To restore files after a ransomware attack, first isolate affected devices, then recover from a verified clean backup if one is available. If not, check whether a trusted decryptor exists for the specific ransomware variant. There is no universal tool that can be assumed to decrypt every attack, and paying a ransom does not guarantee access to your files or a clean computer.
1. Contain the attack before trying to recover files
Disconnect an affected computer or storage device from Wi-Fi and wired networks. For a business or other organization, isolate affected systems or network segments and activate the incident-response plan. Do not reconnect a device just because some files seem accessible; first establish that the attack is contained.
As an Amazon Associate I earn from qualifying purchases.
If you manage an organization, identify which systems and data are affected and prioritize services needed for safety and critical operations. CISA’s #StopRansomware Guide, published October 19, 2023, treats restoration as part of a broader incident-response process, not a stand-alone file-recovery step.
2. Get help and preserve evidence
For an organization, involve your IT or security team and consider an incident-response provider if the team needs specialist support. CISA recommends retaining relevant logs and, where appropriate, system images and memory captures. It also advises consulting law enforcement about possible decryptors.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Reporting, insurance, contractual, and breach-notification obligations depend on your location and circumstances. Get advice from the appropriate authorities and legal or insurance professionals rather than assuming one set of requirements applies to every incident.
3. Choose a recovery path
The right route depends on whether you have a usable backup and whether a decryptor has been confirmed for the ransomware involved. CISA and the UK National Cyber Security Centre (NCSC) describe these as incident-specific decisions; neither identifies a universal consumer tool for recovering encrypted files.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Recovery path | When it may help | Key check |
|---|---|---|
| Restore from backup | A usable copy of the needed files exists from before the attack. | Confirm the backup is intact and free of malware, and restore to a clean system or network. |
| Use a decryptor | A trusted decryptor is confirmed for the specific ransomware variant. | Verify the match through trusted guidance or law enforcement; do not assume a tool for one variant will work on another. |
| Pay the ransom | This is not a dependable recovery method. | NCSC warns that payment does not guarantee access to data or a computer, and the computer may remain infected. |
Identify the ransomware and scope
Work out which devices and data were affected, and investigate whether the incident also involved data theft, additional malware, or continuing attacker access. CISA advises checking trusted guidance for the particular ransomware variant and consulting law enforcement about possible decryptors. Avoid unverified downloads or claims that one program can recover any encrypted file.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →4. Restore from a verified clean backup
- Check the copy. Confirm the backup is intact and free of malware before using it. The NCSC’s ransomware guidance says: “Before you restore from a backup, confirm that it is free from any malware.”
- Prepare a clean destination. Restore to systems or a network that have been made clean; do not use a compromised machine as the recovery environment.
- Prioritize what returns first. Restore essential data and critical services before less urgent files, following your organization’s continuity priorities where applicable.
- Update before reconnecting. The NCSC advises updating the operating system and other software on a clean network before reconnecting systems to normal operations.
If you do not have a clean backup and no trusted decryptor is confirmed, avoid experimenting with unknown recovery programs. Preserve the affected systems and seek qualified technical or law-enforcement guidance about the incident and any safe options for the particular variant.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
5. Secure the environment before resuming normal use
Restoring files is not enough if the attacker can still access the environment. Investigate how access was gained, check for persistence or precursor malware, secure affected accounts and systems, and close the security gaps before reconnecting. CISA recommends threat hunting and documenting lessons learned; the NCSC likewise advises updating software on a clean network before reconnecting.
For organizations, record what happened and use the findings to update the response plan and backup procedures. Resume normal operations only after containment and recovery checks support doing so.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Prepare backups for a future incident
CISA recommends offline, encrypted backups of critical data and regular tests to confirm they can be restored. Ransomware may target connected backups for deletion or encryption. The NCSC recommends keeping multiple copies across different backup solutions and locations, including offline copies, and checking restores regularly.
An external hard drive can serve as one offline backup destination if your backup process supports disconnecting it between backup sessions. It is a way to protect future backup copies, not a decryptor or a way to recover files already encrypted in an attack. Choose storage based on the amount of data, your operating system, and the backup method you use.
Quick Recap
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
