Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Isolate affected computers, servers and network segments immediately, using wired, wireless and mobile disconnection. Do not shut systems down unless you cannot disconnect them; shutdown can erase volatile evidence. Report the incident promptly to the FBI and IC3, CISA and any required regulator or sector authority. Official guidance does not recommend paying: payment cannot guarantee decryption or prevent stolen data from being published.
The first response: contain the spread without destroying evidence
Ransomware response is a time-critical sequence. The first objective is to stop the attacker and malware moving to additional hosts, not to negotiate or begin a normal IT shutdown. Use a written incident plan if one exists, and record who made each decision and when.
As an Amazon Associate I earn from qualifying purchases.
- Identify the apparent scope. Note which user devices, servers, virtual machines, cloud workloads and network segments show encrypted files, ransom notes, unusual logins or other symptoms. Treat any system that shares credentials, trust relationships or network access with an affected host as potentially exposed until responders assess it.
- Isolate affected systems. Remove Ethernet cables, disable Wi-Fi and disconnect other wired, wireless or mobile connections. If several systems or subnets are involved, take the affected network offline at the switch level where feasible. CISA’s #StopRansomware guidance puts immediate isolation first because a delay can allow lateral movement.
- Keep systems powered while you can disconnect them. Running memory may contain encryption keys, attacker tools, usernames, command history or other evidence. FTC guidance likewise recommends disconnecting infected devices without powering them down.
- Power down only when disconnection is impossible. If a device cannot be separated from the network, shutting it down may be safer for containment than leaving it connected. Document that decision and the time it occurred; shutdown can destroy volatile-memory evidence.
- Preserve what is visible. Save ransom notes, payment instructions, attacker messages, relevant logs and timestamps. Do not delete files, reformat drives or run cleanup utilities before qualified responders advise you.
- Move coordination off the suspected network. Attackers may monitor email, chat or file shares. Use out-of-band phone communication or another channel that does not depend on potentially compromised accounts.
Do not reconnect an isolated computer merely to check whether it appears normal. Reconnection should wait until responders have contained the intrusion and recovery copies have been validated as clean.
Should you unplug the computer or turn it off?
Disconnect first
Unplug Ethernet, remove Wi-Fi access and sever other network paths on an affected device. For a larger incident, network-level isolation at switches can contain many hosts quickly. Include wired, wireless and mobile links in the isolation plan; a laptop removed from Ethernet can still spread ransomware over Wi-Fi or a cellular connection.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
When shutdown is the fallback
CISA advises powering down only when you are unable to disconnect from the network. FTC describes the same evidence-preserving principle. A forced shutdown can remove volatile evidence, so ask an experienced incident-response team how to capture memory or a forensic image when circumstances permit. If immediate safety requires shutdown, record the action rather than delaying containment while attempting an ideal collection.
What not to do during isolation
- Do not log in to suspected systems with administrator credentials just to investigate.
- Do not attach an isolated machine to a clean network for convenience.
- Do not erase ransom notes or attacker communications.
- Do not announce containment plans over channels the attacker may control.
Who to call and what to report
Reporting is appropriate whether payment is being considered, has already occurred or will not be made. It can help investigators connect related incidents and may be required by law, contract, insurance policy or sector rules.
United States
Contact a local FBI field office and file a report with the Internet Crime Complaint Center (IC3). Contact CISA when appropriate and follow the notification rules for your industry and the data involved. Notify internal leadership, legal counsel, your cyber insurer, managed security provider and any retained incident-response specialists according to your response plan.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →United Kingdom
Follow the National Cyber Security Centre’s reporting routes and any applicable UK regulatory or sector requirements. NCSC states that UK law enforcement does not encourage, endorse or condone ransom payment.
Other jurisdictions
Notification deadlines and affected parties differ by jurisdiction, sector and data type. Counsel should determine whether privacy, critical-infrastructure, financial, health, employment, contractual or cross-border rules apply. A report to law enforcement does not replace a regulator or customer notification that another rule requires.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Build a reporting packet
- The ransom note, file extensions and any displayed identifiers.
- Wallet addresses, payment demands and transaction details if money was sent.
- Attacker emails, chat transcripts, portal addresses and screenshots.
- First-observed and last-known-good timestamps, with the time zone.
- A list of affected hosts, users, servers, subnets and cloud services.
- Indicators of compromise, suspicious accounts, processes, domains and IP addresses.
- Relevant endpoint, authentication, firewall, VPN, cloud and backup logs.
- Evidence or informed suspicion that files were copied or exfiltrated.
Preserve original files where possible and give copies to responders. Keep an evidence log showing who collected each item, when and from which system.
Should you pay the ransom?
Official agencies do not treat payment as reliable recovery. The FBI’s position is explicit: “The FBI does not support paying a ransom in response to a ransomware attack.” The bureau also warns that payment does not guarantee data recovery and can encourage perpetrators and additional criminal actors. CISA, the FBI and NSA similarly caution that payment can embolden adversaries, fund illicit activity and make further attacks more attractive.
Recommended Free Tools
The FTC says law enforcement does not recommend paying, while recognizing that a business decision involves competing risks and costs. Before any decision, involve legal counsel, law enforcement and the insurer identified in your policy. They can assess evidence, contractual duties, sanctions or other legal constraints that vary by location and sector.
Why a payment is not a recovery plan
- A criminal group may provide a defective decryptor, no decryptor or a tool that works only partially.
- Payment does not prove the attackers deleted copied data.
- Other criminals may already possess the stolen files or credentials.
- Paying can finance the same operation or invite repeat targeting.
- Systems can remain compromised even after files are decrypted.
Payment also cannot be used as a promise to customers or employees that disclosure will not occur. Treat any negotiation as a legal and incident-response activity, not as a substitute for containment, investigation and restoration.
Does paying stop hackers from leaking stolen data?
No. Payment does not assure that stolen information will remain private. Modern extortion can involve encryption, data theft or both, and a criminal may publish, sell or threaten to release copied data regardless of a promise. Preserve evidence of suspected exfiltration and let counsel and responders determine what data may be affected and which notices are required.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Do not assume that a ransom note mentioning “deletion” is proof that copies were destroyed. Validate the incident through logs, endpoint evidence, cloud audit records and other forensic sources. If data exposure is possible, prepare communications and regulatory decisions on that basis rather than waiting for a criminal’s assurance.
How to investigate and eradicate the intrusion
Once affected systems are isolated, use experienced internal or third-party responders. The investigation should establish the initial access route, the attacker’s lateral movement, persistence mechanisms, accounts used, systems touched and data that may have left the environment.
Contain accounts and access
Do not change every credential blindly while evidence is being collected; coordinate the sequence with responders. After malware and persistence are removed and systems are verified clean, change credentials, revoke unauthorized sessions and rotate secrets that may have been exposed. Include service accounts, remote-access credentials, cloud tokens and backup administrators.
Remove persistence
Responders should identify unauthorized scheduled tasks, startup items, remote tools, accounts, firewall changes and other mechanisms that could let an attacker return. Rebuilding a system may be safer than trying to clean it, depending on the evidence and business role. Keep forensic images and logs before destructive remediation when feasible.
Document decisions
Record isolation points, systems rebuilt, credentials rotated, evidence preserved, notifications made and the reasoning for any exception. This record supports technical recovery, regulator questions, insurance claims and lessons learned.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Can you restore from backup safely?
Yes, but only from copies you have reason to believe are clean. A backup connected to the production network or reachable with compromised credentials may also be encrypted or altered. Offline and encrypted copies reduce that exposure, but they still need integrity and malware checks.
- Protect the backup source. Isolate backup servers, repositories and removable media from affected networks. Restrict access to a small, verified recovery team.
- Validate the restore point. Check backup timestamps against the attacker’s known presence, scan the backup and its recovery image, and investigate unexpected changes. Choose a point before compromise when evidence supports that conclusion.
- Prepare a clean recovery environment. Rebuild or reimage critical hosts using trusted media and required software. Apply security updates and harden administrative access before exposing restored data.
- Restore in business priority order. Begin with essential identity, network, communication or operational services identified in the response plan, then restore dependent applications. Keep each restored system segmented while it is checked.
- Test before reconnecting. Confirm that files open, applications function, accounts are controlled and monitoring shows no persistence. Reconnect only systems that responders have cleared, and do so in a controlled sequence.
- Monitor after recovery. Watch authentication, endpoint, network and backup logs for renewed suspicious activity. Retain the recovery record and evidence.
Test restoration procedures before an incident. A backup that exists but cannot be recovered, lacks required software or depends on credentials stored in the compromised environment is not a dependable recovery capability.
Containment choices compared
The practical difference between isolating, shutting down and paying is shown below. The ratings describe the direction of risk, not a guarantee for a particular incident.
| Action | Containment speed | Volatile evidence | Known-clean backup recovery | Legal and regulatory exposure | Repeat-extortion risk | Operational downtime |
|---|---|---|---|---|---|---|
| Disconnect affected hosts and subnets | Immediate when access is available | Usually preserved | Supports investigation and validation | Still requires reporting and notification review | Does not fund the attacker | Targeted systems and isolated segments stop operating normally |
| Power down when disconnection is impossible | Immediate fallback | May be lost | Does not itself validate backups | Documentation remains important | Does not fund the attacker | Powered-off devices are unavailable |
| Pay a ransom | Does not contain the intrusion | Does not preserve evidence by itself | Does not create a clean backup | Requires counsel and law-enforcement consultation | Can encourage attackers and other criminals | May still be substantial if decryption fails or rebuilding is required |
Legal, insurance and communications considerations
Ransomware can trigger obligations beyond restoring technology. The applicable duties depend on where the organization operates, its sector, the type of information involved and its contracts. Counsel should coordinate with regulators, customers, employees and law enforcement so that public statements do not speculate or destroy evidence.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchNotify the cyber insurer and follow the policy’s approved vendors, consent rules and documentation requirements. An insurer may require an approved incident-response firm or a specific reporting workflow. Use out-of-band communications for sensitive coordination, and assume compromised email accounts may be visible to the attacker until verified.
How to prepare before the next incident
- Maintain offline, encrypted backups with access separated from everyday administrator accounts.
- Keep recovery images, license information and required software available for a rebuild.
- Test both file restoration and full-service recovery on a schedule; record the result and fix failures.
- Define isolation authority, contact numbers, reporting routes and an out-of-band communications method.
- Exercise the incident-response plan with leadership, legal counsel, IT, communications, insurers and relevant suppliers.
- Document restoration priorities and dependencies so teams know which clean systems must return first.
An external hard drive can be one component of an offline backup plan, but it must be encrypted, disconnected or otherwise protected from ransomware and included in tested procedures. A drive left permanently attached to a compromised computer is not an offline backup.
Bottom line for the first hour
Containment comes before negotiation. Isolate wired, wireless and mobile connections, preserve evidence and use out-of-band coordination. Shut down only when you cannot disconnect. Report to the appropriate law-enforcement and regulatory channels even if payment is under consideration, and restore only from backups that responders have validated as clean. Payment cannot guarantee decryption or prevent data leaks, so it should never be mistaken for a complete incident-response plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
