What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A backup job that finishes successfully is not proof that you can recover from ransomware. A recovery-ready backup must remain available to you, be unchanged and complete, and restore into a clean environment where important files, applications, identities, and services actually work.
Check those properties with a controlled recovery exercise: define what must be recovered and how quickly, inspect whether an attacker could reach or alter each copy, restore a representative point into an isolated environment, validate the data and services, measure the result, and fix every gap. Repeat the exercise after major changes and on a risk-based schedule.
As an Amazon Associate I earn from qualifying purchases.
What makes a backup ransomware-ready?
Ransomware resilience has three separate tests. First, the copy must be available after the incident; an attacker must not be able to delete it, encrypt it, or lock administrators out. Second, it must be intact and complete: the files, databases, configurations, and other components needed for recovery must be present and unaltered. Third, it must be restorable and usable. A successful restore of a few files does not prove that an identity service, database, application, or business workflow can operate.
The Cybersecurity and Infrastructure Security Agency (CISA) states: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” See the CISA StopRansomware Guide. The test, rather than the green status of a scheduled job, is the evidence that your recovery plan works.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Can ransomware encrypt or destroy a backup?
It can reach a backup when the copy is mounted, writable, exposed through the same network, or administered with credentials that the attacker steals. Synchronization can also carry unwanted changes into another online copy. An attacker who gains access to the backup console or storage account may be able to delete, alter, or shorten retention even if the original production files are elsewhere.
Offline or otherwise isolated copies reduce that path because they are not continuously reachable from production. Encryption protects confidentiality if a drive or storage account is exposed, while immutability can prevent changes during a defined retention period. None of these controls substitutes for a restore test: an isolated copy can be incomplete, the retention policy can be misconfigured, and an immutable cloud design can create compliance, configuration, and cost issues. CISA discusses those considerations in its guide and in the Play ransomware advisory.
Define the recovery test before touching a backup
Inventory what must return
Write a recovery list for the service being tested. Include business data, databases, file shares, application binaries, operating-system images, configuration, certificates, secrets, identity and access services, network dependencies, and any hardware or licenses required to run them. Record the owner who can confirm that each item is correct. Protecting files alone may not recreate an operating system or an application environment.
Recommended Free Tools
Set the acceptable recovery point
Choose the oldest data the organization can afford to lose. This is the recovery-point objective (RPO) for the exercise. Compare it with the age of the selected backup, not merely with the time shown for the last successful job. NIST’s SP 1800-11 explains why frequency matters: a once-daily backup may be inadequate for an enterprise processing thousands of transactions per hour. That example illustrates the problem; it is not a universal schedule.
Set the recovery-time target
Agree how long the service may be unavailable, including time to obtain people, permissions, hardware, software, and vendor assistance. This is the recovery-time objective (RTO). A restore that eventually works but misses the agreed time is a failed recovery against that objective.
Specify observable pass conditions
Define what testers will inspect: representative files open correctly, database consistency checks pass, required identities authenticate, critical transactions complete, and dependencies are available. Also define which omissions, errors, or data loss would trigger escalation. Written conditions stop a team from declaring success because a single convenient file restored.
Inspect the backup boundary and attacker access
Make an inventory of every copy supporting the service, including local media, remote storage, cloud repositories, replicas, snapshots, and exports. For each copy, document its location, connection state, retention, encryption, immutability, administrator accounts, and deletion or overwrite permissions. Confirm these settings in the actual console or configuration rather than relying on a policy document.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Isolation: Identify which copies are offline, disconnected, network-segmented, or otherwise unreachable from production. Test whether a compromised production account or host can list, mount, delete, or modify them.
- Authentication: Record how administrators authenticate, which credentials are shared with production, and which permissions allow deletion, retention changes, key access, or restore operations.
- Retention: Verify that the selected restore point will still exist when an incident is discovered. Check whether automated cleanup can remove it before investigation is complete.
- Encryption: Confirm that backup data is encrypted and that recovery personnel can obtain the keys or passphrases without depending on a compromised identity system.
- Immutability: Verify the actual lock period, policy owner, clock and retention settings, and the separate authority required to change them. CISA notes that cloud immutable storage can involve compliance constraints, configuration risk, and significant cost.
For operational technology and other environments with frequent changes, NIST’s SP 1339 OT Backup Quick Start Guide recommends integrating backup management with change management, creating backups regularly, testing them, and reviewing them during recovery exercises.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Compare backup approaches by recovery evidence
No single architecture is best for every organization. Compare each option against copy frequency, restoration time, integrity and completeness checks, isolation, system coverage, compatibility, compliance, operating effort, and cost.
| Copy approach | Isolation and access questions | Restore exercise focus | Trade-offs to document |
|---|---|---|---|
| Offline or disconnected copy | Is it physically or logically disconnected when not being used? Can production credentials reach or erase it? | Reconnect only in the controlled recovery process, then restore representative data and verify that the media and encryption keys are usable. | Manual handling, storage security, encryption, safe disconnection, and the time needed to retrieve and attach the copy. |
| Cloud-to-cloud or other online copy | Can an attacker with production access alter the repository, retention, or administrator accounts? | Use a clean recovery identity and environment; verify that the service covers the required data, configurations, and dependencies rather than only synchronized files. | Authentication dependencies, provider compatibility, retention configuration, compliance, operating effort, and cost. |
| Immutable storage | What is locked, for how long, and who can change policy or keys? Is the configuration compliant with applicable requirements? | Restore from a locked point and prove that applications and databases, not just objects, are complete and usable. | Misconfiguration, compliance constraints, capacity and retention cost, and the process for extending or ending a lock. |
| Managed backup service | Which provider accounts, support channels, and permissions are needed if the organization’s identity system is unavailable? | Run a supervised restore that includes the provider’s recovery workflow, access approvals, and dependency handoffs. | Service coverage, compatibility, operating responsibility, response arrangements, compliance, and recurring cost. |
Run a ransomware recovery drill step by step
1. Choose a realistic scenario and restore point
State what happened in the exercise, such as production encryption discovered at a particular time. Select a restore point that predates the simulated compromise and contains the critical data in scope. Exercise more than one convenient file when the service depends on databases, configurations, identity, or application state. Record the backup identifier and its creation time so the achieved recovery point can be measured later.
2. Prepare a clean recovery environment
Use a separate test environment or recovery segment isolated from production and from any systems suspected of compromise. Restrict outbound connections to untrusted hosts, and do not allow restored systems to contact the live network by default. Keep infected systems from becoming a path back into the clean environment; CISA specifically warns against reinfecting clean systems during recovery.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors3. Establish recovery access without compromised credentials
Use a recovery account and keys that are not dependent on credentials known to be exposed in the scenario. Confirm that the people performing the test can authenticate to the repository, obtain encryption keys, access required software, and approve restores. Record every permission or manual intervention needed; those dependencies often determine whether the plan works during a real outage.
4. Restore the foundation first
Restore identity and access components, network and name-resolution dependencies, operating-system or infrastructure configuration, and then the application and data layers in the order documented for the service. If the environment requires physical hardware, licenses, or a vendor, include that step rather than silently assuming it is available.
5. Restore representative data
Restore a sample that reflects real use: different file types, large and small objects, recent and older records, permissions, database tables, configuration, and application state. The sample should be large enough to expose omissions and dependency problems. Keep a record of items intentionally excluded so a narrow test is not mistaken for full coverage.
6. Validate content and function
Open representative files and check that their contents are correct. Verify database consistency and application configuration, then run the service’s critical workflows, such as authentication, creating or updating a record, generating a report, or completing a transaction. Where trusted records exist, compare recovered contents or integrity checks against them. There is no single checksum or application-validation method that fits every environment, so document the method used and why it demonstrates correctness.
7. Capture the result and clean up safely
Record elapsed time, the recovery point achieved, missing or corrupt items, errors, dependencies, people, permissions, hardware, software, and vendor access. Preserve logs and screenshots that allow another person to verify the result. After the exercise, destroy or reset the test environment according to policy and ensure no restored system remains connected to production.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Measure whether the recovery met its objectives
| Measure | What to record | How to interpret it |
|---|---|---|
| Recovery point | Timestamp of the newest usable data and the interval between that point and the simulated loss. | Compare the interval with the agreed maximum data loss. A newer job timestamp is irrelevant if its contents are incomplete or unusable. |
| Recovery time | Start and finish times for the service, including access, key retrieval, dependency setup, validation, and approvals. | Compare the elapsed time with the RTO. Separate technical restore time from waiting for people or resources. |
| Completeness | Items restored, deliberately omitted, missing, duplicated, or corrupted. | Any omission that affects a critical workflow is a recovery gap, even when the backup console reports success. |
| Correctness | File-opening results, database checks, integrity comparisons, and workflow outcomes. | Data that exists but cannot be read, trusted, or used does not satisfy the service objective. |
| Dependencies | Accounts, keys, hardware, software versions, licenses, network paths, and external support required. | Unrecorded dependencies are risks to schedule the next exercise and to resolve before an incident. |
Assign an owner and due date to every gap. If the restore missed an objective, do not simply mark the drill failed; identify whether the cause was copy frequency, coverage, access, isolation, capacity, a missing dependency, or a validation defect, then rerun the affected portion after the fix.
Restore priority services without reinfection
Recovery order should be planned before an incident. List the services that enable others, such as identity, network services, security tooling, and core databases, then place dependent applications and user data after them. The order should reflect business impact and technical dependencies rather than the order in which backup jobs appear in a dashboard.
Keep compromised hosts and suspected credentials out of the clean recovery segment until they have been investigated and approved for return. Do not reconnect a restored system merely to make testing easier. Use controlled transfer points, least-privilege recovery accounts, and monitored paths between the recovery environment and any remaining production systems.
NIST’s ransomware tips and tactics recommend planning, implementing, and testing backup and restoration while isolating copies from ransomware. The NIST NCCoE backup guide for managed service providers likewise treats testing and disaster recovery as ongoing operational responsibilities.
How often should you test?
Set a regular, risk-based cadence that matches how quickly data changes and how damaging an outage would be. Test more often for high-change or high-impact services, and test again after a material change to applications, operating systems, infrastructure, backup software, retention, encryption keys, administrator roles, network segmentation, or identity services. A backup that worked six months ago is not evidence that today’s configuration will restore.
Use different exercise depths: a frequent check can validate a representative file or object, while a scheduled full-service exercise restores the dependencies and workflows needed for an operational decision. Include restoration maintenance, not just creation of new copies. CISA’s Play advisory emphasizes offline backups and regular restoration maintenance; NIST SP 1339 calls for testing and review during recovery exercises.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common findings and the corrective action
The dashboard says successful, but only files were protected
Expand the backup boundary to include application state, databases, configuration, identity, and dependencies. Add a service-level restore test instead of relying on object counts or job status.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The newest usable point is too old
Revisit the frequency and type of copies against the service’s acceptable data loss. A once-daily schedule may be unsuitable for a workload that changes thousands of times per hour; choose a frequency supported by the stated RPO and verify it in a restore.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
The repository requires the production identity system
Create a documented recovery path for authentication, keys, and approvals that remains available when production identity is unavailable. Test that path during the isolated drill.
The copy is online and writable by administrators who manage production
Separate administration, reduce write and delete permissions, and add an offline, isolated, or appropriately immutable copy. Then verify from the repository’s actual controls that production access cannot alter it.
Immutable storage is unaffordable or conflicts with requirements
Document the retention, compliance, configuration, and cost constraints rather than assuming immutability is automatically suitable. Compare it with other isolated copies and make the residual risk explicit to the service owner.
The restore environment becomes a bridge to infected systems
Redesign the network segment, block untrusted connections, use controlled transfer procedures, and repeat the exercise with clean recovery credentials. Do not reconnect systems until the organization has determined they are clean.
No one can explain what happened during the drill
Adopt a recovery record containing the scenario, restore-point identifier, start and finish times, data and services tested, validation evidence, omissions, errors, dependencies, decisions, owners, and due dates. Review it through change management so corrective work is tracked rather than forgotten.
Using an external hard drive for an offline backup
An external hard drive for offline backups can be one way to hold a disconnected copy. Encrypt the drive, protect the passphrase or key separately, disconnect it when the backup is complete, and store it where unauthorized users cannot alter or steal it. Rotation between multiple drives may be needed to preserve more than one recovery point.
The drive is only a storage method, not a complete ransomware strategy. It does not automatically cover databases, configurations, identity, or application dependencies, and a drive that has never been restored may contain silent omissions or unreadable data. Include it in the same isolated restore exercise and record the result.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteEvidence, governance, and regional considerations
Keep the recovery record with the organization’s continuity and incident-response documentation. Tie backup configuration changes to change management, note who approved retention and access decisions, and review findings with the owners of the affected service. This creates an auditable history of what was protected, what was tested, and which risks remain.
The guidance cited here is primarily from U.S. federal agencies and organizational programs. Regulated organizations and readers outside the United States should check applicable retention, privacy, data-location, operational-technology, and incident-reporting requirements before selecting storage or recovery procedures. This guidance supports preparedness; it is not a substitute for an organization-specific recovery plan or active incident response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
