The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To recover from ransomware without paying, contain the infected systems, preserve evidence, report the incident where appropriate, and restore from clean, tested backups in a recovery environment that the attacker cannot access. Restoring files is only part of the job: you must also check whether data was stolen and address the way the attacker got in.
What should you do first?
Start your organization’s incident response plan, if you have one. Make a record of key decisions and times, and involve the people responsible for IT, security, management, communications, and relevant insurers or service providers according to that plan. Avoid improvising changes that could destroy evidence or spread the infection.
As an Amazon Associate I earn from qualifying purchases.
- Isolate affected systems. Disconnect infected devices from wired and wireless networks. If many systems or network segments are affected, broader isolation—potentially taking the network offline at the switch level—may be necessary. CISA’s #StopRansomware Guide describes these containment steps.
- Prioritize critical operations. Identify which services are essential and which systems are affected. Use that information to guide containment and recovery decisions rather than reconnecting devices simply to restore convenience.
- Keep a timeline. Record what you observed, what you isolated, when you did it, and who was involved. This can help responders understand the incident and support later reporting.
If an affected device may contain evidence, coordinate with qualified responders before taking actions that could erase it. Some evidence is volatile or retained only briefly, so prompt preservation matters.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do you preserve evidence and get help?
Capture what may disappear
When feasible, preserve system images and memory from representative affected devices, relevant logs, and malware artifacts. Keep suspicious files, addresses, and other indicators in a controlled way; do not open attacker links or circulate unverified claims publicly. CISA specifically calls attention to volatile evidence and logs with limited retention.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Bring in appropriate expertise
For a complex incident, or when your organization lacks the necessary skills, qualified incident-response and digital-forensics support can help assess the compromise and plan remediation. CISA says federal asset-response assistance can include technical guidance and help evaluating and remediating an incident. Contact law enforcement to ask whether a decryptor is available for the specific ransomware variant; do not assume one exists for every incident.
Who should you report the attack to?
For incidents in the United States, reporting options include CISA, a local FBI field office, and the FBI’s Internet Crime Complaint Center (IC3). Use the agencies’ current official channels. IC3 asks for details such as the ransomware variant, if known; file extension; cryptocurrency information; attacker email addresses or websites; the demand amount; and whether a ransom was paid. Preserve those details as evidence rather than engaging with the attackers.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Reporting routes and obligations differ outside the United States. Organizations should check the requirements that apply in their jurisdiction and follow their incident response and legal guidance.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat if the attackers stole data as well as encrypting it?
Encryption and data theft are separate problems. In a double-extortion attack, criminals may threaten to publish information they claim to have stolen. Restoring files does not establish whether information was accessed or exfiltrated, and it does not resolve a publication threat.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Assess whether sensitive information may have been exposed, using available evidence and qualified advice. Follow your breach-notification plan and determine which legal duties apply. The specific duty and deadline depend on the jurisdiction and facts of the incident; this general guide cannot determine them.
How can you restore systems safely from backups?
Prepare a clean recovery environment
Contain the incident before restoring. Make sure the systems used for recovery are clean and do not reconnect compromised machines just to retrieve files. CISA recommends restoring from offline, encrypted backups and keeping updated golden images for critical systems.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Restore by operational priority
- Identify the services needed for essential operations and set a restoration order.
- Use backups that are isolated from routine access and whose integrity you can verify. If a backup may have been reachable by the attackers, do not assume it is safe.
- Restore data and systems in the clean recovery environment. Check that restored systems are clean before reconnecting them.
- Test the restored services and data, then reconnect them in a controlled way as your response plan allows.
Backup storage alone is not a complete recovery plan. For future readiness, decide what data and systems need protection, keep backups isolated and encrypted, and regularly test that they are available and can be restored. An offline external drive can be one part of a small environment’s backup approach, but it still needs isolation and restore testing.
Should you pay the ransom?
Payment does not guarantee that criminals will provide a working decryptor, return data, or stop threatening the victim. The FBI states, “The FBI does not support paying a ransom in response to a ransomware attack.” CISA, the FBI, and the NSA also discourage payment. Whether you can recover without paying depends on the incident, the integrity of available backups, the state of affected systems, and the resources available to respond; no single outcome is guaranteed.
What should you do after operations are stable?
Review how the attacker gained access, which systems were affected, whether data was taken, and what backup or response gaps made recovery harder. Document lessons learned and update relevant policies, response plans, and exercises. Where appropriate, share useful lessons and indicators with CISA or a sector information sharing and analysis center (ISAC).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
