Before restoring after ransomware, verify that the intended backup is available and that a representative recovery works in a clean, isolated environment. Do not begin production recovery while the incident may still be active or treat a successful checksum as proof that backup contents are safe.
1. Contain the incident before touching recovery systems
Follow your incident response plan before restoring data. Isolate affected systems and coordinate isolation if multiple devices or network segments are involved. Use out-of-band communications when appropriate so response work does not rely on potentially compromised systems.
As an Amazon Associate I earn from qualifying purchases.
If a device cannot be disconnected from the network, use the broader isolation measures in your plan. Powering it down is a fallback, not a routine first step: shutdown can destroy volatile evidence that responders may need. Restoring a backup is not a containment measure.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems2. Establish the scope and look for remaining access
Determine which systems and services are affected, then prioritize investigation around the systems needed for critical operations. Review available security alerts, endpoint tools, and logs for signs that the intrusion reached additional systems or began earlier than first suspected. Precursor malware may indicate that the incident is not resolved.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Use your approved response process and involve qualified incident responders when appropriate. A backup can be intact while an attacker still has access to the environment in which it will be restored.
3. Check that the backup is usable and appropriate
CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster-recovery scenario. It also recommends regularly testing backup procedures. These are recommendations to exercise recovery, not a universal test interval or a prescribed checksum tool. See the CISA #StopRansomware Guide.
For the copy you intend to use, work through these practical checks. They translate the recovery goal into questions for your organization; they are not a verbatim CISA checklist.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Access: Can authorized responders reach the intended copy through an approved recovery path, without relying on compromised accounts or systems?
- Protection: Is the copy isolated from the affected environment, and can you confirm its encryption and access controls?
- Integrity: Does the backup system report a successful integrity check, if that feature is available?
- Restoration: In a clean, isolated test environment, can you restore representative data and the applications or dependencies needed to use it?
- Suitability: Do the restored files, system versions, and application data match what the business needs to resume service?
- Dependencies: Are trusted credentials, encryption keys, system images, software installers, and configuration details available for recovery?
What an integrity check does—and does not—prove
A checksum or storage-level integrity check can show that data matches an expected value. By itself, it cannot show that the data predates the compromise or is free of malicious content. Assess backup dates and contents as part of the incident investigation, and have responders determine whether the copy is a suitable recovery point.
4. Test the actual restore procedure in isolation
A backup listing or a green status in a backup console does not demonstrate that a service can be recovered. Exercise the restoration steps your team would use during a disaster, using a representative recovery test in an isolated environment. Check that files open, applications start, and required dependencies are present. Record failures and resolve them before relying on that procedure for production recovery.
There is no single scan or checksum that certifies every backup as safe. The right validation depends on the systems, threat, and response plan; do not treat any one technical check as a substitute for investigation.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
5. Restore in critical-service order on a clean recovery network
Once the incident is contained and an appropriate recovery point is established, restore from offline, encrypted backups according to critical-service priorities. CISA’s checklist says to reconnect systems and restore data based on prioritization of critical services. The order depends on service dependencies, available clean infrastructure, and the incident response plan; it is not the same for every organization.
Keep the recovery environment clean. CISA gives a recovery VLAN as an example and warns against adding anything but clean systems to it. Restore only the systems that have been assessed for recovery, and avoid connecting recovered machines to affected networks prematurely.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Assess restored systems before returning them to production
Use your security and recovery plan to assess restored systems before reconnecting them to production. Confirm that the restoration succeeded, that expected services and dependencies work, and that the response team has addressed the risks identified during the investigation. CISA’s guidance does not define one final scan that certifies a system as safe in every environment, so readiness decisions must be based on the incident and your environment.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Document recovery issues and lessons learned as part of the response. For future preparedness, disconnect external backup drives when they are not actively in use; a drive connected to a compromised system may also be exposed to ransomware.
How individuals should adapt this process
CISA’s guidance is aimed chiefly at organizations. For a personal device, avoid reconnecting a suspected infected computer to backup media, and seek qualified help if the incident involves a work-managed device, critical data, or systems you do not control. Follow the responsible organization’s incident process rather than attempting an independent restore.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
