Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteNo backup arrangement is guaranteed to be ransomware-proof. You can, however, make backups substantially harder to encrypt or delete by combining a complete recovery inventory, multiple independent copies, at least one offline or isolated copy, encryption, deletion-resistant retention, separate credentials, and regular restore exercises.
The practical goal is a recovery system that still contains usable files, applications, configurations, and system images after an attacker compromises production systems. A successful backup job is only evidence that data was copied; a tested restore demonstrates that recovery is actually possible.
As an Amazon Associate I earn from qualifying purchases.
What “ransomware-resistant” backups actually mean
Ransomware often searches for network shares, backup servers, snapshots, and cloud accounts that the compromised device can access. It may encrypt backup files, delete recovery points, or use stolen administrator credentials to alter retention settings. A backup that is online, writable, and controlled by the same credentials as production is therefore part of the attack surface.
“Ransomware-resistant” describes layered controls that reduce the chance of simultaneous loss and improve your ability to recover. It does not promise that every copy will survive every incident. An offline disk can be lost or damaged, an immutable store can be misconfigured, and a cloud account can be taken over. Resilience comes from independent copies, restricted access, retained history, and proof that restoration works.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
CISA’s #StopRansomware Guide (September 2023 edition) summarizes the central practice: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” NIST likewise advises organizations to carefully plan, implement, and test backup and restoration, while adapting the design to their own systems and obligations.
Begin with what must be restored
Do not start by choosing a drive or subscription. Start by defining the services and information that have to come back, in what order, and with which dependencies.
Inventory data, systems, and dependencies
List business records, personal files, databases, virtual machines, applications, source code, configuration files, identity services, network settings, certificates, license information, and any hardware-specific settings needed to rebuild a system. For a home, that might include tax records, photographs, password-manager exports, and the computer or phone configuration needed to open them. For an organization, include the systems that make the data usable; a database backup without its application, encryption keys, or schema may not provide a workable recovery.
Set restoration priorities
Group assets by the effect of losing them. Identify the critical services that must be recovered first, the maximum acceptable amount of recent data loss, and the longest tolerable outage. Record contacts, escalation paths, and the person authorized to approve a recovery. CISA recommends maintaining asset inventories, prioritizing critical services, and keeping system images and recovery plans current.
Define a recoverable scope
Write down what each backup set contains and what it does not contain. Distinguish file backup, application-aware backup, database backup, and full-system image. Include retention periods and the oldest recovery point that must remain available. This prevents a “successful” job from quietly omitting a critical folder or service.
Use 3-2-1 as a foundation, then add isolation
The 3-2-1 pattern is a redundancy baseline, not a measured guarantee. In the formulation reproduced by a CISA LockBit advisory, the Australian Cyber Security Centre describes “three copies of data (one copy of production data and two backup copies) on two different media, such as disk and tape, with one copy kept off-site for disaster recovery.” It is a rule of thumb, not a universal regulatory requirement.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Element | What to keep | Why it matters |
|---|---|---|
| Three copies | Production plus two backup copies | A single failed device or deleted recovery point does not remove every copy. |
| Two media types | For example, disk and tape, or local storage and object storage | Different media reduce dependence on one failure mode. |
| One off-site copy | A copy in another physical location or an appropriately separated cloud environment | Protects against fire, theft, flooding, and a site-wide incident. |
| Offline or isolated protection | At least one copy disconnected from ordinary systems or protected by a separate security boundary | Limits ransomware’s ability to reach, encrypt, or delete the copy. |
Production data counts as one copy in the 3-2-1 description, but it is not a backup. If production is encrypted, corrupted, or destroyed, only the independent copies provide recovery. Add offline, immutable, or deletion-protected controls according to the threat and the value of the data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep at least one copy out of ransomware’s reach
Offline removable storage
A disconnected external hard drive or other storage device can provide one physically separate copy. Connect it only for the backup or restore operation, then disconnect it and store it securely. Keep more than one device in rotation if practical, label each device, protect it from heat, moisture, theft, and impact, and periodically verify that it can still be read. A drive by itself is not a complete plan: it lacks automatic redundancy, off-site protection, retained history, and proof of recovery unless you build those processes around it.
Isolated backup infrastructure
Where continuous connectivity is required, place backup servers or repositories in a network segment that ordinary endpoints cannot administer. Use separate backup accounts rather than reusing domain or workstation administrator credentials. Restrict who can change retention, delete recovery points, or disable backup jobs. Monitor those actions and alert on unusual deletion or encryption activity.
Encryption and key protection
Encrypt data in transit and at rest. Keep encryption keys, recovery codes, and administrator credentials protected separately from the systems they unlock; an encrypted backup with a key stored only on the compromised network may be unusable. Document how an authorized recovery team obtains the key during an incident and test that procedure.
Immutability, retention locks, and object lock
Immutable or write-once retention can prevent alteration or deletion during a defined period. Cloud object lock, retention locks, and delete protection are examples, but their behavior depends on configuration, account permissions, and the provider’s service model. CISA cautions that misconfigured immutable storage can create significant cost and may conflict with some compliance requirements. Verify who can shorten retention, remove a lock, or delete the containing account before relying on the feature.
Recommended Free Tools
Is cloud backup safe from ransomware?
Cloud storage can improve geographic separation and durability, but “in the cloud” is not the same as “isolated.” A synchronized folder may faithfully upload encrypted or corrupted files after ransomware changes them locally. If the service retains only the latest version, the damaged copy can replace the good one.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Separate synchronization from backup
Synchronization is designed to mirror changes across devices. A backup should retain historical versions and provide a way to recover an earlier, known-good point. Confirm the retention window, version history, deletion behavior, and recovery process rather than assuming that a synced folder is a backup.
Controls to verify with a cloud provider
- Versioning or point-in-time recovery that survives mass file changes.
- Object lock, legal hold, or deletion protection with a clearly documented retention period.
- Multi-factor authentication, least-privilege roles, and a separate administrative account.
- Alerts for bulk deletion, retention changes, disabled protection, and unusual sign-ins.
- Encryption at rest and in transit, plus a documented key-management model.
- Export or restore options that work if the primary account, tenant, or provider is unavailable.
Consider a separate cloud-to-cloud backup when a single provider’s account, region, or administrative boundary would otherwise contain both the live data and its only retained history. You remain responsible for configuring access, retention, and recovery under the provider’s shared-responsibility model.
Compare storage approaches by recovery risk
No storage type wins on every dimension. Compare the controls that affect your actual recovery scenario.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Approach | Isolation and deletion resistance | Strengths | Limitations to test |
|---|---|---|---|
| Disconnected external drive | Offline while unplugged; not inherently immutable | Simple, portable, and independent of an online account | Manual handling, physical damage or loss, limited history unless multiple drives rotate, and slower large-scale restores |
| Online local repository | Reachable from the network; can be hardened with segmentation and separate credentials | Fast local restores and centralized management | Ransomware can target it if permissions or administration are shared with endpoints |
| Cloud backup with versioning | Provider-hosted; protection depends on account isolation, retention, and version controls | Off-site durability, elastic capacity, and access from a clean recovery location | Account takeover, retention misconfiguration, provider outage, egress costs, and restore bandwidth |
| Immutable object storage | Deletion or alteration blocked during the lock period when correctly configured | Strong protection against destructive administrator actions | Retention can increase storage costs; misconfiguration or lost credentials can still prevent recovery |
| Managed backup service | Varies by architecture, tenant separation, and provider controls | Operational expertise, monitoring, and orchestrated restores | Shared-responsibility boundaries, contract and exit terms, service availability, and the provider’s ability to restore in an isolated environment |
For every option, ask whether it covers files, applications, configurations, and full-system recovery; how much historical data remains; how quickly a restore can run; whether a test restore can avoid production; and who can delete or alter copies.
A practical implementation sequence
- Map the recovery scope. Inventory critical data, systems, dependencies, software, licenses, source code, and configuration. Assign restoration priorities and owners.
- Select independent destinations. Keep production plus at least two backup copies on different media or services, with one copy off-site. Make at least one copy offline or isolated from ordinary credentials.
- Configure complete backup jobs. Include application data, databases, system images, configuration, and the files needed to rebuild services. Confirm that exclusions are intentional.
- Protect access. Use dedicated backup identities, multi-factor authentication where available, least privilege, and separate administrative paths. Prevent ordinary endpoint accounts from deleting repositories or changing retention.
- Encrypt and retain history. Encrypt transfers and stored copies, protect keys separately, enable versioning, and use immutable retention or delete protection where the cost and compliance impact are acceptable.
- Maintain golden images and rebuild materials. Keep current templates or images for critical systems, along with required software, executables, licenses, infrastructure-as-code files, and recovery documentation in a protected location.
- Document the runbook. State who declares a recovery, where clean systems are provisioned, how credentials and keys are obtained, which services are restored first, and how restored systems are checked before reconnecting.
- Exercise and revise. Perform representative file and system restores, record failures and timing, correct the process, and repeat after major architecture or software changes.
How often should you back up and test restores?
Backup frequency should follow how quickly data changes and how much loss your recovery objectives permit. A system that changes hourly needs a different schedule from an archive that changes monthly. CISA says to test regularly, and one CISA advisory describes maintaining backup and restoration daily or weekly at minimum; that language is not a universal restore-drill schedule for every household, business, or system.
| Activity | Practical starting point | What it proves |
|---|---|---|
| Backup-job monitoring | Every run, with alerts for failure, skipped scope, capacity, authentication, or retention errors | Whether the scheduled copy completed and remains within policy |
| Representative file restore | Regularly for critical data; a monthly exercise is a reasonable starting point for many small environments | That a selected file is available, readable, and recoverable to a safe location |
| Application or database restore | At least quarterly for important services, and after major application or schema changes | That dependencies, permissions, configuration, and data consistency work together |
| Full-system or disaster-recovery exercise | At a cadence set by criticality, recovery objectives, staffing, and applicable obligations | That the organization can rebuild and operate in a clean environment |
| Post-change test | After changing backup software, credentials, retention, storage, network design, or system images | That the change did not silently break recovery |
These intervals are planning examples, not a standard imposed by CISA or NIST. Increase the cadence when data changes rapidly, the consequences of loss are severe, or the backup architecture is complex.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
How to run a meaningful restore test
A restore test should answer more than “did the job show green?” Use a safe destination that cannot overwrite production or reconnect malware.
- Select a representative recovery point. Choose a recent point and, when retention permits, an older point. Include a typical file, a high-value dataset, and a system or application image in separate exercises.
- Prepare an isolated target. Restore to a test network, disposable host, or clean recovery environment. Do not attach an unverified restored system to production.
- Retrieve the copy using the documented process. Record the account, key, approval, and repository steps required. An unexpected dependency or missing credential is a recovery failure, even if the data exists.
- Validate integrity and usability. Open files, compare expected counts or checksums where appropriate, query databases, start applications, and confirm that permissions and configuration behave as expected.
- Measure the recovery. Record the recovery-point timestamp, time to obtain the data, time to make the service usable, bandwidth or capacity constraints, and any manual work.
- Check dependencies. Verify operating-system images, application versions, licenses, certificates, secrets, network rules, identity services, and documentation.
- Capture failures and corrections. Fix missing scope, broken credentials, retention settings, incompatible software, or unclear ownership. Repeat the failed step until the documented procedure works.
- Report the result. Keep the test date, assets tested, recovery point, outcome, timings, defects, owner, and due date for remediation.
Testing availability and integrity is distinct from testing whether an entire business can operate. Critical environments need both representative technical restores and a broader disaster-recovery exercise.
Recover after ransomware without reintroducing it
- Contain affected systems. Isolate suspected endpoints and servers according to your incident plan. Do not connect an unclean machine to a recovery repository.
- Preserve evidence and decisions. Record which systems were affected, when encryption or deletion was observed, and which recovery points remain trustworthy. Coordinate with incident-response and legal contacts where applicable.
- Establish a clean recovery environment. Rebuild from a trusted image or freshly installed system, apply required security controls, and keep it separated while validating restored data.
- Restore the highest-priority services first. Follow the documented dependency order. Use the latest known-good recovery point rather than the newest point automatically.
- Validate before reconnecting. Scan and inspect restored systems, verify accounts and configurations, and confirm that the original attack path is closed.
- Restore remaining systems and monitor. Watch for renewed encryption, unexpected account activity, and failed jobs. Update images, credentials, controls, and the recovery plan after the incident.
Special considerations for operational technology
Industrial and other operational-technology environments cannot treat restore speed as the only objective; safety, deterministic behavior, equipment state, and availability constraints may dictate when and how a system is taken offline. NIST’s OT Backup Quick Start Guide, published June 17, 2026, recommends integrating backups into change management, creating them regularly, testing them, and reviewing them during recovery exercises. Apply those practices with the system’s safety requirements, vendor procedures, and approved maintenance windows.
Common failure modes and fixes
| Failure mode | Why it fails | Correction |
|---|---|---|
| Only one online backup | The same ransomware event can encrypt or delete production and the repository | Add an offline or isolated copy and a separate location. |
| Cloud sync treated as backup | Encrypted or corrupted files can synchronize and replace healthy versions | Use retained versions or a dedicated backup with tested point-in-time recovery. |
| Shared administrator credentials | Compromise of a workstation or domain account grants destructive backup access | Separate backup identities, least privilege, multi-factor authentication, and monitored administrative actions. |
| Immutable storage enabled without a cost review | Retention locks can consume capacity and conflict with deletion or compliance requirements | Model retention, legal holds, capacity, and exit procedures before locking data. |
| Backup scope omits applications or configuration | Files exist, but the service cannot be rebuilt or interpreted | Include images, databases, dependencies, licenses, keys, and configuration in the inventory. |
| Green job status assumed to equal recovery | Unreadable data, missing credentials, or incompatible software may surface only during restore | Run isolated file, application, and system restore tests and record timings and defects. |
| Offline drive left connected | Ransomware can reach and encrypt the supposedly offline copy | Disconnect it when not in use, protect it physically, rotate copies, and test readability. |
| Recovery plan never exercised | People, permissions, dependencies, and decision points fail under pressure | Assign roles and rehearse recovery in a clean environment, then update the runbook. |
What a defensible backup plan looks like
A defensible design has more than one independent copy, at least one copy ransomware cannot routinely reach, protected credentials and encryption keys, retained history or immutability appropriate to the risk, and evidence from actual restore tests. It also covers the systems and configuration needed to resume service, not merely the files users notice first.
Review the design whenever data, applications, credentials, storage providers, retention rules, or regulatory obligations change. Resilience is an operating practice: make copies, limit who can destroy them, and repeatedly prove that a clean recovery still works.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
