What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The most resilient setup keeps several copies of important data, including at least one encrypted copy that ransomware cannot reach through your everyday computer, user account, or network. A removable external hard drive or SSD can provide an offline copy when you disconnect it after the backup. Keep the decryption key or recovery information separately, and periodically restore files to prove the backup is usable.
What a ransomware-resistant backup actually means
Ransomware can encrypt files on a computer and then search for storage that the same account or device can access. It may reach mapped network drives, attached USB disks, shared folders, backup software credentials, and cloud services. A backup job that reports “completed” is not necessarily a recovery copy: if the backup remains continuously reachable, the attacker may encrypt or delete it as well.
As an Amazon Associate I earn from qualifying purchases.
The goal is not to make destruction impossible. No backup arrangement guarantees protection against every attack. The practical goal is to reduce an attacker’s reach, preserve more than one recoverable version, and verify that restoration works.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Cybersecurity and Infrastructure Security Agency (CISA) states: “Maintain offline, encrypted backups of data and regularly test your backups.” That sentence captures the essential controls: isolation, encryption, and restoration testing.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Build the 3-2-1 foundation
CISA, the FBI and the Australian Cyber Security Centre describe the 3-2-1 rule as a useful guideline:
- Three copies: the working data plus two backup copies.
- Two media types: for example, an internal disk and a removable drive, or local storage and a separately managed cloud backup.
- One offline copy: at least one copy is disconnected or otherwise isolated from normal devices and accounts.
This is a design target, not a guarantee. Three copies that all use the same administrator password, sit on the same network, or are updated by the same compromised software can fail together. Diversity and isolation matter as much as the count.
Decide what belongs in the plan
Start with an inventory rather than with a storage purchase. Include documents, photographs, videos, source code, databases, browser exports, password-manager recovery material, tax records, and work in progress. For a business, include virtual-machine images, configuration files, certificates, license keys, shared drives, and the files needed to rebuild critical applications.
Record where each item currently lives, how often it changes, how quickly it must be restored, and how much loss is acceptable. A file that can be recreated from yesterday’s version has a different schedule from a live project that changes every hour.
Set a recovery-point target
Your backup interval should reflect the maximum amount of recent work you are willing to recreate. If losing a day of work is acceptable, a daily backup may be sufficient. If losing an hour is unacceptable, use a shorter interval or continuous versioning for the online copy, while still preserving a separate offline copy. Official guidance recommends backing up regularly but does not prescribe one universal interval.
Rank #2
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Choose copies that an attacker cannot reach together
Working storage
Your computer or primary server is the first copy, but it is not a backup. Ransomware normally starts here, so never count the working disk as your only protected copy.
Removable offline storage
An external hard drive or SSD is a straightforward way to make an offline copy. Connect it for the backup, allow the job to finish, eject it safely, and physically disconnect it. While attached, the drive is still exposed to ransomware running under your account; the isolation begins when it is disconnected.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteKeep the drive in a secure, dry location. If you maintain two rotating drives, one can be stored away while the other is being updated. Rotation limits the damage from a failed disk, accidental deletion, theft, or a ransomware event that occurs while one drive is connected.
Network and cloud copies
A network share, network-attached storage device, or cloud service may improve convenience and restoration speed, but availability is not the same as isolation. If ransomware can authenticate to the service or write through a synchronization client, it may encrypt the local files and propagate those changes. CISA specifically warns that automated cloud backups can sync attacker-encrypted files and overwrite previously unaffected data.
Use cloud storage as one layer only when the service and account configuration provide meaningful separation, such as version history, immutable retention, a separate account, or access that is not continuously available from the protected computer. Do not describe a continuously synchronized folder as offline. Keep an independent copy that does not depend on the same credentials or client software.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
System images and rebuild materials
For a home computer, a file backup may be enough if the operating system and applications can be reinstalled. For an organization, recovery may also require system images, virtual-machine templates, installation media, configuration exports, documented procedures, and identity or encryption recovery information. Store those materials under the same isolation and testing rules as ordinary files.
Encrypt the backup without losing the key
Encryption protects a lost or stolen drive and is part of CISA’s offline-backup recommendation. It does not help if the only copy of the decryption key is stored on the computer that ransomware has compromised.
Keep recovery information separate
Store the encryption key, recovery code, or password through a separate secure route available to authorized users. Examples include a password manager with an emergency-recovery process, a separately protected administrative account, or a sealed written record kept in a secure location. Do not place the key in an unencrypted text file beside the backup.
Document who is authorized to retrieve the key and how access works if the usual administrator is unavailable. For a business, use more than one trained custodian and record the procedure in the recovery plan. Test the key on a non-production copy; a key that has never been used in a restore is an unverified assumption.
Protect credentials used by backup software
Give backup services only the permissions they need. Avoid using a daily workstation administrator account as the owner of every backup destination. Separate backup administration from ordinary email and web-browsing accounts, enable multifactor authentication where supported, and keep emergency credentials out of the files being backed up.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
A practical setup for a home computer
- List critical folders and data. Include user documents, photographs, project directories, exported financial records, and any files needed to recover encrypted archives.
- Prepare two destinations. Use a continuously available copy for convenience and a removable drive or other genuinely isolated destination for the offline layer. Use different storage types where practical.
- Enable encryption. Choose encryption offered by the backup software or operating system, and record the recovery key through a separate secure method before the first job runs.
- Run the initial backup. Check that the job includes the intended folders, reports no unreadable files, and completes without silently excluding large files or unsupported formats.
- Disconnect the removable copy. Eject the drive, unplug it, and store it safely. Do not leave it attached merely because the backup program is idle.
- Schedule updates. Match the schedule to your recovery-point target. A daily job may suit documents that change once a day; active projects may need more frequent updates.
- Rotate or replace media. Keep another offline copy when possible so one drive can be stored away while the other is refreshed. Replace a drive that reports errors or has reached the end of its service life.
- Restore sample files. Open restored documents, play restored media, and compare file counts and dates. Test both the backup data and the decryption key.
Enterprise and team considerations
Organizations need a recovery process, not just a collection of disks. NIST’s ransomware guidance calls for carefully planning, implementing, and testing a backup and restoration strategy, with backups isolated so ransomware cannot readily spread to them.
Separate production and backup administration
Use dedicated backup accounts and limit their permissions. If a directory service account is compromised, an attacker should not automatically control every backup repository. Review who can delete backups, change retention, or disable multifactor authentication. Alert on those administrative actions.
Use retention and versioning deliberately
Keep multiple historical versions so an unnoticed encryption event does not replace the only clean copy. Retention length should reflect how long it might take to discover an incident, the legal or operational need for historical records, and available capacity. A longer retention period is useful only if older versions cannot be deleted by the same compromised account.
Include operational technology carefully
NIST Special Publication 1339, published in June 2026, addresses ransomware recovery in operational-technology environments. Industrial systems may require coordinated shutdowns, validated images, safety checks, and rebuild procedures that do not apply to a home laptop. Organizations operating production or control systems should adapt the isolation and testing principles to those safety requirements rather than copying a consumer workflow.
Test restoration, not just backup completion
A successful backup log proves that a process ran; it does not prove that the files are complete, readable, current, or decryptable. CISA recommends regular testing of availability and integrity, and NIST likewise treats restoration testing as part of the strategy.
Best Value
- USB-C and USB 3.1 compatible.Specific uses: Business, personal
- Innovative style with refined metal cover
- Password protection with 256-bit AES hardware encryption
- Formatted for Mac
Use a tiered test schedule
- Every backup cycle: review warnings, skipped files, capacity, and the timestamp of the newest successful copy.
- Periodically: restore a representative sample, including a large file, a recently changed file, an old version, and a file with special permissions or metadata.
- After major changes: test when changing backup software, encryption settings, storage accounts, operating systems, or retention rules.
- For organizations: run a recovery exercise that uses isolated hardware or a clean test environment. Measure how long it takes to obtain credentials, locate the right version, restore data, and return a service to operation.
Check more than whether a file opens
Compare restored file names, sizes, timestamps, and expected counts. Open office documents, extract archives, query a restored database, and play a selection of media. For system images, confirm that the image can boot in the intended recovery environment. Record failures and correct the process before an incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare backup approaches by ransomware exposure
| Approach | Can ransomware reach or delete it? | Encryption and key recovery | Update and restore characteristics | What must be tested |
|---|---|---|---|---|
| Attached external drive | Yes, while connected to the infected device or account. | Must be configured separately; the key must not depend on the same compromised device. | Fast local transfers and large capacity; easy to forget to disconnect. | Job completion, safe ejection, decryption, and sample-file restoration. |
| Disconnected removable drive | Usually not reachable through the infected computer while unplugged. | Encrypt the drive or backup set and preserve recovery information separately. | Updates require a deliberate connection; restoration is usually fast once the drive is available. | Drive readability, current contents, key access, and physical rotation. |
| Network share or network-attached storage | Potentially yes if the attacker can use the logged-in account or network credentials. | Depends on the backup system; separate administrative access is important. | Convenient and often quick, but exposed during an incident unless isolated. | Access controls, version retention, deletion resistance, and an offline fallback. |
| Cloud synchronization | Potentially yes; encrypted local files may synchronize and overwrite clean data. | Account security and service recovery options are separate concerns from file encryption. | Very convenient and current, but synchronization can copy damage. | Version recovery, account recovery, independent export, and restoration outside the sync client. |
| Cloud backup with isolated retention | Risk depends on account permissions, retention controls, and whether deletion is separately authorized. | Confirm who controls encryption and how an authorized user retrieves the key. | Can provide off-site capacity and faster remote recovery than shipping media. | Immutability or version retention, credential separation, complete restore, and outage procedures. |
Common failure modes and fixes
“The backup is on a USB drive, so it is safe.”
A USB drive is not isolated while attached. Schedule a disconnect step, eject it properly, and store it away from the computer.
“Everything is synchronized to the cloud.”
Synchronization mirrors changes, including malicious encryption or deletion. Retain an independent versioned or offline copy and test recovery without relying on the synchronization client.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute“The job says successful, but restores fail.”
Look for skipped files, permission errors, full destinations, damaged media, expired credentials, or a missing encryption key. Restore small samples after configuration changes instead of waiting for an incident.
“The only backup password is on the protected laptop.”
That creates a single point of failure. Store recovery information separately and ensure an authorized second person can retrieve it when necessary.
“One clean copy is enough.”
A drive can fail, be stolen, be overwritten, or be encrypted during the backup window. Multiple copies on different media reduce the chance that one event removes every recovery option.
“We never need to test because the data is rarely changed.”
Unreadable media, expired accounts, and forgotten keys can affect old files even when the data itself is static. A small scheduled restore is evidence that the process still works.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
What to do after a suspected ransomware incident
- Isolate affected devices. Disconnect network access and removable media to reduce further spread. Do not reconnect the offline backup until the environment is understood to be clean.
- Preserve evidence and follow your incident plan. For organizations, involve the security, legal, and recovery teams and follow applicable reporting requirements.
- Identify a clean restoration point. Check timestamps and versions rather than assuming the newest copy is safe.
- Rebuild or clean the destination. Restoring into a still-compromised system can re-encrypt recovered files.
- Retrieve the key through the separate recovery route. Confirm that the authorized person, not the compromised workstation, controls access.
- Restore in priority order. Recover systems and files needed to resume essential operations first, then less-critical data.
- Validate the result. Open files, verify application data, and monitor restored systems before declaring recovery complete.
A maintenance checklist
- Inventory critical files, systems, and rebuild materials.
- Maintain at least three copies, on two media types where practical.
- Keep at least one encrypted copy offline or otherwise isolated.
- Disconnect removable media after each update.
- Separate backup administration and encryption recovery from everyday accounts.
- Set a schedule based on acceptable data loss, not convenience alone.
- Review logs for skipped files, errors, capacity problems, and stale timestamps.
- Restore representative files regularly and document the result.
- Exercise the full recovery process after major system or credential changes.
- Rotate, replace, and securely retire failing or obsolete media.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
