The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To recover from ransomware, keep a current, encrypted copy of important data somewhere the infected device cannot alter or delete it, and test that you can restore it. A backup connected to the device—or a sync service that mirrors file changes—may be affected by the same attack. CISA recommends offline, encrypted backups of critical data and regular tests of their availability and integrity.
What makes a backup useful against ransomware?
Ransomware can encrypt or block access to files on a device. It may also seek out backups that the device or its user account can reach, then delete or encrypt those copies. A backup only helps if a usable version survives the incident and you can access the credentials and keys needed to restore it.
As an Amazon Associate I earn from qualifying purchases.
CISA’s #StopRansomware Guide, revised October 19, 2023, advises: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” In practical terms, aim for a protected copy beyond the everyday reach of your device or account, disconnect removable media when the backup is complete, and periodically restore sample files to check the process.
There are two separate questions to ask about every backup: can an affected device reach or change it, and can you get a usable copy back if the device or account is unavailable? Encryption helps protect stored data, but it does not by itself make a backup resistant to deletion by an account or device that has access. Conversely, an isolated copy is not useful if it is incomplete, out of date, or locked behind a lost password or key. A good plan addresses both protection and recovery.
#1 Best Overall
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Separate the backup from everyday access. If an infected computer can write to a backup drive or cloud account, an attacker may be able to reach that copy too. Keep at least one copy offline or otherwise protected from alteration.
- Keep older recoverable versions. A copy that only reflects the latest changes may contain encrypted files. Version history or restore points can help, but check how they work and how long they remain available.
- Prove recovery works. A successful backup job is not the same as a successful restore. Test recovery of files, and for an organization, the systems and dependencies needed to resume critical work.
- Protect access information. Store backup passwords, encryption keys, and account recovery information securely but separately from the device they unlock.
For a household, that may mean preserving a separate copy of irreplaceable files and checking that more than one authorized person can find the recovery instructions if the primary computer is unavailable. For a small organization, it means deciding who is allowed to restore data and ensuring that person can reach the protected backup and its required credentials without relying on a compromised everyday account.
How is backup different from synchronization?
Synchronization keeps copies of files aligned across devices or accounts. That is useful for access and collaboration, but it may also copy an unwanted change everywhere. If ransomware encrypts local files and the sync service uploads those changed versions, unaffected cloud copies could be overwritten. CISA warns that automated cloud backups may not be sufficient in this situation; the service’s version history or restore points need to be checked rather than assumed.
A backup is intended to provide a recoverable copy from an earlier point. Some services offer both sync and backup features, but the label alone does not establish protection. Check whether the copy is isolated from ordinary device access, whether older versions persist after mass changes, and whether you can restore the data with the access you will have during an incident. CISA also recommends considering cloud-to-cloud backups for cloud resources.
When evaluating any option, ask what happens after a large number of files are changed, encrypted, or deleted. Does the service retain prior versions or restore points? How long are they kept? Can an ordinary user or compromised account erase them? What credentials are needed to select a recovery point and retrieve files? A clear answer to each question matters more than whether the service calls itself “sync,” “backup,” or “protection.”
| Approach | What to verify | Ransomware consideration |
|---|---|---|
| External hard drive or SSD | That the backup completes, needed files are present, and you can restore them. | A connected drive may be reachable from the computer. Disconnect it when the backup session is finished; a single drive can fail, be lost, or become outdated. |
| Cloud synchronization | Whether version history or restore points exist, how long they are retained, and how restoration works. | Encrypted or deleted local files may sync to the cloud. Synchronization alone should not be treated as proof of an independent backup. |
| Managed backup service | Which devices, files, and systems are covered; whether copies are protected against alteration or deletion; retention; credentials; and restore procedure. | Protection depends on the service’s actual configuration and coverage. Test a restore instead of relying on a product description. |
These are decision criteria, not a ranking of products. The official guidance cited here does not compare consumer vendors, drive capacities, speeds, or prices. Choose based on what needs protection and whether the copy stays recoverable if the everyday device or account is compromised. Capacity should reflect the amount of data you need to preserve; no particular drive size, speed, or price is established by CISA’s guidance.
Build a backup plan for personal devices
Start with the files and settings you would need to rebuild your life or work: personal documents, photos, project files, and other irreplaceable data. For a small organization, include operational records and the data needed to provide critical services. Then account for where that information lives; a computer backup will not automatically cover a separate cloud account or another device.
Rank #2
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- List important data and its location. Note which computer, phone, external storage, or cloud resource holds each item. Identify what is difficult or impossible to recreate. Use the list to spot gaps, such as important files that live only in a cloud account or on a second device.
- Select a backup method that keeps a copy protected. A removable drive is one practical option: copy the data, verify it, and disconnect the drive. A configured service may also work if its coverage, retention, protection from deletion, and restore access meet your needs. Ask whether the service protects copies from changes made through the everyday device or account.
- Use encryption and preserve the means to unlock the copy. CISA’s device-data guidance discusses protecting stored data and safely keeping passwords and keys. Keep the relevant secrets somewhere secure and recoverable; an encrypted backup is of little use if its key is lost. Do not keep the only copy of a key on the device or account that the backup is meant to help recover.
- Back up again when important data changes. Choose a cadence that keeps the copy current enough for your needs. The cited guidance calls for regular backups and restore testing but does not prescribe a universal interval. Consider how much recent work you could afford to recreate if a device were affected before its next backup.
- Disconnect or otherwise isolate the completed copy. Do not leave removable backup media continuously attached if it can be reached by the everyday device. For online copies, understand what prevents a compromised device or account from changing or deleting the backup.
- Test restoration. Restore sample files to a separate location and open them. Check that names, contents, and any needed folder structure are intact. Record the steps and the credentials or keys required. A test should establish that you can find a prior version and complete the restore, not just that a backup job reported success.
An external hard drive or SSD is a storage choice, not a complete recovery strategy by itself. Capacity should fit the data you need to protect; no particular capacity, speed, or device type is established by the cited guidance. Keep another protected copy where possible, and do not let one drive become the only copy of important information.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAfter a backup session, put the removable drive somewhere secure and disconnected from the computer. A drive left attached for convenience can be exposed to the same incident as the files it holds. At the same time, avoid treating one successful copy as permanent protection: the drive can fail, be lost, or simply miss files added since the last session. Revisit your data list when you add a device, move files to a cloud account, or change how you store important work.
Plan recovery for a small organization
Organizations need to recover services as well as files. Microsoft identifies gaps such as backups that are online and alterable, untested enterprise restores, and missing backups of critical systems as preparedness weaknesses in its ransomware preparation guidance. A backup plan should therefore document scope, priorities, dependencies, access, and testing—not just the location of a backup job.
- Define critical data and systems. Decide which business services matter most and what data or systems each depends on. Rank restoration priorities before an incident, rather than choosing under pressure.
- Check coverage. Confirm that backup plans include critical systems and their data, not only user documents. Include cloud resources and other accounts where relevant.
- Protect backup infrastructure and credentials. Consider whether a compromised everyday account or device could alter or delete backups. Secure the credentials and recovery keys needed to reach protected copies.
- Test an end-to-end restore. Verify that the team can recover data and the systems needed to use it, following the intended priority order. A completed backup task does not establish that an organization can restore operations.
- Document ownership and dependencies. Make clear who can initiate a restore, who holds the necessary access information, and which systems must be available first. Keep the instructions accessible to authorized responders if normal systems are unavailable.
Think through dependencies as part of the priority list. A critical service may rely on data, systems, or cloud resources that also need to be restored. The plan should identify those dependencies and the order in which recovery needs to happen. Otherwise, a team may restore a data set but still be unable to use it because a required system or account is unavailable. Test the actual sequence with the people who would carry it out.
Review the plan from the perspective of an incident in which normal devices, accounts, or backup access methods cannot be trusted. Can responders locate the instructions? Do they know which copies are protected and which recovery point to use? Can they retrieve required credentials and keys? These questions help surface gaps that a routine backup status report cannot answer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft 365 Backup documentation describes choosing a restore point for OneDrive or SharePoint, either manually or with a tool-recommended express restore point. That is a product-specific example, not evidence that every account or file is covered by default. Administrators should check the applicable plan, coverage, retention, and restore access. Microsoft’s procedure is documented at Restore data in Microsoft 365 Backup. Organizations using other cloud services should likewise verify what is covered and how a restore is initiated rather than assuming the Microsoft workflow applies to them.
Rank #3
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
What to do if ransomware is already active
Do not begin by reconnecting an affected device to backup media or restoring files onto it. First contain the incident and protect clean systems. CISA’s response guidance calls for isolating affected systems and restoring from offline, encrypted backups in line with critical-service priorities; it also warns against reinfecting clean systems during recovery.
- Isolate affected systems. Follow incident-response guidance to prevent affected devices from communicating with or contaminating clean systems. Do not use them to access backup credentials or attach protected backup media.
- Establish what is affected and what is clean. For a business, a qualified incident response team may need to verify containment and system cleanliness before restoration. Avoid restoring over an infected system before it is ready.
- Choose a known-good recovery point. Use an offline or otherwise protected backup and select a version from before the damaging changes. Confirm that the necessary credentials and encryption keys are available.
- Restore according to priority and dependencies. For organizations, bring back critical services in the planned order and confirm systems are clean before reconnecting them. For an individual, first restore important files to a clean device or environment.
- Validate the result. Open restored files and confirm that the data is usable before treating the recovery as complete. Recheck backup access and the plan after the incident.
Restoration is not a reason to rush a potentially infected device back into normal use. An available backup and a clean destination are different things: keep the affected system isolated while containment and recovery decisions are made. For an organization, use the planned priorities and have qualified responders verify that systems are clean before reconnecting them. For an individual, restoring important data to a clean device or environment helps avoid relying on the system that was hit.
CISA’s #StopRansomware Guide provides the broader response and recovery guidance. If the scope is unclear or business systems are involved, do not improvise a restoration that could expose clean devices or copies; use qualified incident-response help.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How to check whether a backup is ransomware-ready
Review the plan from the perspective of someone who cannot trust the everyday device or account. A “yes” should be based on a demonstrated restore or a documented protection setting, not an assumption.
- Does the backup include every important device, account, and cloud resource?
- Can an infected device or compromised everyday account alter or delete every copy?
- Can you retrieve an earlier version after widespread file changes?
- Do you know how long older versions or restore points remain available?
- Are passwords, encryption keys, and account recovery methods available securely if the primary device is unavailable?
- Have you restored sample files recently, and—for an organization—tested critical systems and dependencies?
- Can you isolate affected systems and identify a clean recovery point before restoring?
If any answer is uncertain, treat it as an unresolved recovery dependency. Clarify the setting or procedure, then test it. The goal is not simply to have a copy; it is to have a current, protected copy that authorized users can restore without relying on a potentially compromised device.
Frequently asked questions
Is cloud sync enough to recover from ransomware?
Not necessarily. Sync can copy encrypted or deleted files to other devices or the cloud, potentially replacing unaffected versions. Check whether the service retains version history or restore points, how long they remain available, and whether you can restore them after a mass change. Do not assume that a synced copy is an independent backup.
Rank #4
- 【Versatile Storage Expansion – For Gaming, Work & Everyday Use】 Running out of space on your PS5 or Xbox Series X/S? This external hard drive lets you store and play PS4 / Xbox One games directly, instantly freeing up your console’s internal storage for next‑gen titles. At the same time, it handles work file backups, media libraries, and cross‑device data transfers with ease. One drive, all your needs. *（Note: PS5 / Xbox Series X|S games cannot be run or stored directly from the external hard drive. However, by offloading your PS4 / Xbox One games, you can free up valuable space for newer titles.）*
- 【Patented Silicone Sleeve – Data Protection You Can Count On】 Worried about drops? We’ve got you covered. The patented built‑in silicone sleeve acts like a shock‑absorbing armor, cushioning your drive against bumps and falls. Whether it’s important work documents, precious family photos, or hard‑earned game saves, your data deserves this level of protection.
- 【Plug & Play, Compatible with Computers & Consoles】 No complicated setup—just plug in and go. Works seamlessly with Windows, Mac, and Linux computers, as well as PS4, PS5, Xbox One, and Xbox Series X/S. Process files at the office, back up data at home, or enjoy gaming in your downtime—one drive handles all your devices, simply and hassle‑free.
- 【USB 3.0 Ultra‑Fast Transfer – No More Waiting】 Tired of watching progress bars crawl? With USB 3.0 speeds up to 5Gbps, large files transfer in seconds. Whether you’re moving work documents, transferring hundreds of gigs of games, or backing up a year’s worth of photos, you get more done in less time.
- 【Sleek, Lightweight, and Ready to Go】 Weighing just 0.16 kg—lighter than a can of soda—this compact drive features a stylish mirror‑and‑frosted finish. Toss it in your bag and go, whether you’re heading to the office, visiting a friend for a gaming session, or giving a presentation on the road.
Should I leave my external backup drive connected?
If the everyday device can write to the drive, ransomware or an attacker controlling that device may be able to reach it. Disconnect removable backup media when the backup session is complete. A single drive can also fail, be lost, or fall behind, so maintain another protected copy where possible and test restores.
Recommended Free Tools
How often should I back up my files?
CISA calls for regular backups and regular tests, but its guidance does not set one interval for everyone. Choose a schedule based on how much recent work you could afford to lose and how often important data changes. Make sure the backup remains current enough for your needs and test that you can restore files from it.
What if I lose the password or encryption key for my backup?
You may be unable to unlock the data even if the backup copy remains intact. Store passwords, encryption keys, and account recovery information securely in a place you can reach when the primary device is unavailable. CISA’s device-data guidance highlights safe storage of these secrets; do not keep the only copy on the device or account they are meant to help recover.
Does a backup service automatically cover all my cloud files?
No. Coverage depends on the service and its configuration. Check which devices, files, accounts, and cloud resources are included, what retention applies, what protects copies from alteration or deletion, and how to restore. CISA recommends considering cloud-to-cloud backups for cloud resources, but that does not mean any particular service automatically covers every account.
Can I restore immediately after ransomware encrypts my files?
First follow incident-response guidance and isolate affected systems so they do not contaminate clean systems or backup copies. Restore only from a known-good, protected recovery point, and use a clean destination. For an organization, qualified incident-response help may be needed to verify containment and system cleanliness before restoration.
Frequently Asked Questions
Is cloud sync enough to recover from ransomware?
Not necessarily. Sync can copy encrypted or deleted files to other devices or the cloud, potentially replacing unaffected versions. Check whether the service retains version history or restore points, how long they remain available, and whether you can restore them after a mass change. Do not assume that a synced copy is an independent backup.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Should I leave my external backup drive connected?
If the everyday device can write to the drive, ransomware or an attacker controlling that device may be able to reach it. Disconnect removable backup media when the backup session is complete. A single drive can also fail, be lost, or fall behind, so maintain another protected copy where possible and test restores.
How often should I back up my files?
CISA calls for regular backups and regular tests, but its guidance does not set one interval for everyone. Choose a schedule based on how much recent work you could afford to lose and how often important data changes. Make sure the backup remains current enough for your needs and test that you can restore files from it.
What if I lose the password or encryption key for my backup?
You may be unable to unlock the data even if the backup copy remains intact. Store passwords, encryption keys, and account recovery information securely in a place you can reach when the primary device is unavailable. CISA’s device-data guidance highlights safe storage of these secrets; do not keep the only copy on the device or account they are meant to help recover.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does a backup service automatically cover all my cloud files?
No. Coverage depends on the service and its configuration. Check which devices, files, accounts, and cloud resources are included, what retention applies, what protects copies from alteration or deletion, and how to restore. CISA recommends considering cloud-to-cloud backups for cloud resources, but that does not mean any particular service automatically covers every account.
Can I restore immediately after ransomware encrypts my files?
First follow incident-response guidance and isolate affected systems so they do not contaminate clean systems or backup copies. Restore only from a known-good, protected recovery point, and use a clean destination. For an organization, qualified incident-response help may be needed to verify containment and system cleanliness before restoration.
The Bottom Line
A ransomware-ready backup is current, protected from changes by the everyday device or account, and tested by restoring files. Keep removable media disconnected between backup sessions, verify cloud version history and retention rather than treating sync as backup, and securely preserve the credentials and keys needed to recover. If ransomware is active, isolate affected systems and restore only from a known-good copy after the recovery environment is ready.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
