Stop further recovery attempts until affected devices are isolated and the incident is under control. Preserve the ransom note and other evidence, check whether a decryptor exists for the specific ransomware variant, report the attack, and look for clean offline backups. A second provider may help investigate or plan recovery, but no company can guarantee that encrypted files can be restored.
What should you do first?
Disconnect affected devices from Wi-Fi and wired networks to limit the incident. Do not reconnect them just to check whether files open. If the attack affects a business, school, or other organization, contact its incident-response lead and follow the response plan instead of making ad hoc changes.
As an Amazon Associate I earn from qualifying purchases.
Do not attach a backup drive to a compromised device. CISA recommends isolating affected systems and preserving relevant evidence; its guidance and the FBI also recommend keeping backups disconnected from the systems they protect.
Recommended Free Tools
What should you preserve and request from the first company?
Keep the ransom note, encrypted filenames and extensions, relevant logs, payment demands, and communications with the recovery company. Preserve copies and note what the company examined or changed. These details may help identify the ransomware variant and give another responder a clearer starting point.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Ask the company for a written account of its work, including the methods it tried, what evidence or data it retained, and what changes it made to devices or files. Ask what it believes is and is not recoverable, and what its conclusion is based on. Treat a claim of guaranteed recovery cautiously: the official guidance cited here does not establish a universal success rate for recovery providers.
Could a decryptor work for this ransomware?
Decryptors are variant-specific; there is no universal tool that can unlock every ransomware-encrypted file. Use the ransom note and file extension as clues, then check No More Ransom’s Crypto Sheriff and its catalog of free decryptors. A listed tool may work only for particular variants, so confirm that it matches the infection and follow the tool’s instructions.
Rank #2
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
No More Ransom advises removing the malware before using a decryptor, while warning that malware removal by itself does not decrypt files. If the variant is unknown, or the catalog has no matching tool, do not assume that a generic decryption program will help.
Where should you report the attack?
In the United States, report the incident to the FBI through a local field office or the Internet Crime Complaint Center (IC3). CISA also accepts incident reports and offers assistance. IC3 asks complainants to include the details they know, such as:
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- The ransomware variant, if known, and the encrypted file extension.
- The cryptocurrency requested and the address provided by the attackers.
- Attacker email addresses, websites, or other URLs, and the amount demanded.
- Whether any payment was made.
If you are outside the United States, contact your national cybercrime authority. Reporting and notification duties can vary by country, sector, and incident; confirm the applicable requirements with the relevant authority or your organization’s legal and incident-response leads.
Can backups restore the files?
Clean backups may be the most practical restoration route when there is no applicable decryptor. CISA recommends restoring from offline, encrypted backups while taking care to avoid reinfection. The FBI also advises keeping backups disconnected from the systems they protect.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Before restoring, have an incident responder or your organization’s response lead confirm that the systems and backup copies are safe to use. Restore to clean systems and prioritize the data and services that need to return first. Do not connect an offline backup to a compromised device to test it.
When is a second recovery provider useful?
A second opinion may help when you need incident containment, malware cleanup, forensic investigation, variant identification, a decryptor check, or a plan for restoring from backups. Those are distinct services; an investigation or cleanup can be valuable even when it cannot decrypt files.
Best Value
- USB-C and USB 3.1 compatible.Specific uses: Business, personal
- Innovative style with refined metal cover
- Password protection with 256-bit AES hardware encryption
- Formatted for Mac
Before authorizing more work, ask a prospective provider for a written scope and method, what it will do with your files and evidence, whether it will preserve original media, the costs and conditions, and whether it is promising a specific result. These are practical questions for evaluating a proposal, not government-mandated criteria or proof that a provider can decrypt the files.
What if there is no usable backup or matching decryptor?
File recovery may remain impossible if no clean backup is available and no decryptor supports the specific ransomware variant. The FBI states: “The FBI does not support paying a ransom in response to a ransomware attack. Paying a ransom doesn’t guarantee you or your organization will get any data back.” Payment is not a reliable recovery method.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
