Free tools Windows power users keep installed
One-click scans. No signup required.
Keep an up-to-date copy of important files somewhere malware on your device cannot readily change or delete. For local files, CISA recommends a separate external hard drive or a properly vetted cloud service. Disconnect an external drive when a backup finishes; for ransomware resilience, use offline, encrypted backups and test that you can restore them.
What makes a backup useful during malware cleanup?
A backup is useful only if it preserves files you need and remains available when the device holding the originals is infected, damaged, or being cleaned. A second copy on the same device does not provide that separation. A connected external drive may also be reachable by ransomware, while a cloud service that synchronizes files may copy encrypted or corrupted versions over unaffected ones.
As an Amazon Associate I earn from qualifying purchases.
Think of the goal as a recoverable copy, not merely a second place where the same files appear. CISA’s personal-data guidance, How to Protect the Data that is Stored on Your Devices, recommends an external hard drive or a properly vetted cloud service for locally stored data. Its StopRansomware Guide adds two important safeguards: keep backups offline and encrypted, and regularly test their availability and integrity.
Recommended Free Tools
That distinction matters during cleanup. If your only copy is on the affected device, cleaning or replacing it may leave you without the files. If your second copy is a drive that stayed attached, it may have been exposed to the same malware. And if your cloud account mirrors changes immediately, the cloud copy may no longer contain the older, unaffected files you expected. The useful question is therefore not simply “Do I have a backup?” but “Can I reach a clean, usable version of the files without relying on the infected device?”
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choose a destination that fits your recovery needs
The main options supported by CISA are a removable external drive and a vetted cloud service. Neither is automatically safe: the details of isolation, version history, update frequency, restore testing, and access to credentials matter.
| Consideration | External hard drive | Cloud service |
|---|---|---|
| Separation from the device | Can be disconnected after copying. CISA warns that a connected drive may be exposed to ransomware that could delete or corrupt backups. | Can provide a separate destination, but CISA does not rank or endorse specific providers. Check the service’s recovery controls. |
| Protection from encrypted or overwritten files | Offline storage helps limit access while disconnected. Whether older copies are retained depends on how you make and manage backups; CISA does not specify a particular drive setup. | Check whether recoverable prior versions are kept and how to restore them. CISA warns that automated cloud backups may sync encrypted local files and overwrite unaffected copies. |
| How often copies are updated | Connect and run backups often enough for your work and the amount of change you can afford to lose. CISA says to back up frequently but gives no universal personal schedule. | Update frequency and behavior depend on the service and its settings; verify them with the provider. |
| Restore testing | Not stated as an automatic feature; test by restoring files yourself. | Not stated as a universal feature; learn the restore process and test it yourself. |
| Credentials or encryption recovery key | Keep any required password or recovery key retrievable through a safe method. The exact requirements depend on your setup. | Keep account access and any encryption recovery key retrievable through a safe method. Provider-specific requirements vary. |
Use the table as a set of questions, not a brand ranking. CISA names these broad destination types but does not establish that one is best for every reader. A removable drive can offer a straightforward way to take a copy offline, but that depends on actually disconnecting it. A cloud service can keep a copy away from the device, but it is only a dependable recovery option if its version and restore controls meet your needs and you can still access the account.
When a removable drive makes sense
An external drive gives you a physical copy you can disconnect and store separately. Its most important safety habit is to connect it for the backup, wait for the job to finish, safely disconnect it, and store it somewhere protected. A drive left attached all the time is not offline, so malware that can reach the computer may also be able to reach the drive.
Keep the routine deliberate: connect the drive when you are ready to back up, let the copy complete, and then disconnect it rather than leaving it mounted for convenience. If you use encryption, make sure you have a safe way to retrieve the password or recovery key when needed. A drive that is securely isolated but impossible for you to unlock is not a useful recovery copy.
Think about what “complete” means for your setup. Do not unplug the drive while the backup is still running; confirm that the job has finished, then disconnect it safely. Since no one schedule fits every person, choose a repeat pattern that reflects how often your important files change and how much recent work you could tolerate losing. CISA calls for frequent backups without prescribing a universal personal interval.
When cloud storage may fit
A cloud service can be an off-device destination, but synchronization alone does not prove that clean historical copies will survive an incident. Before relying on a service, find out whether it preserves prior versions, how long those versions remain available, and how you restore one. This guidance does not establish current features for any particular provider, so verify the details with the provider rather than assuming every cloud plan behaves the same way.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Ask how the service behaves if files on your computer are encrypted, corrupted, or overwritten. CISA specifically cautions that automated cloud backups may sync encrypted local files and overwrite unaffected copies. A service’s ability to sync quickly is not the same as its ability to roll back to a clean earlier version. Learn what recovery controls are available, what steps you would follow to use them, and whether the account credentials needed for that process are accessible to you.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDo not select a provider based on a generic promise of “cloud backup” alone. The relevant details are the service’s current version-retention and restoration features, which can vary and should be checked with the provider. CISA’s guidance does not endorse named providers or verify their current features.
Set up a backup before malware cleanup is urgent
Make the plan while the device and files are accessible, rather than waiting until a cleanup is underway. Start with files that would be difficult or impossible to replace: personal documents, photos, and project files. Choose a separate destination, decide how often to update it based on how quickly those files change, and test a restore.
- Identify what matters. List the documents, photos, project files, and other personal data you would need if the device had to be cleaned or replaced. Prioritize files that cannot readily be recreated. Consider the files you would actually need to resume personal or project work, rather than assuming that a large undifferentiated copy is automatically useful.
- Choose a separate destination. Use an external hard drive or a properly vetted cloud service. For a cloud service, check the prior-version and recovery controls before treating it as your only backup. Ask yourself whether the destination could be changed from the same device if that device were infected.
- Make the initial copy. Copy the selected files to the destination and let the backup complete. A copy that has not finished is not a usable backup. Make sure the material you intended to protect is actually included, rather than assuming the presence of a destination means the right files were copied.
- Plan updates around your work. Back up frequently enough that the most recent changes you might lose are acceptable to you. There is no single interval established for every personal user; a person who changes important files often may need more frequent copies than someone whose files rarely change.
- Isolate a removable drive. Once the job completes, safely disconnect the external drive and store it safely. Reconnect it when you need to run the next backup. The protection comes from taking it offline, not merely from owning an external drive.
- Protect access. Make sure you can retrieve the account credentials and any encryption recovery key required to reach the copy. Keep that access information safe and separate enough that losing the device does not also mean losing the only way to decrypt or retrieve the backup. Do not rely on memory alone if you may not be able to access the affected device during recovery.
- Test restoration. Restore selected files to a suitable location and confirm that the files are available and usable. Repeat tests regularly, especially after changing the backup method or settings. A test checks both whether the copy can be reached and whether the material you need is intact.
Make the test a real restore
A backup job that reports completion is not proof that recovery will work. Test by restoring a selection of files from the destination, then check that you can open or otherwise use them. This is different from merely looking at a list of filenames or seeing that storage is occupied. The test should cover the actual route you would use in a recovery: access the account or drive, locate the intended files, and restore them to a suitable location.
CISA’s StopRansomware Guide says to “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” Availability means you can get to the copy; integrity means the restored data is usable and not damaged. The guide is organizational in focus, but those backup principles apply to the basic question every user faces: can I retrieve the files when I need them?
Keep a record of the recovery route that does not depend solely on the device being backed up. For example, know which account or drive contains the copies and where to retrieve any required credential or recovery key. This is not a substitute for protecting that information; it is a way to avoid discovering during an incident that you cannot find the access details.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to handle backups if you already suspect malware
If malware may already be present, do not assume that a backup destination connected to the device is protected. CISA warns specifically that a connected external drive could be exposed to ransomware. If you have a disconnected backup, leave it disconnected while you work out a safe recovery plan; do not treat it as clean merely because it is a backup.
The safest backup strategy is preventive: maintain copies before an incident. If you are trying to save files after an infection has begun, the correct steps can depend on the malware and device. The guidance here does not establish a consumer malware-removal sequence, so it cannot guarantee that copying files from an infected system is safe. Avoid using a suspected-infected device as the source for restoring onto a clean system until you have a clean backup and a recovery approach that avoids re-infection.
If the drive was attached during the incident, do not assume it escaped exposure; CISA warns that ransomware may use the connection to reach and delete or corrupt a backup. Likewise, if a cloud destination is synchronized, check whether unaffected prior versions remain available rather than relying on the newest visible copy. These cautions do not tell you which cleanup action to take for a particular infection. They are reasons to avoid treating every connected or synchronized copy as automatically safe.
Keep the source and destination clear in your mind during recovery. A backup is intended to be a trusted copy from which to restore, not a reason to copy everything from a potentially infected machine back onto a clean one. CISA’s organizational recovery guidance emphasizes avoiding re-infection when restoring. The exact consumer sequence varies with the malware and device, so seek an appropriate recovery approach for the situation rather than assuming one file-copy procedure fits all infections.
Restore without bringing the problem back
After cleanup, use a clean backup and take care not to re-infect clean systems during restoration. CISA’s detailed ransomware recovery guidance is aimed mainly at organizations, so the exact consumer steps can vary with the malware and device. The practical decision is to restore data from a backup you trust, not simply the newest copy if that copy may contain encrypted or corrupted files.
- Use a backup that was not exposed to the infection where possible; a drive that remained attached is not automatically a clean source.
- For cloud storage, look for a recoverable prior version if the current synchronized files were encrypted or overwritten.
- Restore a few needed files first and confirm that the copies are usable before relying on the restored data.
- Keep the backup isolated except when it is needed for a deliberate backup or restore operation.
During restoration, use the same checks you used when testing: can you retrieve the copy, are the files you need present, and are they usable? If a version appears encrypted or otherwise corrupted, it is not the right copy just because it is the most recent one. Prefer a clean version you trust. After restoring, maintain the separation that made the backup useful in the first place instead of leaving the only backup copy continually exposed.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Common backup failures to avoid
- Leaving the only external copy connected: ransomware may be able to access and damage it. Disconnect it when the backup is complete.
- Assuming synchronization preserves history: automated cloud backups may sync encrypted files. Verify prior-version retention and the restore process.
- Never trying a restore: a completed copy is not proof that files can be recovered. Test availability and integrity regularly.
- Losing the key or account access: an encrypted or account-protected copy is of little use if you cannot retrieve the credentials or recovery key. Keep them safely retrievable.
- Choosing an update schedule by habit rather than need: CISA recommends frequent backups but does not set a universal interval. Set updates according to how much recent work you could tolerate losing.
- Confusing a second copy with a separate copy: another folder on the device being protected does not help if the device itself is compromised or unavailable. Choose a distinct destination.
- Assuming all cloud plans retain older versions: CISA warns that synced encrypted files may overwrite unaffected copies. Check the provider’s actual recovery controls rather than inferring them from the word “backup.”
- Assuming a backup is clean because it is old or stored elsewhere: a copy’s usefulness depends on its availability and integrity. Test it and, after an incident, use a clean backup while avoiding re-infection.
What the guidance establishes—and what it doesn’t
CISA’s How to Protect the Data that is Stored on Your Devices supports the core personal-data practices in this guide: keep a separate copy of local files, disconnect an external drive when it is not actively being used for backup, and use a properly vetted cloud service if that fits your needs. CISA warns: “Avoid leaving the external drive connected when not actively backing up your data as the connection could be used by ransomware to gain access to the drive and delete or corrupt your backups.”
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →CISA’s StopRansomware Guide recommends offline, encrypted backups and regular tests of availability and integrity. It also supports taking care during recovery to avoid re-infecting clean systems. The detailed ransomware recovery advice is primarily for organizations, so it should not be mistaken for a complete consumer malware-removal sequence.
The guidance does not identify a preferred cloud provider, verify any provider’s current version-history features, prescribe a personal backup interval, or provide a complete consumer malware-removal sequence. Treat those as questions to verify for your own service and device rather than assuming a universal answer. The practical standard remains straightforward: make a separate copy, keep it out of reach when possible, know how to access it, and test that recovery works.
Frequently Asked Questions
How do I back up my files before removing malware?
The safest plan is to make and test a separate backup before an infection occurs. Prioritize irreplaceable documents, photos, and project files; use an external hard drive or a properly vetted cloud service; and verify that you can restore files. If malware is already suspected, do not assume it is safe to copy files from the infected device or to use an attached backup. The correct recovery steps depend on the malware and device.
Can ransomware infect my backup drive?
A drive connected to a device may be reachable by ransomware. CISA advises disconnecting an external drive when it is not actively being used for backup because a connection could let ransomware access and delete or corrupt the backup. For ransomware resilience, CISA recommends offline, encrypted backups and regular tests.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is cloud syncing enough to protect files from ransomware?
Not necessarily. CISA warns that automated cloud backups may sync encrypted local files and overwrite unaffected copies. Before relying on a cloud service, check whether it preserves recoverable prior versions and learn how to restore them. Features vary by provider, so verify current details rather than assuming synchronization keeps a clean history.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
How often should I back up my important files?
CISA recommends backing up frequently but does not set one interval for every personal user. Choose a schedule based on how often your important files change and how much recent work you could tolerate losing. Files that change often may need more frequent copies than files that rarely change.
How can I tell whether a backup will work?
Test a restore: retrieve selected files from the drive or cloud destination, restore them to a suitable location, and confirm they are available and usable. CISA’s StopRansomware Guide recommends regularly testing backup availability and integrity; a completed backup job alone does not prove that restoration will succeed.
Should I restore the newest backup after malware cleanup?
Not automatically. If ransomware encrypted or corrupted files before the backup or synchronization updated them, the newest copy may not be clean. Use a backup you trust, check for recoverable prior versions where relevant, and take care not to re-infect clean systems during restoration.
Should I encrypt my backup, and what if I lose the recovery key?
CISA recommends offline, encrypted backups for ransomware resilience. Keep any required password or encryption recovery key retrievable through a safe method. If you cannot unlock the backup or access the cloud account, the copy may be unusable when you need it; the exact access requirements depend on your setup.
The Bottom Line
Make a separate copy of the files you cannot replace, update it often enough for your work, and test that you can restore it. Disconnect an external drive when the backup is complete; with cloud storage, verify that prior versions and recovery controls can protect you from synced encryption. CISA recommends offline, encrypted backups and regular tests, and recovery should use a clean copy without re-infecting restored systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
