Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf ransomware has encrypted your files, first disconnect the affected device from Wi-Fi and Ethernet, then preserve the ransom note and encrypted files. Don’t start deleting malware, renaming files, plugging in backup drives, or trying random decryptors. Contain the incident, document what happened, and restore from a backup only after the affected system is clean. For a business, several affected devices, or sensitive data, involve an incident-response professional.
1. Contain the attack before trying to recover files
Disconnect the affected computer from Wi-Fi and unplug its Ethernet cable. If shared or attached storage can be disconnected without interacting with suspicious prompts, isolate it too. Avoid using the affected device to discuss response steps: an attacker may still be monitoring compromised systems.
As an Amazon Associate I earn from qualifying purchases.
If multiple business systems or network segments are involved, ask IT or an incident-response team to coordinate isolation. CISA recommends that organizations use out-of-band communications and, where necessary, take affected network segments offline at the switch level. Follow your incident response plan rather than improvising a network-wide shutdown.
Don’t power off the computer as an automatic first step. CISA warns that shutting down can erase volatile-memory evidence; it recommends powering down only if network disconnection is not possible. In a business or legally sensitive incident, get responder guidance before taking further action.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
2. Preserve the note, encrypted files, and incident details
Keep the ransom note, the encrypted files, and any new file extensions or instructions. Don’t delete the note or rename files as a first reaction. Record when you noticed the attack, which devices and shared storage appear affected, and any contact details or payment instructions in the note.
Organizations may need to preserve logs, malware samples, indicators, system images, or memory captures. These tasks can require specialist handling; don’t experiment on the only copy of important data. CISA’s #StopRansomware Guide recommends collecting relevant evidence and preserving volatile data.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
3. Report the incident and get help where needed
For a business incident, follow your response plan and contact appropriate authorities or CISA. If you are an individual in the United States, you can report the attack through your local FBI field office or the Internet Crime Complaint Center (IC3). If your location is elsewhere, contact the relevant national cybercrime reporting authority.
Use a separate, uncompromised device and communication channel to seek help. A business, multi-device incident, sensitive-data exposure, or uncertainty about evidence handling is a strong reason to consult an incident-response professional before attempting restoration. CISA describes technical assistance and evidence-analysis support for organizations on request in its guide.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
4. Choose a recovery route based on what you know
| Option | When it may apply | Important limitation |
|---|---|---|
| Restore from a clean backup | A backup from before the attack is available and can be verified as clean. | Restoring before containment and cleanup can reintroduce malware. |
| Use a decryptor | The ransomware variant is identified and a trusted, variant-specific decryptor is available. | There is no universal decryptor; a tool for another variant may not work. |
| Get professional response | Several devices, business-critical systems, sensitive data, or evidence concerns are involved. | Do not attempt complex recovery or evidence collection on your own if it could compromise the case or the only copy of data. |
| Pay the ransom | Payment is not a dependable recovery method. | The FBI does not support paying; payment does not guarantee usable files will be returned. |
Look for a clean backup first
Find a backup dated before the attack. CISA recommends offline, encrypted backups and regular testing. Don’t connect a backup drive to the infected computer just to check it; wait until the affected environment is contained and a clean system is ready for restoration. CISA’s backup and recovery recommendations are in its #StopRansomware Guide and StopRansomware resources.
Consider a decryptor only for the identified variant
Some ransomware variants have decryptors, for example when researchers discover a flaw, but tools are specific to particular variants. Ask law enforcement or a qualified responder whether a trusted decryptor exists for the identified ransomware. Don’t assume a download is legitimate or run an unverified tool on the affected computer. CISA advises consulting trusted guidance for the variant; its guide does not establish a general-purpose decryptor.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Do not treat payment as a guarantee
The FBI says: “The FBI does not support paying a ransom in response to a ransomware attack.” It also warns that paying does not guarantee that files will be returned. Report the incident rather than relying on payment as a recovery plan. See the FBI’s ransomware guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Restore only after containment and cleanup
Once the affected environment has been contained and cleaned or rebuilt, restore from a backup believed to be clean. Use a clean recovery system and avoid reconnecting affected devices or backup media until they have been assessed; otherwise malware may return to systems you have restored. Verify backup integrity where possible, and prioritize critical systems and files rather than reconnecting everything at once. CISA’s recovery guidance emphasizes clean restoration and avoiding reinfection.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Keep the affected files and ransom note until a qualified responder confirms they are no longer needed. If you cannot establish that a backup is clean, or the attack may have involved data theft as well as encryption, get professional advice before restoring.
Quick Recap
What not to do while recovery is uncertain
- Don’t delete the ransom note or encrypted files; they may help identify the variant or preserve evidence.
- Don’t plug backup media into an affected computer before containment and assessment.
- Don’t run an unverified decryptor or assume one tool works across ransomware variants.
- Don’t shut down automatically if a responder may need volatile evidence; disconnect from the network first when possible.
- Don’t assume files will be returned if you pay.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
