PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf ransomware may have reached your cloud environment, do not start by decrypting files or negotiating with the attacker. Activate your approved incident-response plan, move coordination to trusted communications, identify and isolate affected systems, preserve logs and volatile evidence, investigate compromised identities and persistence, then rebuild and restore critical services from clean, tested backups. CISA’s joint #StopRansomware Guide is the baseline for this sequence.
The first decision: treat the event as an active incident
A cloud ransomware event is an identity, infrastructure and data-integrity crisis, not simply a set of encrypted files. Your first objective is to stop the attacker from changing more systems while keeping enough evidence to determine how access was gained and what remains trustworthy.
As an Amazon Associate I earn from qualifying purchases.
Use the organization’s approved incident-response plan and its communications plan. Assign an incident lead, technical containment lead, evidence owner and communications or legal coordinator if those roles exist. Use out-of-band communication, such as phone calls, for sensitive coordination when an attacker may be monitoring email, chat or other organizational channels. CISA recommends planning these roles and communications before an incident rather than improvising them during one.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not make irreversible changes before the response team agrees on the containment objective. A hurried deletion of an account, shutdown of a host or purge of a log can remove evidence or destroy the clean recovery path.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Cloud ransomware response checklist
- Activate the approved incident and communications plans. Confirm who can authorize isolation, credential resets, service suspension and restoration.
- Identify affected systems and isolate them promptly. Separate compromised workloads, accounts, networks and storage from trusted systems.
- Capture evidence before it disappears. Preserve cloud control-plane logs, network records, endpoint telemetry and other short-retention or volatile data.
- Determine the initial access and continued access. Investigate stolen credentials, persistence, lateral movement, email identities, remote access and public-facing assets.
- Map dependencies and define restoration order. Use the critical-asset list and service dependencies, not the order in which systems were encrypted.
- Rebuild cleanly. Prefer known-good images and audited infrastructure-as-code, reset affected credentials and remove persistence.
- Restore from protected backups and monitor. Keep recovery systems separated, restore critical services first, and watch for reinfection.
- Document lessons and required notifications. Update plans, exercises, controls and jurisdiction-specific reporting decisions after containment.
How to isolate infected cloud systems
Confirm scope without waiting for perfect certainty
List the accounts, subscriptions or projects, regions, virtual networks, workloads, storage resources and user identities showing encryption, deletion, unusual administration or other indicators. Record the time first observed, the last known-good state and the owner of each resource. Mark systems as confirmed, suspected or currently trusted; that distinction helps the team contain broadly without treating every asset as equally compromised.
Cut paths that let the attacker continue
Apply the smallest isolation action that stops ongoing access while preserving evidence. Depending on the facts and your response plan, this can include disabling compromised accounts, revoking active sessions and access tokens, restricting security-group or firewall paths, suspending exposed workloads, or disabling VPN and other remote-access services. If a single identity provider or single sign-on resource is implicated, coordinate a controlled containment action rather than allowing users to keep authenticating through it.
When multiple systems or subnets are affected, CISA says taking a network offline at the switch level may be necessary. In a cloud design, that principle can mean removing routing or trust paths between affected and clean segments, not merely stopping one virtual machine. Be careful not to sever the logging or management channel needed to collect evidence.
Snapshot affected cloud volumes when feasible
Capture snapshots of affected volumes before destructive remediation when your provider and incident plan support it. Preserve the snapshot separately from production permissions, label it with time and chain-of-custody information, and restrict who can alter or delete it. A snapshot is an evidence copy, not proof that the underlying account or storage is clean.
Preserve evidence and telemetry
Collect the records most likely to expire
Review endpoint, intrusion-detection and intrusion-prevention telemetry, identity-provider events, cloud control-plane activity, network-flow records, storage access logs and backup-system logs. Prioritize sources with short retention or volatile characteristics. Export copies to protected storage that the suspected attacker cannot rewrite, and record the collection time, collector and original location.
Look backward from the first encryption or destructive event. Earlier authentication anomalies, newly created keys, permission changes, unusual regions, bulk reads, disabling of logging or deletion-protection changes may reveal the initial compromise and additional affected systems.
Do not power down by reflex
CISA advises avoiding a shutdown unless other disconnection options are unavailable, because powering down can destroy volatile-memory evidence. Prefer network isolation, access revocation or workload quarantine when those actions can stop the attacker without erasing memory-resident artifacts. If a shutdown is unavoidable for safety or containment, document who authorized it and what evidence was collected first.
Recommended Free Tools
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Find the initial access, identities and persistence
Investigate accounts, not only encrypted data
Identify every account involved in suspicious activity, including administrator, service, automation and email identities. Look for newly issued credentials, changed multifactor-authentication settings, unfamiliar API keys, delegated permissions, emergency accounts and privilege escalation. A restored database is unsafe if the attacker still controls an administrator or service principal.
Trace persistence and lateral movement
Determine how the intruder retained access: scheduled jobs, startup scripts, altered images, federation or single-sign-on changes, remote-management tools, implanted keys, modified policies or hidden accounts. Trace which identities accessed other accounts, regions, storage locations and backup systems. Investigate credential theft even when only a small number of files appear encrypted; the same credentials may have been used to copy data or prepare a later attack.
Contain exposed entry points
Based on evidence and the response plan, containment may include disabling VPN or other remote access, restricting single sign-on, taking a public-facing application offline, rotating exposed secrets and blocking malicious network destinations. Coordinate these actions with service owners so that an emergency change does not create a second outage or destroy evidence.
Build a clean recovery environment
Start from known-good images and code
Rebuild compromised workloads from standard golden images where possible. Use version-controlled infrastructure-as-code templates to redeploy cloud networks, identities, compute and storage consistently. CISA recommends keeping template backups offline, auditing changes and retaining notes that explain how the environment is supposed to be assembled. Do not treat the currently running configuration as a trusted template after an identity compromise.
Remove access that survived the rebuild
Reset affected passwords and rotate access keys, tokens, certificates and other secrets. Remove unauthorized accounts, persistence mechanisms and excessive permissions. Patch the vulnerabilities used for entry and verify that logging, alerting and time synchronization are active before production traffic returns.
Review customer-managed encryption keys
If customer-managed encryption keys may have been exposed, altered or used by the attacker, assess and update them as part of the cleaned rebuild. Coordinate key rotation with application owners so encrypted data remains recoverable and old keys are retained only when policy and forensic requirements justify it.
Restore services in a deliberate order
Use criticality and dependencies
Restore from a predefined critical-asset list. Map dependencies such as identity, DNS, network connectivity, databases, queues, monitoring and security controls before bringing an application online. A practical order is the one that makes the minimum safe business service available, not the one that restores the largest data set first.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Foundation: clean identity, networking, logging, security tooling and recovery administration.
- Data services: databases, object stores and queues restored from a known-good point.
- Core applications: services required for safety, operations, customer access or regulated processes.
- Secondary workloads: lower-criticality systems after monitoring confirms the environment remains clean.
Keep recovery systems separate
Maintain clean recovery accounts, networks and administration paths separately from production. If a backup repository or recovery account is reachable with the same compromised credentials, restoring from it can reintroduce the attacker. During each restoration wave, verify identities, permissions, logging and endpoint health before connecting the next dependency.
Validate before declaring success
Test that restored data is complete and internally consistent, that applications can authenticate without old compromised credentials, and that alerts fire for abnormal use. Preserve the original evidence and restoration records so the team can explain which backup, image and configuration was used for every critical service.
Design backups that ransomware cannot easily reach
CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster-recovery scenario. Its checklist states: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” A backup that remains writable or reachable by compromised production identities may be encrypted or deleted in the same incident.
Separate access and accounts
Use backup identities and, where practical, separate cloud accounts or tenancy boundaries. Limit production administrators from deleting, changing retention or altering backup policies. Document the break-glass process, protect it with strong authentication and test that an authorized recovery team can use it without production credentials.
Use deletion protections and versioning carefully
For cloud storage, consider delete protection or object lock and enable versioning where it helps preserve earlier copies after malicious or accidental changes. Confirm exactly who can bypass retention, whether protected versions consume additional storage, and how recovery staff will locate a known-good version.
Balance immutability, regulation and cost
Immutable storage is not automatically suitable for every regulatory regime. Retention settings, legal holds, data residency and deletion obligations must be reviewed with the appropriate counsel or compliance owner. Misconfiguration can also impose significant storage or retrieval costs. Record the intended retention and test both a normal restore and an emergency restore before relying on the design.
Reduce provider-concentration risk
A cloud-to-cloud or multi-cloud copy can reduce dependence on one provider if that provider account is affected. It also adds identity, networking, transfer, monitoring and operational complexity. Choose it only when the team can secure the second environment and demonstrate a restore, rather than treating a second destination as automatically resilient.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Compare recovery designs before an incident
| Decision axis | Questions to answer | Evidence to require |
|---|---|---|
| Backup accessibility | Are copies offline or continuously reachable from production? | Documented isolation and a successful restore from the protected copy |
| Identity separation | Can a production administrator delete or rewrite recovery data? | Separate roles, accounts and tested break-glass access |
| Restore capability | How quickly can each critical service be rebuilt, and in what order? | Dated restore-test records, dependency map and recovery runbook |
| Immutability and deletion control | Who can bypass retention, and what happens when protection is misconfigured? | Policy review, alert tests and documented exception handling |
| Regulatory fit | Do retention, residency and deletion rules permit the design? | Approval from the relevant legal or compliance owner |
| Cost and complexity | What storage, transfer, retrieval and operational burden does protection add? | Budgeted estimate and an exercised operating procedure |
| Provider concentration | Would loss of one provider account remove both production and recovery? | Independently secured secondary location where justified |
These are decision criteria, not a universal ranking. The right design depends on the organization’s critical services, regulatory obligations, staff capability and demonstrated restore results.
Communication, notification and documentation
Keep a contemporaneous incident record: decisions, timestamps, affected resources, evidence collected, isolation actions, credential changes, restoration sources and approvers. Coordinate internal updates through the trusted channel selected in the communications plan. Do not assume that a ransom note proves the full scope, or that the absence of a note proves no data access occurred.
Notification duties depend on jurisdiction, sector, contracts and the type of data involved. Have counsel and the relevant regulator or supervisory authority determine what must be reported and when. The available CISA guidance establishes the response sequence but does not provide a universal notification deadline for every organization.
Common mistakes that make recovery harder
- Shutting systems down immediately: this can destroy volatile evidence when network or access isolation would have worked.
- Restoring before removing persistence: an attacker-controlled identity, key or image can reinfect a clean workload.
- Leaving backups online and writable: reachable copies may be encrypted or deleted with production data.
- Using the compromised environment to rebuild: altered templates and policies can reproduce the compromise.
- Resetting only user passwords: service accounts, API keys, sessions, certificates and federation settings also require investigation.
- Restoring by convenience: bringing up low-value systems first can consume scarce staff and recovery capacity while critical dependencies remain unavailable.
- Assuming immutable means compliant or free: retention, residency, deletion and cost implications still require review.
- Communicating through monitored channels: visible containment plans can help an attacker react; use the approved out-of-band method.
Turn the incident into readiness work
After containment and restoration, hold a documented review with technical, operational, security, legal and communications participants. Identify the initial access path, controls that failed, evidence that was unavailable, decisions that delayed isolation and dependencies that were missing from the critical-asset list.
Update the incident and communications plans, golden images, infrastructure-as-code, backup retention, identity boundaries, alert rules and restoration runbooks. Exercise the revised process, including a scenario in which production credentials are unavailable and a provider account is partially compromised. Keep offline copies of the recovery templates and verify that changes to them are audited.
Preparation is measurable: you should be able to show which critical data is protected, who can restore it, how isolation is authorized, when the last restore test ran and which clean environment will host the service. Those records turn a checklist into an executable response.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
