Start by isolating affected devices, then check for a decryptor that matches the ransomware, a clean backup, or an unaffected cloud file version. Recovery is not always possible: decryptors exist for only some variants, and paying does not guarantee that attackers will restore your files. Do not reconnect or restore data to a device until it has been cleaned.
What should you do first?
Contain the infection
Disconnect affected computers from Wi-Fi and wired networks if you can do so safely. If several devices or network segments appear affected, an organization may need to take impacted network segments offline at the switch level. The goal is to limit further spread while responders assess the incident. CISA’s ransomware guide, revised October 19, 2023, recommends following an incident response plan, identifying critical systems, reviewing logs, and preserving relevant evidence.
As an Amazon Associate I earn from qualifying purchases.
Keep the ransom note and records of what happened. Avoid wiping devices or discarding encrypted files before a qualified responder has assessed whether they may be needed for analysis. Encryption may not be the only harm: attackers can also steal data, so restoring files alone may not resolve a breach.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Get help if this affects an organization
Use your incident response plan and involve qualified incident responders for containment, evidence preservation, restoration planning, and assessment of possible data theft. CISA advises consulting law enforcement about possible decryptors. The FBI’s ransomware guidance says victims can contact their local FBI field office or report the incident through IC3.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Can a free decryptor unlock your files?
Identify the ransomware before choosing a tool
Keep the ransom note and note the encrypted file extension and other identifying details. An extension by itself does not prove which ransomware family is responsible, so do not select a decryptor based only on a filename or a resemblance to the note.
No More Ransom’s Crypto Sheriff can check an encrypted sample of up to 1 MB along with information from the ransom note to see whether a solution is known. Submitting a file shares it with the service under its stated terms. Choose a sample that does not reveal sensitive contents, or ask an incident responder before uploading sensitive material.
Use only a decryptor matched to the variant
Search the No More Ransom decryption tools directory for a tool that covers the identified ransomware, and follow that tool’s instructions. Decryption can be possible in some cases, including when malware authors made an implementation mistake, but there is no decryptor for every variant. A tool with a similar name is not evidence that it will work. Do not test an unmatched decryptor on the only copy of important files.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What other recovery options should you check?
Restore from a clean backup
After the infection has been contained and the malware removed, restore from a backup known to be clean. Organizations should prioritize critical systems and use a clean recovery environment. CISA recommends offline, encrypted backups and regular restoration tests because ransomware may find and delete or encrypt backups that remain accessible. A cloud-synced copy is not automatically an independent, clean backup.
Look for an unaffected cloud version
If the affected files were stored in OneDrive, check Microsoft’s instructions for detecting ransomware and recovering files. The process includes cleaning affected devices before restoring, which helps prevent restored files from being encrypted again. Whether a usable version is available depends on the account and the history it retained; follow the provider’s current instructions.
Distinguish decryption from deleted-file recovery
Windows File Recovery is intended to recover deleted files from local storage; it does not decrypt files that ransomware has encrypted. Microsoft advises minimizing use of the computer when trying to recover deleted data. If deleted-file recovery might matter, avoid installing recovery software onto the affected drive, since writing to it can reduce the chance of finding deleted data.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How do you decide which route to try?
These options solve different problems. Use the distinction to avoid treating a deleted-file utility, a cloud copy, and a cryptographic decryptor as interchangeable.
| Recovery route | Can help when | Key limitation |
|---|---|---|
| Matched decryptor | A reputable tool specifically supports the identified ransomware variant. | Tools cover only some variants; a similar extension or note is not a match. |
| Backup restore | A clean copy from before encryption is available and can be restored after containment. | Backups reachable during the attack may also have been altered or encrypted. |
| Cloud version recovery | The service retains an unaffected version of the file. | Availability depends on the account’s stored history, and the device should be cleaned before restoring. |
| Deleted-file recovery | A file was deleted from local storage and recoverable data remains. | It does not decrypt an encrypted file; using the drive can reduce recovery chances. |
For any route, check whether it matches the identified ransomware or source copy, whether the copy predates encryption and is clean, and whether the recovery process could overwrite evidence or deleted data. Restore only after containment, using a clean environment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should you pay the ransom?
The FBI says, “The FBI does not support paying a ransom in response to a ransomware attack.” Payment does not guarantee that you will get your data back. CISA and its partners also advise consulting law enforcement and note that researchers have released decryptors for some variants. Check matched decryptors, clean backups, and available cloud versions before weighing any other path.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
What if none of these options works?
If no working decryptor, clean backup, or unaffected file version is available, recovery cannot be promised. Preserve the encrypted files, ransom note, and incident details for qualified analysis rather than assuming a general-purpose recovery tool can decrypt them. If data was stolen, restoring files does not address the separate risk of disclosure or extortion. No More Ransom’s ransomware Q&A explains why decrypting files is not possible in every case.
How can you reduce the impact of a future attack?
Keep offline, encrypted backups and test that you can restore them, as CISA recommends in its ransomware guidance. A backup drive should be disconnected when it is not being used for backup; an always-connected copy may be exposed to the same attack as the computer.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
