Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRecovering business data after ransomware is a controlled incident-response operation, not a matter of copying files back. First contain the attack and preserve evidence, then determine which systems and backups can be trusted. Restore the most critical services into an isolated, clean environment, validate them, and reconnect production only after you have checked for reinfection and unresolved compromise.
A successful backup job does not prove that a usable recovery point exists. Ransomware can encrypt or delete backups that are reachable from compromised systems, and restoring data does not by itself determine whether information was accessed or exfiltrated.
As an Amazon Associate I earn from qualifying purchases.
Recovery starts with containment, not restoration
The safest sequence begins by stopping the attacker’s access and defining the incident boundary. Restoring immediately can overwrite evidence, spread malware to clean systems, or place compromised credentials back into service.
Isolate affected computers and servers
Use your incident-response procedure to isolate every known or suspected endpoint, server, virtual machine, and storage system. Disconnect network access where practical, but avoid actions that destroy logs or volatile evidence unless there is an immediate safety or operational reason. Record which assets were isolated, when, by whom, and what symptoms were observed.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Take wider network action when the infection is broad
If several systems or subnets show the same indicators, CISA’s response checklist says taking the network offline at the switch level may be appropriate. That is a business-impacting decision: coordinate with the incident commander and operations leads, identify services that must remain available for safety, and document the exact switches, segments, and times involved.
Capture cloud evidence before changing resources
For cloud workloads, take volume snapshots for later forensic review before deleting, rebuilding, or overwriting resources. Label snapshots with the account, region, instance, volume, and timestamp, and protect them from routine cleanup policies. A snapshot is evidence, not proof that the underlying data is clean.
Establish what was affected
Build an inventory of impacted systems and the business services that depend on them. Include file shares, databases, identity services, application servers, virtualization hosts, cloud volumes, backup consoles, and administrative workstations. Mark the last known normal operation and the first observed encryption, ransom note, or suspicious login for each asset.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a critical-asset list
CISA recommends a predefined critical-asset list that reflects health and safety, revenue generation, critical services, and dependencies. If your list is outdated, create a temporary one with service owners. For each service, record its data stores, authentication requirements, network dependencies, licensing, and the people who can approve restoration.
Look for an earlier compromise
Before treating any backup or rebuilt host as safe, examine detection and prevention tools and available logs for evidence that the attacker entered earlier or moved laterally. Review identity-provider sign-ins, privileged-account activity, endpoint alerts, firewall and VPN records, hypervisor events, backup-console access, and cloud audit logs to the extent your retention allows. CISA warns that a ransomware event can follow an unresolved compromise; restoring systems while the attacker still has access invites a second encryption event.
Decide whether a backup is safe and usable
Assess each candidate recovery point separately. A copy that exists may still be encrypted, incomplete, corrupted, reachable by the attacker, or dependent on software and credentials that are also compromised. Treat “backup completed” as a historical record, not as a recovery guarantee.
Evaluate isolation and attacker reach
Prefer copies that were offline or otherwise isolated from production systems and production credentials. Check whether the backup repository, management account, storage shares, and deletion APIs were accessible from the affected environment. If an attacker could log in and delete or overwrite the copy, downgrade its trust until you can prove its contents and history.
Check encryption and deletion protection
Confirm that backup data is encrypted as required by your policy and that deletion or overwrite protections were enabled, configured correctly, and not bypassed during the incident. Encryption protects confidentiality and does not make a compromised or tampered copy restorable; protection against deletion does not prove that the original data was never altered.
Confirm the recovery point and integrity
Identify the last known clean point for each system, not merely the latest point. Use the integrity checks and restore procedures documented for your platform. Test whether the catalog can read the backup, whether all required volumes or files are present, and whether the restored data opens in the intended application. Keep the test in an isolated environment.
Rank #2
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
| Question | Evidence to collect | Decision if evidence is missing or negative |
|---|---|---|
| Was the copy unreachable from production? | Repository network path, access logs, account permissions, and connection times | Do not call it clean; preserve it for investigation and seek another recovery point |
| Can the copy be read and restored? | Catalog status, test restore output, required media or keys, and application-level checks | Mark it unusable until the failure is understood and corrected |
| Is the point earlier than the compromise? | Timeline of encryption, suspicious access, and backup activity | Choose an earlier point or another source; do not rely on the newest copy by default |
| Are deletion and overwrite controls effective? | Configuration, audit events, retention records, and administrator changes | Treat the copy as potentially altered and require additional validation |
| Has this recovery method been tested? | Recent restore exercise, measured completion time, and documented errors | Perform a controlled test before committing a critical production restore |
Choose what to restore first
Restoration order should follow business impact and technical dependencies, not the order in which systems were encrypted. Ask service owners what failure creates an immediate health or safety risk, stops revenue generation, or prevents other critical services from operating.
| Priority | What belongs here | Why it comes first |
|---|---|---|
| Tier 1: safety and essential operations | Systems whose outage creates a health or safety risk or prevents legally required operations | They have the highest consequence of prolonged downtime |
| Tier 2: revenue-critical services | Order processing, customer-facing systems, production control, or other services that directly generate revenue | They restore core business activity once the environment is safe |
| Tier 3: shared dependencies | Identity, name resolution, network services, databases, storage, and management components required by Tier 1 or Tier 2 | Dependent applications cannot operate reliably without them |
| Tier 4: supporting and lower-impact systems | Internal tools, archives, convenience services, and nonessential historical data | They can follow after critical services are stable |
Draw the dependency chain before restoring. For example, an application may require a database, identity service, storage volume, licensing server, and network path in a particular order. Record the owner, validation test, and approval required for each step. If two services compete for the same people or infrastructure, restore the one with the greater safety or revenue consequence first.
Recommended Free Tools
Prepare a clean recovery environment
Do not restore directly into the compromised production network. Build a controlled area in which you can rebuild, inspect, and test systems before exposing them to normal users or interconnections.
Use an isolated recovery VLAN or equivalent segment
CISA gives a clean recovery VLAN as an example of how to avoid reinfecting systems during recovery. Restrict routes from this segment to only the services and administrators needed for the restore. Keep ordinary user traffic, unverified file shares, and the original backup-management path out of the segment until they have been assessed.
Rebuild from maintained golden images
Keep regularly updated golden images for critical systems. A golden image should represent the approved operating system and baseline configuration for a specific role, together with the documentation needed to deploy it. Rebuilding from a known image is safer than trying to “clean” an encrypted or suspicious host in place.
Gather offline recovery materials
Recovery may require more than user files. Maintain offline copies, where appropriate, of infrastructure-as-code templates, source code or executable packages, software installers, license agreements, configuration exports, and other artifacts needed to recreate a service. Verify that the people performing the rebuild can access these materials without using credentials taken from the compromised environment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Restore in a controlled sequence
- Freeze the recovery plan. Name the incident commander, service owners, technical leads, and approval authority. Write down the selected recovery point, target environment, dependencies, and rollback action for each service.
- Protect the evidence. Preserve affected disks, cloud snapshots, logs, ransom notes, and backup audit records according to your legal and investigative requirements. Do not use an evidence copy as a working restore unless it has been duplicated and documented.
- Rebuild the target host. Deploy the appropriate golden image or a clean installation in the recovery segment. Apply the organization’s approved baseline and only the software required for the service.
- Restore the minimum required data. Start with the selected clean recovery point and the volumes or databases needed for the service. Keep the restored copy in the isolated environment while you test it.
- Recreate dependencies in order. Bring up identity, storage, databases, network services, licensing, and application components according to the dependency map. Avoid reconnecting an unassessed production share simply to make a test pass.
- Validate data and application behavior. Check that expected records, files, permissions, and timestamps are present; open representative data in the production application; and run the service owner’s documented business transaction or safety test.
- Record defects and decisions. Log missing files, failed jobs, incompatible versions, damaged databases, and workarounds. A failed test is useful evidence; do not conceal it by restoring a later, less trustworthy copy.
- Apply monitoring before exposure. Enable the detection and logging controls available for the rebuilt service. Confirm that administrators can see authentication, process, network, and backup activity before users return.
- Reconnect in controlled stages. Move one dependency or service at a time from the recovery segment toward production. Use change approval, observe for unexpected activity, and stop if encryption, suspicious logins, or other indicators reappear.
- Confirm business acceptance. The service owner, security lead, and incident commander should agree that the system meets its required function and that the remaining limitations are understood before normal operations resume.
Compare backup and recovery approaches by capability
When selecting or redesigning a backup arrangement, compare capabilities rather than brand names. CISA’s guidance supports offline backups, regular restore testing, golden images, and recovery prioritization; it does not establish that any particular product or provider meets those requirements.
| Evaluation area | Questions to ask | What good evidence looks like |
|---|---|---|
| Isolation | Can ransomware reach the repository through production credentials, network routes, or a connected management console? | Documented separation, restricted administration, and audit records showing when access occurs |
| Encryption and tamper resistance | Is data encrypted, and are deletion or overwrite protections available and actually configured? | Current configuration, tested recovery of encryption keys, retention settings, and change history |
| Restore testing | How often are complete restores exercised, and how long do they take? | Recent test records with measured duration, errors, owners, and corrective actions |
| Coverage | Does the plan include critical data, system images, software, configurations, licenses, and dependencies? | An asset-to-backup map and a rebuild procedure for every critical service |
| Clean-environment recovery | Can the organization restore without reconnecting compromised hosts or shares? | A documented recovery VLAN or equivalent isolation design and tested access path |
| Operational ownership | Who can start a restore during an incident, and who approves service return? | Named roles, current contact details, decision thresholds, and an exercised runbook |
Where an external hard drive fits
An external hard drive can be one component of an offline backup strategy. CISA advises disconnecting an external drive when it is not actively being used for backup, because a connected drive can be reached and deleted or corrupted by ransomware.
Choose capacity, encryption, compatibility, retention, and handling procedures that match the data you must recover. Label drives, control who can access them, store them in a protected location, and maintain more than one recovery copy when your risk assessment requires it. Most importantly, perform a test restore from the actual drive and record the result. A removable drive that remains plugged into a production computer is not an offline backup, and a single drive does not by itself provide a complete disaster-recovery plan.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Verify systems before reconnecting them
Reconnection is a separate decision from successful file restoration. Use a written gate for each service:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- The restored operating system and applications came from an approved clean image or installation source.
- The selected recovery point is earlier than the known compromise or has been otherwise validated.
- Required records, files, permissions, and dependencies pass application-level checks.
- Logging and detection are active, visible to the response team, and producing expected events.
- Administrative access has been reviewed, and the service does not depend on an unassessed compromised host.
- The service owner has completed the required business or safety test.
- The incident commander has approved the next connection and defined what observation would trigger isolation again.
Reconnect gradually rather than opening the entire network at once. Keep the recovery environment available until the restored service has operated long enough for its normal jobs, integrations, and backup tasks to be observed.
If no backup is clearly clean
Do not guess. Preserve every available copy and document why each one is questionable. A partial, older, or manually reconstructed dataset may be preferable to restoring malware, but the trade-off must be approved by business, legal, security, and service owners.
Engage qualified incident-response and recovery specialists when internal staff cannot establish the compromise timeline, validate backups, rebuild critical dependencies, or determine whether data was exposed. CISA describes incident-response and federal asset-response assistance; organizations can also consult their sector information-sharing and analysis center. Verify the scope, confidentiality terms, and technical responsibilities of any external provider before granting access.
Keep the investigation open if evidence suggests theft or continuing access. Data restoration addresses availability; it does not establish that confidential information was not copied, nor does it close notification or legal obligations.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAfter recovery: turn the incident into a tested capability
Document what happened
Record the timeline, affected assets, recovery points considered, restore failures, decisions, approvals, and remaining gaps. Note which logs were available and which had expired. This record supports technical improvement, legal review, insurance requirements, and future incident response.
Update plans and procedures
Revise the critical-asset list, dependency maps, contact rosters, recovery VLAN design, golden images, and offline artifact inventory. Remove obsolete accounts and update procedures that relied on a compromised system or credential.
Test availability and integrity regularly
CISA recommends regularly testing that backups are available and intact in a disaster-recovery scenario. Test complete service restoration, not only whether a single file can be downloaded. Measure how long each critical service takes, capture failures, and correct them before the next incident.
Share useful indicators
Consider sharing relevant indicators of compromise and lessons learned with CISA or your sector information-sharing and analysis center, subject to your legal, contractual, and privacy obligations. Sharing can help other organizations recognize the same intrusion pattern without exposing unnecessary business information.
The operational standard is simple: contain first, prove a recovery point is usable, restore critical dependencies in a clean environment, validate the result, and reconnect only under observation. Backups become a recovery capability only when that sequence has been documented and exercised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
