and other financial restrictions that may apply in your jurisdiction. Keep records of every contact and instruction.
An individual should not negotiate alone or trust a website promising guaranteed recovery in exchange for cryptocurrency. A qualified responder can identify the ransomware family, check whether a reputable decryptor exists, and explain the risks without promising an outcome. Never send a backup drive or private keys to an unverified “recovery” service.
Can you restore from a backup?
Yes—but only when the backup is both usable and trustworthy, and only after the compromise has been contained. Connecting an online backup, cloud sync folder, or external drive too early can encrypt the backup or reintroduce the attacker into a replacement system.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Use this restoration sequence
- Inventory copies without reconnecting them. List local, removable, cloud, snapshot, and off-site backups, including their creation dates and retention periods. Note which accounts can administer or delete them.
- Determine the likely intrusion window. A backup created after the attacker gained access may already contain encrypted files, malicious tools, or stolen credentials. Do not assume the newest copy is the safest.
- Contain and remediate the environment. Disable or reset compromised accounts as directed by responders, remove persistence, patch the exploited entry point, and rebuild affected systems when necessary. In a business, this work should be documented in the incident plan.
- Validate the backup. Scan it with trusted, updated security tooling, inspect representative files, verify hashes or backup-integrity reports where available, and confirm that the backup was not writable from the compromised network.
- Prepare a clean destination. Restore to a freshly installed or otherwise verified-clean device or network segment. Keep it isolated while security controls, updates, administrator accounts, and monitoring are configured.
- Restore in stages. Start with a small, noncritical set of files and observe the environment. Then restore services in an order that limits dependency and business risk, retaining the encrypted originals for evidence until responders approve disposal.
The UK National Cyber Security Centre advises restoring only when you are confident that both the backup and the device being connected are clean. That condition matters for cloud services as well: a synchronized folder can faithfully copy encrypted files or malicious changes to every connected endpoint.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →If every available backup is encrypted
Do not conclude that recovery is impossible, but do not assume a universal solution exists. Ransomware families use different algorithms, keys, and implementation flaws. Researchers sometimes release trusted decryptors for specific variants, while other families have no public tool.
Give a responder or law-enforcement contact the ransom note, sample encrypted files, original file extensions, and any identified variant name. Ask whether a reputable decryptor is available and whether using it could alter evidence. Download tools only from a recognized security authority or the tool’s verified publisher; fake decryptors are a common way to steal money or install more malware.
Check less obvious sources without reconnecting them to the infected network: versioned cloud snapshots, application exports, email attachments, collaboration-platform history, archival media, and copies held by a trusted partner. These are possibilities, not guarantees, and each must be checked for both integrity and malware before use.
Prepare backups that ransomware cannot easily reach
Future resilience depends on more than owning a drive. CISA recommends frequent backups; its consumer guidance describes an external hard drive as one option for local-only data and advises storing it safely and disconnecting it when it is not actively being used for backup. The joint ransomware guidance emphasizes offline, encrypted backups and regular tests of availability and integrity.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Design principles
- Isolation: Keep at least one copy offline or otherwise unreachable from ordinary user accounts and production systems. An external drive left permanently attached is exposed to the same encryption event.
- Encryption: Encrypt backup media and protect the recovery key separately. Encryption prevents unauthorized reading if the device is lost; it does not stop ransomware from deleting or encrypting a mounted backup.
- Independent credentials: Use a backup account that cannot administer everyday endpoints, and protect its recovery factors from the same identity system where practical.
- Multiple generations: Retain older versions so an attacker cannot make one clean backup useless by silently altering it before discovery.
- Testing: Schedule restoration tests. Confirm that files open, permissions are correct, applications can use their data, and the people responsible know the recovery procedure.
- Documented ownership: Record what is backed up, how often, where copies are stored, who can restore them, and how keys are recovered during an outage.
An external hard drive can be a sensible component for personal files, but it is not a decryption method for files already encrypted and is not, by itself, a complete ransomware protection plan.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare backup approaches by security properties
There is no single “best” medium. Evaluate each approach against isolation, encryption, tested integrity, and the cleanliness of the destination rather than by brand or capacity alone.
| Backup approach | Isolation from ransomware | Encryption | Testing requirement | Key risk |
|---|---|---|---|---|
| Disconnected external drive | Strong while unplugged; weak while mounted | Must be configured and key-protected | Periodically reconnect in a controlled, clean environment and restore sample files | Loss, damage, or an infected computer encrypting it while attached |
| Cloud backup with version history | Depends on provider controls, immutable versions, and account isolation | Check provider and client encryption settings | Perform test restores and verify that versions predate the incident | Compromised credentials, synchronized encryption, or deleted snapshots |
| Network backup appliance | Usually reachable from the production network unless segmented | Configure encryption at rest and in transit where supported | Test restores and administrative recovery procedures | Ransomware using a shared administrator account to delete or encrypt backups |
| Off-site or archival copy | Good when physically or logically separated | Encrypt before transport or storage | Verify that media can still be read and that keys are available | Long retention without integrity checks or usable recovery hardware |
Different priorities for homes and organizations
For an individual or family
Disconnect the affected computer and attached storage, photograph the note, and write down what changed. Contact a reputable local security professional or your device manufacturer if you need help identifying the variant. Change important passwords from a known-clean device only after the affected accounts and email access have been assessed. If the computer holds tax, medical, identity, or financial records, consider identity-theft monitoring and ask the relevant institution whether notification is appropriate.
For an organization
Open an incident record, assign an incident lead, and separate technical, legal, communications, and business-continuity decisions. Identify critical services, affected subsidiaries or suppliers, privileged accounts, and systems that must remain online for safety. Preserve evidence under legal guidance, coordinate with the insurer’s approved process, and plan public or customer communications based on confirmed facts rather than the ransom note alone. If personal or regulated data may have been accessed, obtain jurisdiction-specific advice about notification deadlines.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Mistakes that make recovery harder
- Leaving a machine connected because “only one folder” appears encrypted.
- Shutting down every system before responders can preserve memory and short-retention logs, when isolation was possible.
- Plugging a backup drive into an infected computer to see whether it works.
- Restoring the newest backup without checking when the attacker first gained access.
- Deleting ransom messages or logs, which can remove variant and timeline clues.
- Paying under time pressure without consulting law enforcement, legal advisers, responders, and the insurer.
- Installing an unverified decryptor or recovery utility that may contain additional malware.
When is it safe to resume normal use?
Resume normal connectivity only after the person responsible for the incident can explain what was isolated, which accounts and systems were compromised, how persistence was removed, and why the restored environment is clean. Re-enable services in stages, monitor authentication and network activity, and keep heightened logging for a period defined by your responder or security policy. Treat unexplained re-encryption, new ransom notes, disabled security tools, or unusual account activity as signs to isolate again and escalate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
