Restore business operations in stages—not by reconnecting every device at once. First contain the incident and establish what is affected; then prioritize essential services, rebuild clean systems, validate backups, and bring services back gradually while monitoring for signs of reinfection.
1. Coordinate the response and contain the incident
Use the organization’s incident response and communications plans. Bring in the appropriate technical, leadership, insurance, and external response stakeholders, and preserve relevant logs and other evidence. The joint #StopRansomware Guide from CISA, the FBI, NSA, and MS-ISAC recommends identifying affected systems and isolating them to limit further spread.
As an Amazon Associate I earn from qualifying purchases.
Disconnect affected endpoints or subnets from the network where feasible. If many devices or network segments are involved, isolation at the network level may be necessary. Coordinate isolation through out-of-band communications when appropriate, so responders are not relying on potentially compromised systems. CISA cautions that shutting down a device can destroy volatile evidence; consider disconnecting it from the network first when that can be done safely.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →As you contain the incident, use security tools and logs to scope affected assets and accounts and look for precursor activity, malware, and persistence. Do not treat a machine as safe merely because ransomware is no longer visibly running.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
2. Decide what to restore first
Set recovery order according to business impact, not convenience. Start with systems that support health and safety, revenue generation, or other essential services, then include the dependencies those systems need to function. A critical service may rely on identity, networking, storage, or other shared infrastructure, so map those dependencies before restoring it.
Use the organization’s critical-asset inventory and dependency map if available. The right order depends on the business’s systems, incident findings, and sector obligations; there is no universal sequence that fits every environment.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
3. Prepare a clean recovery environment
Rebuild affected systems from known-good standard images where possible, or from infrastructure-as-code templates where those are part of the organization’s operations. Investigate how the attackers entered and whether they left persistence behind. Address exploited vulnerabilities and clean the environment before restoring data or reconnecting systems.
Secure affected accounts as part of remediation. Reset compromised credentials after the environment has been cleaned and rebuilt, rather than allowing potentially exposed credentials to regain access to restored systems.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
4. Verify backups before using them
Choose offline, encrypted backups and verify their availability and integrity before restoring data. Test the recovery process in a segregated or otherwise clean environment, and connect only systems that have been confirmed clean. CISA recommends routinely testing backups through disaster-recovery exercises; keeping golden images and, where rebuilding requires it, suitable hardware can also help.
If you are selecting offline backup storage, assess whether it can be isolated from production, encrypted, and protected from compromised production credentials. Check that its capacity and compatibility match the systems you would need to rebuild, and test that data can actually be restored. An external drive may be one part of a backup setup, but buying a drive alone does not make backups secure or recoverable.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
5. Restore and reconnect services gradually
- Restore by priority. Use verified backups to restore data for the critical services selected in your recovery plan, including their dependencies.
- Admit only clean systems. Keep unverified devices out of the recovery network; do not reconnect everything simply because a backup restore has started.
- Check service function. Confirm that each restored service works as expected before expanding its connections or moving on to lower-priority systems.
- Monitor as you expand. Watch for suspicious activity as systems and services return, and pause expansion if indicators of compromise reappear.
CISA’s guide gives a direct warning: “Take care not to re-infect clean systems during recovery.” Gradual reconnection, clean systems, and careful monitoring help reduce that risk.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute6. Close out the incident and improve the plan
Have the designated IT or security authority decide when the incident is over, using criteria established in the organization’s plans. Document what happened and what responders learned, then update response and recovery procedures. Organizations may also consider sharing relevant lessons and indicators with CISA or a sector information sharing and analysis center.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Notification duties are not settled by a general recovery checklist. They depend on jurisdiction, sector, data types, and incident circumstances. For a live incident, consult qualified legal counsel and the applicable regulator guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
