Recommended Free Tools
A verified, clean backup restored after the ransomware incident has been contained is generally the safer primary recovery method. A decryptor can be useful when a trusted tool exists for the exact ransomware variant, but no tool is universal, and decrypting files does not remove malware or attacker access. The safest choice depends on whether the backup or decryptor is trustworthy, what data may be lost, and whether the systems can be recovered without reinfection.
How the two recovery methods differ
| Decision factor | Backup restore | Decryptor |
|---|---|---|
| Availability | Requires an accessible, sufficiently recent backup that is clean. | Requires a working tool for the exact ransomware variant and affected encryption. One may not exist. |
| Data recovery | Files created or changed after the selected backup may be missing. | May recover encrypted files, but availability and completeness depend on the variant and tool. |
| Safety checks | Check the backup for malware and select a protected prior version; test restoration where possible. | Verify the tool through trusted incident-response or law-enforcement channels; an unknown download should not be trusted. |
| Reinfection risk | Contain and eradicate the incident before restoring, then reconnect only clean systems. | Decrypting files does not establish that malware, persistence, or attacker access has been removed. |
| Time and disruption | May be quicker when clean backups and tested procedures are ready; rebuilding can still take time. | May be quicker in some cases, but tool availability and performance are uncertain. |
| Other incident effects | Restoring files does not address possible data theft or disclosure obligations. | Decrypting files does not reverse data theft or resolve disclosure obligations. |
These are practical comparison factors, not universal rankings: official guidance does not establish a recovery-time advantage or success rate for either method across incidents. A backup may prove quicker when both a backup and decryptor are available, but that is conditional, not a guarantee. UK NCSC payment guidance
As an Amazon Associate I earn from qualifying purchases.
When a decryptor is worth considering
Ransomware decryptors are variant-specific. Researchers sometimes identify encryption flaws and release tools, but that does not mean every ransomware family, version, or encrypted file can be decrypted. The joint CISA, MS-ISAC, NSA, and FBI #StopRansomware Guide recommends consulting federal law enforcement about possible decryptors. For a specific incident, seek help from qualified incident responders or law enforcement to identify the ransomware and verify whether a legitimate tool is available.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDo not treat a decryptor download as safe just because it claims to match the ransomware note or file extension. A misleading or malicious tool can add risk, and successful decryption would not by itself clean the affected system. Preserve evidence and handle the incident before running a tool on affected machines.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
When restoring from backup is safer
A backup is a strong recovery option when it is both clean and recent enough to meet your needs. “Available” does not necessarily mean safe: ransomware actors may delete or encrypt backups they can reach, and cloud sync may copy encrypted files over clean versions. Check that the selected restore point predates the damage, and verify it is free of malware before restoring. CISA also warns that automated cloud backups may not protect against encrypted files overwriting unaffected copies. CISA #StopRansomware Guide
Backup resilience comes from how copies are protected and recoverable, not simply whether they are in the cloud or on a separate device. CISA recommends offline encrypted backups and regular restoration testing. The UK NCSC’s cloud backup principles and on-premises backup principles address protection and recovery for each arrangement.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What to do before recovering files
- Contain affected systems. Follow your incident-response plan and isolate impacted devices or systems. Preserve relevant evidence; CISA advises capturing system images, memory, logs, and malware samples when appropriate.
- Get help identifying the incident. Consult qualified incident responders and law enforcement about the ransomware family and whether a legitimate decryptor is available.
- Check backup integrity and exposure. Determine whether the backup system, its accounts, or credentials may have been compromised. Do not assume a synced copy is clean if encrypted files could have replaced earlier versions.
- Select a clean restore point. Check it for malware, then choose a version that balances recovery needs against data loss. For organizations, prioritize critical services.
- Restore only after containment and eradication. Recover onto clean systems and reconnect them carefully to avoid reinfection. NCSC’s ransomware attack guidance also advises checking backups for malware before restoring.
- After recovery, close the path back in. Test restoration procedures, review the incident, reset affected credentials as appropriate, and address the vulnerabilities that enabled access.
Reduce the chance that backups become part of the incident
For home users and small businesses
Keep removable backup media disconnected and off the network when it is not being used. A detached external drive can hold an offline copy, but it still needs a regular backup schedule and restore testing; it is not ransomware-proof. The UK NCSC gives this advice in its WannaCry guidance for home users and small businesses.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11For organizations
Assess cloud and on-premises backups for isolation, protection against destructive actions, account and key management, prior-version retention, alerting, and tested restoration. Cloud storage is not automatically immune to ransomware: configuration, vendor dependency, and cost can matter, including with cloud-to-cloud backup and immutable storage. The NCSC’s ransomware-resistant backup guidance brings together principles for resilient backup arrangements.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How to choose for a specific incident
- Choose a backup-led recovery when you have a clean, protected restore point that meets your recovery needs, and can restore after containment and eradication.
- Consider a verified decryptor when trusted responders or law enforcement confirm a legitimate tool for the exact variant, especially if no usable backup exists or a backup would leave unacceptable data loss.
- Do not rush either route if the backup may be compromised, the tool is unverified, or the attacker may still have access. Secure and investigate the environment before using either method.
No recovery method restores stolen data or automatically resolves any disclosure obligations. Recovery decisions should therefore account for the broader incident, not only whether files become readable.
Quick Recap
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
