Recommended Free Tools
Keep at least one recoverable backup outside the reach of systems and accounts that ransomware can compromise. In practice, that means combining an offline or separately controlled copy with deletion-resistant retention, tightly restricted administration, strong authentication, monitoring, and regular restoration tests. The familiar 3-2-1 rule is a useful foundation, but it is not a guarantee: three copies can still be erased if they share the same credentials, network path, or cloud control plane.
Why ransomware attacks backups
Ransomware operators do not need to encrypt every production file if they can also destroy the copies needed for recovery. An attacker who reaches a backup server, mapped share, cloud account, synchronization folder, or backup-console credential may be able to encrypt, delete, or alter recovery data. Some malware is designed to identify online backup systems and disrupt them first.
As an Amazon Associate I earn from qualifying purchases.
The U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR) warned in its October 2022 cybersecurity newsletter: “Because some malware, including some ransomware variants, are known to delete or otherwise disrupt online backups, regulated entities should consider maintaining at least some of their backups offline and unavailable from their networks.” That advice was written for healthcare organizations, but the technical risk applies to any organization whose backups remain reachable from compromised production systems.
No single product setting makes backups ransomware-proof. Protection comes from separating copies, identities, locations, and recovery procedures so that one stolen password or infected workstation cannot reach everything.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Start with recovery requirements, not storage products
Identify what must be restored
Inventory critical data, applications, virtual machines, databases, configuration files, identity services, and dependencies. Include the information needed to rebuild a system, such as encryption keys, licensing details, network diagrams, software installers, and administrator procedures. A backup that contains files but not the system configuration or credentials needed to use them may not meet your recovery objective.
Set recovery time and data-loss targets
For each important service, decide how quickly it must return and how much recent data the organization can afford to lose. A payroll database, customer-facing application, file share, and industrial controller may require different recovery points and restoration times. Record which systems are restored first and what they depend on.
Keep recovery information available during an outage
If normal identity services, email, or file shares are unavailable, responders still need contact details, recovery instructions, asset lists, and key-management procedures. Keep an offline or separately accessible copy of essential runbooks. Restrict changes to those documents and test that staff can actually find and use them during an exercise.
Build a layered copy strategy
Use 3-2-1 as a baseline
CISA’s 3-2-1 strategy, reproduced by HHS OCR, calls for:
- 3 copies of important data: one primary copy and two backup copies.
- 2 different media types, such as disk plus removable media or disk plus object storage.
- 1 copy offsite, away from the primary location.
These are rule-of-thumb counts, not outcome statistics or a guarantee of isolation. Three copies in the same cloud account, with the same administrator and network access, can all be deleted by one compromised identity. Treat 3-2-1 as the minimum architecture to improve, not as proof that recovery is safe.
Add an actually isolated copy
At least one copy should be offline or held in a separately controlled environment. “Offline” means malware cannot reach the copy through the production network or an always-connected account. A removable hard drive can serve a home user or small organization when it is disconnected after backup and stored securely in a different location. A drive that stays attached to a workstation, a permanently mounted network share, or a synchronized cloud folder is not offline; ransomware may be able to encrypt or delete it.
For larger environments, isolation may be physical disconnection, a separate account and network with no routine route from production, or a storage system that enforces retention independently of ordinary administrator permissions. Document exactly which identities and network paths can reach each copy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Separate locations and failure domains
Keep an offsite copy far enough away to avoid a single fire, flood, theft, or power event affecting every copy. Consider whether the same vendor account, identity provider, encryption-key hierarchy, or management network could fail at once. Geographic separation helps with physical disasters; separate administrative control helps with account compromise. You may need both.
Make deletion and retention changes difficult
Use object lock, immutable retention, or delete protection where appropriate
Cloud and network-storage platforms may offer object lock, immutable snapshots, write-once retention, or delete protection. These controls can prevent an object from being removed or shortened before its retention period expires. Configure them only after understanding the provider’s exact behavior, supported workloads, and recovery process.
CISA recommends enabling object lock or delete protection for relevant cloud resources. It also cautions that immutable storage can have compliance limitations and that misconfiguration can create significant cost. Retention periods, legal holds, replication, and deletion rules differ by provider; no particular platform configuration is established here.
Protect the retention control plane
Find out who can change a retention period, disable object lock, delete a storage account, revoke encryption keys, or close the billing account. Separate those permissions from routine backup administration. Require a second approver or an independent break-glass process for destructive changes when the platform supports it. Alert whenever retention, replication, encryption, or administrator membership changes.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Do not confuse snapshots with immunity
Snapshots can speed recovery, but they may share the same account, credentials, and management interface as production. If an attacker can delete snapshots or roll them back to an encrypted state, they are not a sufficient isolated copy. Treat snapshots as one recovery layer and keep another copy under different controls.
Lock down backup identities and management paths
Apply least privilege
Give each administrator, service account, and automation job only the permissions it needs. A process that writes backups should not automatically be able to delete every historical version. A monitoring account should not be able to alter retention. Separate roles for backup creation, restoration, policy changes, and destructive deletion where possible.
Use phishing-resistant multifactor authentication
CISA calls for phishing-resistant MFA for important services, including email, VPNs, and accounts that access critical systems. Apply it to backup consoles, cloud management, key-management systems, and emergency recovery accounts. Hardware security keys or platform passkeys can reduce the risk of stolen passwords and one-time codes being replayed through a phishing site.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Separate daily and emergency administration
Do not use a highly privileged backup account for email, web browsing, or ordinary office work. Keep emergency credentials out of the production password store if that store could be compromised, while still controlling and auditing access. Test the break-glass process so that separation does not become an unusable secret during an outage.
Monitor destructive actions
Send logs for backup failures, unusual download volume, mass deletion, retention-policy changes, new administrator accounts, key revocation, and authentication from unfamiliar locations to a monitoring system that ransomware cannot modify. Alert on behavior, not only on a failed scheduled job. Preserve a copy of important logs outside the backup administrator’s control.
Schedule backups so a clean recovery point exists
Use more than one recovery point
Keep a history of versions rather than overwriting one copy. Versioning helps if an attacker quietly corrupts data before the incident is noticed. Choose retention based on how long compromise might remain undetected, storage cost, legal requirements, and the volume of data that changes.
Protect backup traffic and credentials
Encrypt data in transit and at rest, and store encryption keys separately from the systems being backed up when practical. If production administrators can delete both the backup and its keys, encryption does not provide recovery. Document how authorized responders retrieve keys when identity systems are degraded.
Include configurations and system images
File copies alone may not restore a service. Include operating-system images, application configuration, directory data, database transaction logs, network-device configurations, and infrastructure definitions where they are needed. CISA also discusses offline encrypted backups and “golden images”; retain the hardware, drivers, or software versions required to use them when a rebuild cannot be done entirely in the cloud.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsVerify that backups can actually be restored
Test representative files and complete systems
A green backup-job status proves that a job ran, not that the data is complete or usable. Periodically restore individual files, databases, virtual machines, and a full representative service. Check that permissions, timestamps, application consistency, and dependencies survive the process. For databases, use the application’s recovery tools and verify that the restored data passes integrity checks.
Practice with normal access unavailable
Run an exercise in which production credentials, identity services, or the primary network cannot be trusted. Confirm that responders can authenticate to the isolated copy, obtain keys, locate runbooks, and move restored systems into a clean environment. Record the time required, missing prerequisites, and every manual workaround.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Review logs and failed jobs
HHS OCR advises periodic test restorations and regular review of backup logs. Investigate skipped files, shrinking backup sizes, repeated authentication failures, expired credentials, and jobs that finish unusually quickly. A backup that silently excludes a critical database is a recovery gap even if the scheduler reports success.
Include operational technology and change management
NIST’s 2026 operational-technology update calls for regular backups, testing, integration with change management, and review during recovery exercises. Before changing a controller, firmware version, or plant network, confirm that the corresponding configuration and rollback image are captured. Restoration tests for operational technology must account for safety, sequencing, and the risk of sending an unsafe command to equipment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Compare backup approaches by recovery properties
| Approach | What it protects against | Primary weakness to check | Best use |
|---|---|---|---|
| Disconnected removable media | Remote deletion and network-spread encryption while disconnected | Loss, theft, physical damage, stale copies, and manual handling errors | A small organization or home user needing a genuine offline layer |
| Separate account or network | Routine compromise of production credentials and network paths | Shared identity providers, administrator overlap, or hidden routes can defeat separation | Frequent automated backups that must remain quickly accessible |
| Immutable object storage or snapshots | Deletion or overwrite during the enforced retention period | Misconfigured retention, privileged bypass, cost, provider limits, and account takeover | Scalable version history with policy-enforced retention |
| Offsite secondary environment | Site disasters and some local compromises | Replication can copy corruption; the same vendor or credentials may remain a single failure domain | Business continuity for large data sets and critical services |
Evaluate every option against attacker reachability, the type of isolation, restoration speed and scale, integrity verification, operational burden, cost and retention limits, compliance obligations, and vendor or account concentration. There is no universal ranking: a slow offline copy may be the only safe fallback for one system, while another needs a rapidly restorable immutable tier plus a separate offline archive.
Common designs that fail
- One permanently attached USB drive: malware can encrypt or delete it, and a local disaster can destroy it with the computer.
- A mapped backup share: ordinary workstation credentials may provide enough access to damage the share.
- Cloud sync mistaken for backup: synchronized deletions and encrypted files can propagate to every replica.
- One administrator for everything: a stolen production credential can change retention, delete copies, and revoke keys.
- Immutable storage without a cost and compliance review: an incorrect retention period or legal restriction can make data inaccessible or unexpectedly expensive.
- Testing only the backup job: successful scheduling does not validate application consistency, keys, permissions, or restoration time.
- Replication without integrity checks: corruption or encrypted data may be copied faithfully to the secondary site.
A practical implementation sequence
- Inventory recovery priorities. List critical systems, dependencies, owners, recovery-time targets, data-loss tolerances, keys, and required software or hardware.
- Map access paths. For every copy, document reachable networks, accounts, service principals, retention administrators, and key custodians.
- Establish the 3-2-1 baseline. Create three copies on two media types with one offsite location, then identify which copy is truly isolated.
- Create an offline or separately controlled tier. Disconnect removable media after use, or place automated copies in a separate account and network with independent administration.
- Enable retention protection. Configure object lock, immutable retention, or delete protection where the provider supports the required workload; verify who can bypass it.
- Harden identities. Apply least privilege, phishing-resistant MFA, separate administrator accounts, and controlled break-glass access.
- Turn on monitoring. Log backup failures, access, deletion, policy changes, key events, and unusual volume; route alerts outside the backup control plane.
- Run a clean restoration exercise. Restore representative data and a complete service without relying on compromised production identity or file shares.
- Correct and repeat. Fix missing keys, permissions, software, capacity, or documentation, then retest after major infrastructure or configuration changes.
What to do when an attack is suspected
Do not let an infected production system continue contacting every backup target. Follow the incident-response plan to isolate affected hosts and preserve evidence while protecting the clean copy. Suspend suspicious backup credentials and administrative sessions, but avoid casually deleting logs or changing retention in a way that destroys evidence. Confirm the last known clean recovery point using backup logs, integrity checks, and business-owner validation.
Restore into a clean, segmented environment rather than writing directly over compromised systems. Rebuild identity and administrative paths before reconnecting restored services, rotate credentials and keys that may have been exposed, and monitor restored systems for reinfection. After recovery, document which controls worked, which copies were reachable, and what changes are required before normal operations resume.
Compliance and scope notes
HHS OCR’s newsletter addresses covered entities and business associates under U.S. healthcare rules; its recommendations should not be read as a universal legal requirement. NIST’s 2020 publication discussed here is aimed at managed service providers, while the 2026 update focuses on operational technology. The underlying practices—asset awareness, secure storage, integrity checking, audit logs, testing, and recovery exercises—are broadly useful, but retention, notification, records, and data-location obligations depend on your sector, contracts, and jurisdiction.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
