A backup is a security and recovery layer, not a shield. It cannot stop malware, block a ransomware intrusion, or guarantee that every file can be recovered. It can, however, sharply reduce the damage from a failed drive, software corruption, accidental deletion, malware, or ransomware when a clean, usable copy exists.
The safest plan combines two properties that solve different problems: automatic backups that run often enough to capture recent work, and at least one encrypted copy kept offline or otherwise out of reach. You also need to test restoration. An untested copy may fail precisely when the original computer is unavailable.
As an Amazon Associate I earn from qualifying purchases.
What a backup does for security
Security is often described as prevention, but recovery is part of security as well. If a laptop drive dies, an update corrupts files, or an attacker encrypts a workstation, a separate copy lets you rebuild instead of negotiating with the failure. File backups can restore individual documents and folders. An image backup can preserve a larger system state so the computer can be returned to an earlier working configuration.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallLeo A. Notenboom’s Ask Leo! article, updated December 22, 2025, frames the practical value clearly: a backup does not make an attack impossible; it limits the consequences. That distinction matters when setting expectations. You are buying time and options, not immunity.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Failures a current copy can address
- Hardware failure: A failed internal drive can be replaced while data is restored from another device or service.
- Software corruption: Damaged files or a broken system can be rolled back to an earlier copy.
- Accidental deletion: A prior version can recover a file emptied from the normal recycle or trash workflow.
- Malware: A clean restore point can remove the need to keep damaged or altered files.
- Ransomware: An offline or otherwise protected copy can provide a recovery path without relying on encrypted originals.
What it cannot do
A backup does not prevent an infection, identify a phishing message, patch a vulnerability, or stop an attacker from operating on a live computer. If the only copy is connected and writable, malware may encrypt or delete it too. A backup also cannot restore data that was never included, was already corrupted before the backup ran, or was overwritten without retaining an older version.
Why ransomware can encrypt a backup
Ransomware usually acts with the permissions available on the compromised computer. Any backup share, mounted external disk, or synchronized folder that the infected account can write to may be reachable. Attackers can encrypt those files, erase them, or target backup catalogs so recovery software cannot find earlier versions.
That is why “I have a backup” is incomplete. Ask whether the copy is reachable from the computer, whether older versions are retained, and whether a clean restore has been demonstrated. CISA’s StopRansomware Guide states: “It is critical to maintain offline, encrypted backups of data and to regularly test your backups.” The advice addresses both access and confidence: isolation makes destructive access harder, while testing proves that the files and the restoration process work.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Offline is a different control from automation
An automatically scheduled backup may run every day or continuously, but a disk left attached is still exposed while the computer is compromised. A periodically disconnected disk is less convenient, yet malware on the computer cannot normally alter it while it is physically or logically offline. CISA’s June 2025 ransomware advisory gives a clean offline backup on a separate device, such as an external hard drive, as an example and recommends removing the device after the backup completes.
These controls should not be treated as alternatives. Automation improves freshness; disconnection improves isolation. Use automation for the routine copy and a separate offline or immutable destination for a protected copy.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Build a backup plan that balances freshness and isolation
- List what must be recoverable. Include personal files, work folders, photos, project data, browser or application exports, and any configuration that would be expensive to recreate. Decide whether you need individual files, a complete system image, or both.
- Choose a routine schedule. Set an automatic daily or continuous process so it does not depend on remembering. Ask Leo! emphasizes that a process working without your intervention is more important than worrying about a theoretical failure mode. A manual-only routine is easy to postpone and eventually forget.
- Keep historical versions. Configure retention so a newly encrypted or accidentally overwritten file does not replace the only usable copy. The exact retention period depends on how quickly you notice a problem and how much storage you can allocate.
- Add an isolated destination. Maintain a separate copy on an external device that is disconnected after backup completion, or use storage designed to be offline, off-site, or immutable. The isolated copy should be encrypted and protected from casual access.
- Protect the backup account and device. Use a strong, unique credential, enable available multi-factor authentication, and restrict who can delete or alter backup data. Separation is valuable only if an attacker cannot simply use the same account to destroy every copy.
- Record the recovery method. Note where the copies are stored, which credentials or keys are required, and how to boot or reinstall the tools needed for restoration. Keep this information available when the primary computer is unavailable.
- Run a restore test. Restore a sample file first, then periodically perform a broader test in a spare location or on replacement hardware. Record what succeeded, how long it took, and which steps need clarification.
How common backup approaches differ
| Approach | How it runs | Version history | Can ransomware on the computer reach it? | Off-site or offline protection | Typical recovery use |
|---|---|---|---|---|---|
| Connected local backup drive | Convenient automatic or scheduled jobs | Depends on the software and retention settings | Yes, while the drive is mounted and writable | Not offline while attached; off-site only if physically moved | Fast recovery from recent local copies |
| External drive removed after backup | Automatic job followed by a manual disconnect | Depends on the backup configuration | Much harder to reach after disconnection | Offline; it becomes off-site only when stored elsewhere | Recovery from ransomware or a compromised computer |
| Cloud backup or synchronization service | Usually automatic, subject to account and network availability | Recycle-bin and version features vary by service and configuration | Potentially, if the infected account can synchronize, delete, or encrypt content | May be geographically separate; not automatically offline or immutable | Convenient access and recovery across devices |
| System image backup | Scheduled or manual image creation | Depends on how many images are retained | Reachability depends on where the image is stored | Can be offline, off-site, or immutable when the destination supports it | Returning an entire system to an earlier state |
| Immutable or protected repository | Usually scheduled through backup software or a managed service | Retention is enforced by the repository’s policy | Designed to prevent ordinary deletion or alteration during the retention period | Can be offline or off-site, depending on the implementation | Recovery when attackers target normal backup files |
The table describes design properties, not a guarantee for every product. Verify the retention, deletion permissions, encryption behavior, and restore workflow in your specific edition and configuration.
Connected versus disconnected drives: a practical compromise
When leaving a drive connected helps
A permanently connected destination supports unattended daily or continuous backups. That convenience increases the chance that a recent copy exists, especially for people who cannot reliably remember to plug in a disk. It is reasonable for the routine working copy when the backup software is configured with version retention and the destination is not the only recovery source.
Recommended Free Tools
When disconnecting matters
After the scheduled job completes, ejecting the external drive removes its normal path from the compromised operating system. Store it somewhere physically separate from the computer. If a fire, theft, power event, or other local incident is in scope, move a copy to another location as well; an offline disk beside the computer is isolated from ransomware but not from a disaster affecting the room.
Do not disconnect before the backup has finished or before the software confirms that the catalog and files are complete. A half-written copy is not a reliable recovery point.
Cloud storage is not automatically a backup
Online services can provide useful recovery features, including recycle bins or historical versions, and they can protect against a local drive failure. Their behavior varies by service, account type, synchronization settings, and retention policy. A synchronized folder may mirror encryption or deletion from the infected computer rather than preserve an independent clean copy.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Check the specific service for how long deleted items remain available, whether older versions are retained, what an administrator can permanently delete, and whether an account compromise can remove every copy. Treat synchronization as one component unless you have verified that it supplies independent versioned backups and a workable restore process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Image backups and file backups solve different recovery problems
A file backup is efficient when you need a document, folder, or set of photos. An image backup captures the operating system, applications, settings, and data in a state that can be restored as a unit. That can be valuable after severe software corruption or a system compromise, when rebuilding the machine manually would take longer than restoring an earlier image.
Images are not inherently safer than file copies. If the image repository is connected and writable, ransomware may still reach it. Retain more than one restore point when storage permits, and keep at least one image or file copy in the offline, encrypted tier.
How to test whether a backup is usable
- Choose a representative sample. Select several recent files, an older file, and—if you rely on images—a test computer or spare drive.
- Use the documented recovery path. Restore to a separate folder or replacement disk rather than overwriting the only live copy.
- Open and verify the results. Check that documents open, photos display, permissions are usable, and filenames and dates are sensible.
- Measure the process. Note the time required, network or hardware dependencies, encryption keys, and any step that assumes the original computer is still running.
- Update the plan. Fix failed jobs, increase retention, replace an unreliable device, or revise instructions before the next incident.
CISA specifically recommends regular tests of backup availability and integrity. A successful copy operation is not proof that restoration will succeed; only a restore test answers that question.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and fixes
“The backup says it ran, but the file is missing”
Check whether the folder was included, whether an exclusion rule removed it, and whether the job completed without errors. Restore from an earlier version if the newest copy was incomplete, then adjust the selection and retention policy.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
“Ransomware encrypted the attached backup”
Disconnect unaffected devices, preserve evidence needed for investigation, and do not reconnect the suspected backup until the computer is clean. Recover from the separate offline, immutable, or otherwise protected copy. Rebuild or clean the system before restoring data so the original malware does not immediately encrypt the restored files.
“The only backup is an old disk”
Use it as a starting point, not as proof that the current data is safe. Establish an automatic routine copy, create a fresh isolated copy, and test both. Older media may also have unreadable sectors or missing software needed to interpret the files.
“Cloud files disappeared everywhere”
Review the service’s recycle bin, version history, retention window, and account audit information. If synchronization propagated deletion or encryption, rely on an independent backup rather than assuming the cloud folder itself is a second copy.
A short security checklist
- Automatic backups run on a defined schedule.
- Recent versions and older recovery points are retained.
- At least one copy is encrypted and offline, off-site, or immutable.
- The isolated copy is removed or disconnected after completion.
- Backup credentials and deletion permissions are protected separately from the computer.
- File and image restores have been tested on a regular schedule.
- Recovery instructions, keys, and device locations are documented.
The security result
Backups are great security because they turn many catastrophic failures into recoverable events. Their value is highest when the process is automatic enough to stay current, the destination cannot be reached by the same ransomware that attacks the computer, and restoration has been proven in advance. Keep the connected copy for freshness, add a disconnected or immutable copy for isolation, and test both. That combination does not stop an attack, but it prevents one compromised machine from becoming the end of your data.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
