Recommended Free Tools
First, isolate affected devices from the network, then get help before attempting cleanup or restoration. Don’t connect backup drives to a compromised computer, delete the ransom note, or assume a reboot will remove the attacker. Preserve what you can, report the incident, and restore only from a source you have reason to believe is clean.
This U.S.-centered checklist draws on CISA’s joint #StopRansomware Guide, whose official publication record lists a revision date of October 19, 2023. The guide is aimed primarily at organizations; individuals can use its containment and recovery principles, but may need a qualified technician or incident-response professional to preserve evidence and investigate safely. Reporting routes and breach-notification requirements differ outside the United States.
As an Amazon Associate I earn from qualifying purchases.
What should you do immediately?
- Disconnect affected devices. Turn off Wi-Fi on visibly affected computers and unplug their network cables. If several systems at a business are affected, the IT or security lead may need to isolate a larger network segment, such as at a switch. Do not casually reconnect devices.
- Keep backup media away. Do not plug an external drive or other backup device into an affected computer. If backups are reachable through a network or account, ask the person responsible for IT to protect them without exposing another device.
- Contact the right person. At a business, notify the incident lead or the person responsible for IT or security. A home user without in-house support should contact a reputable technician or incident-response professional whose identity and capabilities can be independently verified.
- Record what you see and do. Note when you discovered the incident, which devices or services appear affected, what the ransom note says, suspicious messages, and the actions already taken. Keep the note and relevant messages; don’t pay, delete files, or run cleanup tools before getting advice.
Should you turn off or restart the computer?
There is no universal instruction to shut down or restart every ransomware-infected device. CISA advises preserving volatile evidence, including system memory and security logs, where feasible; powering a machine off may make some evidence unavailable. If you can isolate it from Wi-Fi or the wired network, do that and ask an incident responder how to proceed. If a device creates an immediate safety risk, prioritize people’s safety and contact the appropriate emergency or technical support.
How do you find out what was affected?
For an individual or household
Make a cautious inventory of affected devices, accounts, and services. A ransom note alone does not establish how the attacker got in, whether data was copied, or whether other devices are compromised. Don’t sign in to sensitive accounts from a device you suspect is affected; ask a qualified technician for guidance on checking accounts and other devices.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For a small business
Identify affected and apparently unaffected systems, accounts, services, and the data they hold. Triage by criticality and dependencies, particularly systems needed for health, safety, revenue, or essential operations. Review available security alerts and logs, and use endpoint or forensic investigation to establish the scope. Ransomware can be evidence of an earlier compromise, so don’t treat the encrypted machines as the whole incident.
How do you preserve evidence and coordinate the response?
For a business, activate the incident-response plan and coordinate the incident lead with appropriate IT or security staff, leadership, legal counsel, insurance contacts, and communications staff. Don’t make public claims about what information was accessed until the investigation supports them.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Preserve relevant logs and, when technically feasible, system images and memory captures before remediation. Evidence collection can be technical and time-sensitive; a home user should not attempt it with unfamiliar tools. Record actions and decisions as the response proceeds, and restrict access to evidence and incident details to people who need them.
Who should you report ransomware to?
In the United States, CISA’s guide lists CISA, a local FBI field office, FBI Internet Crime Complaint Center (IC3), and a local U.S. Secret Service field office as reporting or assistance paths. Confirm current contact details through the agencies’ official channels. Reporting promptly can help authorities assess the incident and advise on available assistance, even if you are still deciding how to respond to the ransom demand.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
A business should also assess whether the incident involves a reportable data breach. Notification rules may apply to personal information or certain regulated data, but requirements depend on jurisdiction, industry, and the facts. Seek jurisdiction-specific legal advice rather than assuming there is one deadline that applies to every organization. Outside the United States, use the relevant national or regional reporting authorities.
Should you pay the ransom?
CISA, the FBI, and NSA strongly discourage paying. Payment can encourage criminal activity and does not guarantee that files will be returned, that a decryption key will work, or that stolen data will be deleted. It is not a substitute for reporting, investigation, or recovery planning. A business considering any response to a demand should coordinate with its incident lead, legal counsel, and relevant authorities.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Can you get your files back?
Possibly, but no outcome is guaranteed. Recovery may depend on whether clean backups exist, whether the attacker reached other systems or accounts, and whether a verified decryptor is available for the exact ransomware variant. CISA advises consulting federal law enforcement about decryptors that researchers may have released. Don’t download a tool based only on a ransom-note name or an unverified website; confirm its source and that it applies to the identified variant.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How should you restore a home computer or business?
- Decide what must return first. A business should prioritize critical services and their dependencies; an individual should identify essential files and functions. Don’t rush every system back online at once.
- Establish a clean recovery environment. Rebuild on systems or a network believed to be clean. Keep systems out of the recovery environment until they have been assessed and are believed clean.
- Verify backups before restoring. Use offline, encrypted backup copies and check their integrity. CISA recommends regularly testing both backup availability and restoration in a disaster-recovery scenario. Never assume a backup is usable simply because the drive or account is accessible.
- Restore in a controlled order. Restore the services and data needed for priority operations, then verify that they function before expanding recovery. Avoid reconnecting recovered systems to an environment that has not been assessed.
- Review access after systems are clean. Once malware has been removed and systems are believed clean, reset affected credentials and review who has access. Tailor account actions to the incident and the identity provider; a business should apply least-privilege access practices.
What should you change after recovery?
Document what happened, what was affected, and what response actions worked or failed. A business should update its response procedures and test its recovery plan. For ongoing backup protection, keep copies offline and encrypted, separate them from the systems and accounts they protect, and regularly verify that data can be restored. An encrypted external hard drive can serve as an offline copy only if it is disconnected from the compromised environment and its backups are tested; it is not a fix for active malware.
Quick Recap
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
