Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRansomware recovery begins with containment, not a restore button. Isolate infected devices, determine how far the compromise reached, preserve evidence, and activate your incident-response plan. Then rebuild on a clean recovery network from a backup that you can verify is both uncorrupted and free of the attacker’s access. Reconnect services in dependency order and monitor for reinfection.
A decryptor may exist for a particular ransomware variant, but no official guidance promises one for every incident. The CISA-led #StopRansomware Guide recommends consulting law enforcement about that possibility while you pursue independent recovery. Whether paying is lawful or financially sensible depends on the facts and jurisdiction; the steps below focus on restoring operations without relying on payment.
As an Amazon Associate I earn from qualifying purchases.
1. Isolate the attack before touching backups
Immediately separate affected systems from one another and from the rest of the network. CISA advises isolating impacted systems; when multiple systems or subnets appear affected, taking the network offline at the switch level may be necessary. If broader isolation is not feasible, disconnect each device from Ethernet and Wi‑Fi. Use your approved incident-response plan rather than improvising changes that could destroy evidence or spread the compromise. CISA joint guide
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Remove network cables or disable wireless on visibly affected computers.
- Quarantine servers, virtual machines, storage appliances and shared drives that show encrypted files, ransom notes or suspicious activity.
- Prevent automatic reconnection through remote-management tools, mapped drives and synchronization clients until they are assessed.
- Keep a written timeline of what was disconnected, when, and by whom.
- Disable exposed remote-access paths and suspend suspicious accounts from a trusted administrative workstation, not from a machine that may be compromised.
Cloud services need containment too. Revoke suspicious sessions and tokens, pause synchronization jobs and restrict administrative access while preserving audit logs. Do not connect a supposedly clean backup drive to an infected computer to “see if it works.” Use a separate, controlled recovery environment.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
2. Triage systems and set a restoration order
Inventory affected devices, applications, accounts and data stores. Recovery is safer when it follows business or safety priorities rather than an arbitrary device-by-device sequence. CISA specifically calls for prioritizing critical services and their dependencies. CISA joint guide
Identify what is affected
- Record hostnames, users, operating systems, locations and the first time encryption or unusual activity was observed.
- Mark which systems are encrypted, which are merely offline, and which still appear operational but may be compromised.
- List data repositories: local disks, file servers, databases, cloud storage, removable media and backup systems.
- Note service accounts, administrator accounts, remote-access paths and scheduled jobs that could reconnect the attacker.
- Check whether the incident affected identity systems, storage-management consoles, virtualization hosts or backup administrators, not only end-user computers.
Prioritize services, not isolated machines
Start with health and safety functions, revenue-generating operations and the dependencies those services require. A directory service, identity provider, DNS service or database may need to be rebuilt before the application that depends on it. Write the dependency chain down so that staff do not bring a restored application online while its underlying authentication or data layer remains compromised.
Make the order explicit: name the service owner, the minimum data required, the prerequisite systems and the test that proves the service is ready. A small business might restore identity and file storage before accounting software; a larger organization might restore network management, authentication and core databases before customer-facing applications. This list also gives leaders a defensible basis for deciding which operations can remain offline.
3. Preserve evidence while the scope is still visible
Ransomware artifacts can disappear when a machine is rebooted, cleaned or reimaged. CISA recommends retaining relevant logs and, where feasible, system images and memory captures; system memory and security logs can be volatile. Review security-tool alerts and historical logs to determine whether the intrusion began earlier or reached more systems than first observed. CISA joint guide
Evidence to retain
- Endpoint, server, firewall, VPN, identity and cloud-audit logs.
- Ransom notes, file extensions, attacker messages, suspicious scripts and timestamps.
- Disk images and memory captures from representative affected systems when qualified responders can collect them safely.
- Lists of encrypted files, affected accounts, external connections and observed indicators of compromise.
- Backup-console logs showing when backup sets were created, accessed, deleted or altered.
For a home computer, preserve the ransom note and a sample of encrypted files before reinstalling. For a business, coordinate collection with your incident-response or forensic team so that evidence handling is documented and does not delay containment. Record who collected each item, where it was stored and whether a system was powered down, rebooted or modified. That chain of custody can matter for insurance, regulatory inquiries or a later law-enforcement investigation.
4. Report and coordinate the incident
Use the organization’s incident and communications plans. CISA advises considering assistance from CISA, a local FBI field office, the FBI Internet Crime Complaint Center (IC3), or a local U.S. Secret Service field office. Follow applicable breach-notification requirements if personal, regulated or confidential data may have been exposed; encryption of files does not by itself establish whether data was stolen. CISA joint guide
Keep one authorized communications lead. Tell employees or household members how to report suspicious messages and which systems they must not use. Avoid publicly posting ransom notes, internal addresses or investigative details that could help an attacker while responders are still determining scope. Notify cyber-insurance counsel or the insurer’s approved response coordinator promptly if a policy requires it; some policies specify which forensic or legal providers may be used.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →5. Check whether a legitimate decryptor exists
Ask law enforcement or a qualified incident-response provider whether a decryptor is available for the specific ransomware variant. Identification may depend on the ransom note, file extension, encryption behavior and forensic indicators. The CISA guidance treats decryptors as a possibility, not a guarantee; do not assume that a tool advertised online will work safely.
- Do not run an unverified decryptor against the only copy of your data.
- Make a forensic copy first and test any tool on duplicates in an isolated environment.
- Confirm the tool’s source and variant match before using it.
- Retain the original encrypted files until recovered data has been validated.
- Be wary of websites demanding payment or credentials for a supposed free tool, and never install a utility on a still-compromised production host.
6. Compare recovery paths before choosing one
Evaluate each feasible path against integrity, isolation, service priority, reinfection risk and evidence needs. NIST’s recovery guidance emphasizes selecting a correct backup version free of corrupted data and planning restoration carefully. NIST SP 1800-11
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Recovery path | When it can work | Checks required | Main risks |
|---|---|---|---|
| Verified offline, encrypted backup | A backup predates the compromise and remains separate from affected systems. | Verify the backup version, integrity and malware-free status; restore in a clean environment. | The backup may be corrupted, incomplete or compromised if it was reachable during the attack. |
| Variant-specific decryptor | Law enforcement or a trusted responder confirms a tool for the identified ransomware. | Match the variant, preserve originals and test on copies before wider use. | A wrong or malicious tool can damage data or spread further; availability is not guaranteed. |
| Versioned cloud or snapshot copy | The provider retained an earlier version outside the attacker’s effective control. | Check retention, immutability, administrator activity and whether synchronization propagated encrypted files. | A compromised account or synchronized deletion may have altered every visible version. |
| Independent or paper-held records | No complete digital backup exists, but critical records remain in read-only, exported or physical form. | Reconcile records, document gaps and enter data into rebuilt systems only after validation. | Recovery may be incomplete and manual reconstruction can introduce errors. |
If no clean restore point exists, preserve encrypted data and evidence while responders determine whether another legitimate recovery source is available. Do not label a backup “clean” merely because it was not encrypted. Verify that it was created before suspicious activity, was protected from ordinary production credentials and can be restored without bringing the attacker’s persistence along.
7. Build a clean recovery environment
Restore outside the compromised production network. NIST recommends planning and regularly testing backup and restoration procedures, and its ransomware guidance focuses on data integrity and recovery from destructive events. NIST ransomware preparation tips NIST SP 1800-11
Recommended Free Tools
- Provision isolated infrastructure. Use a clean network segment or separate hardware with controlled administrator access. Keep it disconnected from infected systems until security controls and monitoring are ready.
- Harden the foundation. Install supported operating systems and security updates from trusted media. Change credentials, especially privileged and service-account credentials that may have been exposed. Revoke old tokens, keys and remote-management certificates where appropriate.
- Validate the restore source. Confirm the backup date, contents, retention status and integrity before copying data. Select a version that is demonstrably before the compromise. Keep backup media mounted only for the duration needed to perform the controlled restore.
- Restore core dependencies first. Rebuild identity, name resolution, management and data services in the order required by the prioritized service list.
- Restore applications and data. Copy only the necessary data into the clean environment. Scan files and verify database consistency before making services available.
- Test functionality and security. Confirm that users can authenticate, applications read the correct data, permissions are least-privilege and monitoring shows no suspicious activity.
Use clean administrative accounts created in the recovery environment rather than credentials copied from a potentially compromised domain. Keep a record of the exact backup set and restore actions so that a failed attempt can be rolled back and repeated without guesswork.
“Reconnect systems and restore data from offline, encrypted backups based on a prioritization of critical services.”
— CISA-led #StopRansomware Guide, recovery checklist: https://www.cisa.gov/stopransomware/ransomware-guide
8. Reconnect systems without reinfecting them
Reconnection is a controlled change, not the final click of a restore wizard. Keep restored systems segmented while you test them, then add connectivity in small groups. CISA warns that care is needed when reconnecting systems so the compromise is not reintroduced. CISA joint guide
- Reconnect the minimum number of hosts needed for the next critical service.
- Monitor endpoint, identity, network and file-access logs during and after each connection.
- Block or reset known malicious accounts, tokens, scheduled tasks and remote-access routes.
- Verify that restored permissions do not grant broad write access to every workstation.
- Keep the original encrypted systems powered down or isolated until the investigation and recovery teams approve disposal or reimaging.
- Use a staged pilot with a small number of users before expanding access to an entire department.
If suspicious encryption, beaconing or privilege escalation resumes, disconnect the affected segment and return to scope analysis rather than continuing the rollout. Document the observation, affected host and response time; a recurrence can reveal that the initial scope assessment or credential reset was incomplete.
9. Validate that the restored data is usable
A completed copy operation is not proof of recovery. Check representative files from every critical repository, open databases with their native tools, reconcile transaction dates and confirm that required permissions and metadata survived. Have business owners verify that the restored information is complete enough to operate.
For personal computers
- Open documents, photos, project files and email archives from the restored location.
- Check that file names, dates and folder structure are plausible.
- Run security scans before signing back into financial, work or password-manager accounts.
- Keep a second copy of recovered files until the rebuilt computer has operated normally for a reasonable observation period.
For organizations
- Use application-level consistency checks for databases and line-of-business systems.
- Reconcile a sample of records against paper, read-only or independently retained sources.
- Obtain an explicit service-owner sign-off before moving a system from quarantine to production.
- Test backup jobs again after recovery so the rebuilt environment is protected going forward.
10. Avoid common recovery mistakes
Wiping every machine immediately
Reimaging may remove useful memory, logs and malware artifacts. Preserve evidence first when feasible, then rebuild according to the incident-response plan.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Restoring the newest backup automatically
The newest copy may contain corrupted data or attacker persistence. Select a version that predates the compromise and verify its integrity, as NIST advises. NIST SP 1800-11
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Leaving backup storage online
A backup reachable with ordinary production credentials can be encrypted or deleted during the same intrusion. CISA and NIST emphasize offline or isolated, encrypted backups and tested restoration procedures. CISA joint guide NIST ransomware preparation tips
Assuming a newly purchased drive will decrypt old files
An external drive bought after an attack cannot decrypt files already encrypted by ransomware. Its value is preventive: maintain a separate, encrypted backup before an incident and retain the hardware needed to rebuild systems. CISA’s guidance addresses that backup practice, not a particular product or model. CISA joint guide
Running random “decryptor” utilities
Unverified programs may be ineffective, destructive or malicious. Use a tool only when a trusted responder or law-enforcement source confirms that it matches the variant, and test it on copies.
Assuming encryption means there was no data theft
Ransomware incidents can involve both encryption and unauthorized access or copying. Review logs and applicable notification duties instead of treating restored files as proof that confidential information stayed private.
Free tools Windows power users keep installed
One-click scans. No signup required.
11. Adapt the process to your situation
Home computer
- Disconnect Ethernet and Wi‑Fi and unplug external drives.
- Photograph or save the ransom note and preserve a few encrypted files.
- From a different, trusted device, change important passwords and contact your insurer, employer or relevant authorities if required.
- Identify offline or versioned backups and have a qualified technician verify the machine before restoring.
- Restore personal files only after the operating system is rebuilt and patched.
- Check cloud storage from a trusted device for earlier versions, but pause synchronization until you know encrypted files have not propagated.
Small business
- Use the incident plan to isolate endpoints, servers and cloud identities; take affected network segments offline when necessary.
- Assign incident, communications, legal and service-owner roles.
- Inventory critical services and dependencies, then establish a clean recovery segment.
- Preserve logs and images while selecting a verified backup version.
- Restore and reconnect in priority order, with monitoring and owner approval at each stage.
- Coordinate with the insurer, law enforcement and any approved incident-response provider before making irreversible changes.
Larger organization
Coordinate security operations, infrastructure, legal, privacy, business continuity and executive leadership. Consider specialist incident-response and digital-forensics assistance when the scope, regulatory exposure or evidence requirements exceed internal capacity. No provider can legitimately guarantee decryption or a fixed recovery time.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.12. Turn the incident into a tested recovery capability
After services stabilize, document the timeline, decisions, evidence preserved, failed restore points and dependency surprises. Update the incident-response and business-continuity plans, then exercise them. NIST’s ransomware publication index lists IR 8374 Rev. 1 as final and SP 800-61 Rev. 3, with the index updated June 11, 2026; these are guidance publication dates, not outcome statistics. NIST ransomware publications
- Keep multiple backup generations, with offline and encrypted copies.
- Test restoration on a schedule and record how long each dependency takes.
- Use separate backup credentials and limit who can delete or alter backups.
- Practice isolating a network segment and communicating during an outage.
- Review retention, notification and evidence-handling requirements for your jurisdiction.
- Include cloud identities, SaaS exports, virtualization hosts and backup-management consoles in recovery exercises.
Preparedness determines whether “restore without paying” is a realistic option. A backup that has never been restored, or cannot be separated from production, is an assumption rather than a recovery plan. An external hard drive can be useful for maintaining an offline backup before an incident, but buying one after encryption has occurred does not recover existing files.
Sources and scope of the guidance
The CISA-led #StopRansomware Guide is a joint resource developed with MS-ISAC, the FBI, NSA and the Joint Ransomware Task Force; the guide identifies its update as September 2023. NIST SP 1800-11 addresses data integrity and recovery from ransomware and other destructive events, while NIST’s preparation tips cover backup and restoration practices. These sources support containment, evidence preservation, prioritized restoration and clean reconnection; they do not provide a universal ransom-payment decision, guaranteed decryptor, recovery-time promise or success rate.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Frequently Asked Questions
Should I shut down a ransomware-infected computer immediately?
First isolate it from Ethernet, Wi‑Fi and shared drives, following your incident plan. Because memory and logs can be volatile, preserve evidence or obtain responder advice before powering down when feasible. If the device is actively spreading encryption and no responder is available, containment takes priority.
Can I restore from the newest backup?
Not automatically. Choose a version that predates the compromise and verify that it is complete, uncorrupted and separated from the attacker. The newest backup may contain damaged files or persistence.
What if every connected backup was encrypted?
Keep the encrypted data and evidence intact. Check offline media, immutable or versioned cloud copies, independently retained exports and other legitimate recovery sources with a qualified responder. Do not assume that an unencrypted copy is clean without checking its date and access history.
Is it safe to use a free ransomware decryptor found online?
Only use a tool whose source and ransomware variant have been confirmed by law enforcement or a trusted responder. Preserve originals, test on duplicates in an isolated environment and retain the encrypted files until recovery is validated.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Does paying guarantee that files will be restored?
No official guidance guarantees a working key, complete recovery or removal of the attacker’s access. Payment decisions involve legal, financial and operational facts that vary by jurisdiction; this procedure focuses on independent recovery.
How do I know when a restored system is safe to reconnect?
Rebuild it in a clean environment, rotate exposed credentials, apply updates, scan restored data, test application and permission behavior, and monitor logs. Reconnect only the hosts required for the next prioritized service, expanding in controlled stages.
Should I buy an external hard drive after an attack?
A new drive cannot decrypt files already encrypted by ransomware. It can support future preparedness when used as a separate, encrypted, offline backup and when restoration is tested before an incident.
Who should a business notify?
Use the incident and communications plans. CISA advises considering CISA, a local FBI field office, IC3 or a local U.S. Secret Service field office. Also consult legal counsel, insurers and applicable breach-notification authorities.
The Bottom Line
Contain first, preserve evidence, and map the services and dependencies that matter most. Restore only from a verified clean backup or other legitimate recovery source in an isolated environment, then reconnect gradually while monitoring for reinfection. A tested offline backup and practiced recovery plan are what make restoration without paying a ransom achievable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
