Backups survive ransomware and mistakes only when they are separated from everyday systems, protected against unauthorized changes, and proven restorable. Keep at least one encrypted copy offline or otherwise isolated, separate backup administration from production access, configure retention or deletion safeguards, and rehearse recovery.
A synchronized folder is not automatically a backup: a deletion or encrypted file can synchronize everywhere unless version history, retention, soft delete, or immutability is enabled.
As an Amazon Associate I earn from qualifying purchases.
What a ransomware-resistant backup actually requires
Ransomware commonly reaches backup data through the same computers, network paths, credentials, or administrative consoles used for production data. Accidental deletion follows a similar pattern: a user removes a file, a script applies the wrong command, or synchronization propagates the mistake. Protection therefore depends on independence, not simply on having another copy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Isolation: At least one recovery copy must be offline or separated from routine systems and the credentials most exposed to attack.
- Integrity: Encryption, least-privilege permissions, version history, retention, soft delete, or immutability should prevent an attacker or mistake from silently replacing every usable copy.
- Recoverability: A successful backup job is only a report that data was copied. A restore exercise must show that the required files, configurations, and systems can actually be recovered.
CISA summarizes the core practice this way: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.”
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Start with the data needed to rebuild
List what must be available after an incident, rather than backing up only the documents users notice. Include databases, shared files, cloud data, virtual machines, identity and security configurations, application settings, encryption-key recovery material, and the instructions needed to rebuild critical services.
Include rebuild materials
For critical systems, retain a known-good golden image or equivalent build specification. CISA also advises keeping relevant source code, executables, and licensing materials with offline backups where applicable. Without these items, a file restore may leave you unable to recreate the application that uses the files.
Assign recovery priorities
Mark systems as critical, important, or deferrable and record the order in which they should return. Define an acceptable data-loss window and a maximum tolerable outage for each class. Those decisions determine backup frequency, the number of independent copies, geographic separation, and whether a slower but cheaper archive is acceptable.
Recommended Free Tools
Choose an arrangement that separates failure domains
Local storage, cloud storage, and a hybrid design can all work. The right choice depends on how much data you have, how quickly it must be restored, what connectivity is available, and whether you can administer the controls consistently.
| Arrangement | Isolation and deletion protection | Restore characteristics | Costs and operational issues |
|---|---|---|---|
| External storage kept disconnected | Strong physical separation while unplugged; protection is lost if it remains mounted or shares exposed credentials. Use encryption and more than one device when the data warrants it. | Fast for a local failure when the device is available; slower if the device is off-site or damaged. | One-time hardware cost plus replacement and off-site handling. A drive can be lost, stolen, damaged, or fail. |
| Cloud backup service | Can provide versioning, retention, soft delete, immutable storage, separate accounts, subscriptions, or regions. Settings and defaults vary by service. | Convenient remote access, but large restores depend on bandwidth, provider availability, and retrieval procedures. | Recurring storage and possible retrieval or transfer charges. Administrative separation and policy review are essential. |
| Hybrid arrangement | Combines a quickly available local copy with an isolated or geographically separate copy. A cloud-to-cloud copy may reduce dependence on one account or service. | Use the local copy for routine recovery and the isolated copy for broader compromise or disaster scenarios. | More components to monitor, document, and test, but fewer single points of failure. |
No arrangement is universally best. Compare the choices against credential isolation, resistance to deletion or overwriting, version and retention controls, encryption, restore speed, geographic and administrative separation, storage and retrieval costs, device capacity, and the volume of data to protect.
Make one copy offline or independently administered
Offline external storage
An external hard drive can serve as an offline copy when it is connected only for the backup session and then disconnected, powered down, or stored where ordinary systems cannot reach it. Encrypt the drive before putting sensitive data on it and label the backup date and coverage. Rotate devices if you need an off-site copy or cannot tolerate losing the only physical unit. Offline storage is not complete protection by itself: fire, theft, media failure, and an unverified restore remain possible.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Separate cloud boundaries
For cloud backups, consider a separate account, subscription, region, or provider from the one hosting production. Microsoft’s architecture guidance describes independent copies across administrative and regional boundaries, while CISA advises considering cloud-to-cloud backup. Separation limits the damage when one identity, tenant, or region is compromised, but it also creates additional credentials, policies, and recovery procedures that must be maintained.
Separate administration from production
A single administrator who can edit production and erase backups is a single point of catastrophic failure. Create a dedicated backup administration role or account where the platform supports it. Grant only the permissions needed to run jobs, inspect status, or perform a restore; reserve deletion and policy changes for a smaller group.
- Use unique credentials for backup administration rather than reusing production passwords.
- Require multifactor authentication and store emergency recovery credentials separately from ordinary user accounts.
- Keep backup service keys out of scripts and endpoints that ransomware can reach; use a managed secret store or equivalent control.
- Enable approval, dual-control, or multi-user authorization for destructive operations when available.
- Review membership and access logs regularly, and remove dormant accounts promptly.
AWS documentation, for example, describes access policies for backup vaults. The exact roles and policy syntax differ by platform, so map permissions to the service you operate instead of copying a generic role list.
Encrypt backup data in transit and at rest
Encryption protects confidentiality if a drive, account, or storage location is stolen. Use encrypted transport for backup transfers and encryption at rest for the repository and removable media. Decide who controls the keys and how a restore works if the primary identity system is unavailable. Keep a documented recovery path for keys, with access restricted as carefully as the backup itself; an encrypted backup whose key is lost is not recoverable.
Understand the controls that stop deletion
Different features protect different failure modes. Turn them on only after confirming what they retain, who can bypass them, and when data becomes eligible for deletion.
Free tools Windows power users keep installed
One-click scans. No signup required.
Versioning
Versioning keeps earlier versions of an object when a newer version is written. It can recover a file that was overwritten or encrypted, but it may not stop an administrator from deleting all versions and may increase storage use. Configure lifecycle rules so old versions are retained for a period that matches your recovery needs.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Soft delete
Soft delete moves deleted recovery data into a protected state for a defined recovery window. Microsoft’s Azure Backup documentation describes a configurable period of up to 180 days, with 14 days documented as the default for that service, and recommends not disabling the feature. Those figures apply to the cited Azure Backup behavior, not to cloud backup services generally. Check whether soft-deleted data consumes capacity, whether an attacker with high privileges can disable the setting, and how a restore is initiated.
Retention and legal holds
A retention policy keeps recovery points until a specified date or age. It is useful for both accidental deletion and delayed ransomware discovery. Set the period from documented recovery and compliance requirements rather than choosing an arbitrary long value; longer retention increases storage cost and may slow deletion or migration.
Immutability and object lock
Immutable storage is designed to prevent modification or deletion during a configured retention period. AWS describes its immutable storage as write-once, read-many (WORM), and documents AWS Backup Vault Lock as a control that can prevent backup deletion or retention changes. Microsoft describes immutable Azure vaults with similar protection against deletion or modification. These are service-specific controls with account, configuration, and operational prerequisites.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsLocked immutability deserves special care. Microsoft warns that, once locked, the policy cannot be reversed during its retention period. Validate the retention duration, capacity, restore process, and cost before locking; an overly long policy can consume budget and prevent legitimate cleanup.
Provider examples: what to verify before enabling a lock
| Example feature | Protection described by the provider | Questions to answer in your environment |
|---|---|---|
| Azure Backup soft delete | Deleted backup data is retained for a configurable period up to 180 days; 14 days is the documented default in the reviewed guidance. | Does the setting cover every protected workload? Who can disable it? How much capacity does the recovery window consume? |
| Immutable Azure vault | Backup data is protected from deletion or modification during the configured retention period. | What retention should be locked? How will restores work if the production tenant is unavailable? Have cost and policy limits been validated first? |
| AWS Backup Vault Lock | WORM-style controls can prevent deletion of backups or changes to retention settings. | Which account owns the vault, which roles can access it, and how will you recover across account or regional failure? |
These examples illustrate control types, not universal defaults or a recommendation to use one service. Provider interfaces, limits, and defaults can change, so read the current documentation for the account and region you operate.
Implementation checklist
- Inventory: Record critical data, systems, configurations, golden images, source code, executables, licensing information, and dependencies.
- Set recovery objectives: For each system, document the acceptable data-loss window, outage limit, restore order, and responsible owner.
- Create independent copies: Keep more than one recovery copy when the impact warrants it, with at least one copy offline or separated from routine credentials and networks.
- Encrypt: Protect transfers, repositories, and removable media; document key custody and an emergency key-recovery procedure.
- Separate accounts: Use dedicated backup administration, least-privilege roles, multifactor authentication, and approval controls for destructive actions.
- Enable history: Turn on versioning, retention, soft delete, immutability, or object lock according to the platform and your recovery objectives.
- Check policy interactions: Confirm lifecycle rules do not delete versions too early and that immutable retention does not prevent required migrations or consume unexpected capacity.
- Monitor: Alert on failed jobs, unusual deletion attempts, disabled protections, authentication changes, and sudden changes in backup volume.
- Document: Keep an offline or separately accessible runbook with account identifiers, contacts, restore order, key-recovery steps, and validation checks.
- Test: Perform a controlled restore, record the elapsed time and problems, then fix the process and repeat at a planned interval.
Test restoration, not just backup completion
Schedule restore exercises for both individual files and complete systems. A safe test uses an isolated network or disposable destination so restored malware, old credentials, or conflicting hostnames cannot affect production.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
File-level test
- Select files from different dates, including one that was intentionally deleted or overwritten in the test environment.
- Restore them to a clean location without replacing current production files.
- Check names, permissions, timestamps, checksums where appropriate, and whether the application can open the files.
- Record the recovery point used, time required, operator, and any missing metadata.
System-level test
- Provision an isolated network and a clean destination.
- Restore the golden image or base system, configuration, application binaries, data, and required licenses.
- Recreate identity, secrets, and dependencies using the documented emergency process rather than an undocumented shortcut.
- Run representative transactions and verify that users or services can perform critical work.
- Capture the actual restore time, data age, capacity consumed, and steps that failed or required specialist knowledge.
CISA and Microsoft both emphasize testing recovery. A job dashboard showing “successful” cannot prove that your required applications will start or that the restored data is complete.
Operate the controls throughout the year
Protection decays when people, systems, and policies change. Assign an owner for backup health and review the following on a defined schedule:
- Daily or per-job: failed jobs, missed sources, authentication errors, unusual volume changes, and alert delivery.
- Monthly: access lists, service-account use, retention consumption, version growth, encryption-key status, and available capacity.
- After every major change: new workloads, cloud-account moves, region changes, identity migrations, or altered retention policies.
- At least periodically: a full restore exercise, including the isolated-copy path and the emergency runbook.
Keep evidence of tests and approvals. A dated restore record is more useful during an incident than an assumption that an old configuration still behaves the same way.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when ransomware is suspected
Do not connect an offline drive or mount an isolated backup repository to an infected machine. Stop synchronization paths that could propagate encryption or deletion, isolate affected endpoints according to your incident plan, and preserve logs. Use a clean administrative workstation and the separately protected backup account to inspect recovery points.
Identify a recovery point that predates the compromise, restore into a clean, isolated environment, and validate the system before reconnecting it. If credentials may be stolen, rotate them and review who can access backup vaults. Keep the immutable or offline copy untouched until the investigation confirms that it is safe to use.
Handling accidental deletion and synchronization mistakes
When a user deletes or overwrites data, first stop any process that could propagate the change. Check the application’s recycle bin, version history, soft-delete area, or retained recovery point before attempting a broad restore. Restore to a new location, compare the contents with the expected state, and then merge or replace deliberately.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
For synchronized folders, define which side is authoritative and how long deleted items remain recoverable. Without that policy, a perfectly synchronized service can faithfully reproduce the error on every connected device.
Common mistakes and their fixes
| Mistake | Why it fails | Better practice |
|---|---|---|
| Keeping every copy mounted with the same administrator account | Ransomware or a stolen credential can reach production and backups together. | Disconnect a physical copy between sessions or place cloud copies behind separate accounts, subscriptions, regions, or providers. |
| Assuming synchronization equals backup | Deletes and encrypted files can propagate immediately. | Enable versioning, retention, soft delete, or immutability and test recovery of an earlier state. |
| Locking an extremely long immutable period without testing | Capacity and cost can grow, and the policy may be irreversible during retention. | Validate restore, retention, budget, and operational ownership before locking. |
| Backing up only user documents | Applications, configurations, keys, or licenses may be missing during rebuild. | Include golden images and the materials needed to recreate critical systems. |
| Trusting a green job status | A copy may be incomplete, unusable, or impossible to restore in the required time. | Perform file and system restore exercises and record results. |
| Storing the only encryption key with the production administrator | A compromised or unavailable identity can make the backup unreadable. | Document controlled key recovery with separate emergency access. |
How to choose retention and isolation levels
Use the consequences of loss to set controls. A personal archive may need a short version history and one disconnected copy. A business system that supports customers may require independent administrative boundaries, geographic separation, immutable retention, and a tested full rebuild. Highly sensitive data may need stricter key custody and approval controls.
Longer retention is not automatically safer. It increases storage consumption, may increase retrieval time, and can preserve confidential data longer than necessary. Short retention reduces cost but narrows the window in which delayed encryption or deletion can be reversed. Document the trade-off and revisit it whenever recovery objectives, regulations, or data volume change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A practical minimum configuration
For a small environment, begin with an encrypted backup set, a disconnected external copy rotated on a schedule, and a cloud or other separately administered copy with version history or retention enabled. Use a dedicated backup account with multifactor authentication, monitor job failures, and perform a restore test that includes a deliberately deleted file. Expand to immutable storage, separate regions, or cloud-to-cloud copies when the impact of compromise justifies the additional cost and administration.
The essential test is simple: after an unexpected deletion or a compromise of everyday credentials, can you identify a clean recovery point, access it with a separate path, restore the required data, and verify that the rebuilt system works? If any answer is no, the backup arrangement is not yet resilient.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
