Disconnect the affected device or network immediately, but do not automatically shut the computer down. Unplug Ethernet or disable Wi‑Fi on one device. If several systems are involved, an organization should isolate affected segments and coordinate by phone or another out-of-band channel. Preserve the ransom note and other evidence, call qualified responders, report the incident as appropriate, and investigate for an ongoing intrusion. Restore only after containment, using clean and verified backups. Do not assume that paying will recover your files.
The first 15 minutes: stop the spread
1. Isolate the affected device or network
On a personal computer, unplug the Ethernet cable and turn off Wi‑Fi and Bluetooth if they are not needed. Disconnect external storage, shared backup drives and other removable media that are not required for evidence preservation. Do not browse the web, open email or connect the device to another network while deciding what to do.
As an Amazon Associate I earn from qualifying purchases.
For a business, school or other organization, identify systems showing encrypted files, ransom notes, unusual names or unavailable shares and isolate them immediately. The joint CISA, FBI, NSA, MS-ISAC and Joint Ransomware Task Force guide recommends taking broader network action when multiple systems or subnets are affected. Network administrators may need to disable switch ports, quarantine VLANs or take a segment offline. Coordinate those changes through incident leaders and use phone or another out-of-band method where possible, so attackers monitoring email or collaboration tools do not learn how containment is being performed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Isolation is containment, not recovery. Leave affected systems disconnected until responders establish that the initial access route, stolen credentials and persistence mechanisms have been removed.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
2. Do not reflexively power off
Shutting down can erase volatile evidence held in memory, including running processes, encryption keys, network connections and malware artifacts. CISA’s guide and its PDF version 3.1 therefore treat power-off as conditional: disconnect first and preserve the running state when practical.
Power down only when you cannot disconnect the device or network safely, when continued operation could spread the attack, or when an incident responder directs you to do so. A home user who cannot judge that trade-off should leave the isolated machine untouched and call qualified technical help. Never keep using it to “see what still works.”
3. Preserve the ransom note and timeline
Photograph or copy the ransom note, file-extension changes, attacker contact details and any deadline. Record the first time you noticed the problem, which devices and accounts were in use, what changed, and every action taken afterward. Do not delete encrypted files or rename them.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Organizations should preserve system images, memory captures, relevant authentication, endpoint, firewall, VPN, cloud and backup logs, suspicious files and indicators such as command-and-control addresses. A cloud volume snapshot can preserve a point-in-time copy for forensic review. Collection should be performed by trained responders; do not run an unknown “decryptor,” cleanup utility or script on the original evidence.
Choose the right response for your situation
The immediate isolation rule applies to everyone, but the rest of the process differs substantially by scope and resources.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Situation | Typical scope | Who should lead | Evidence and reporting | Recovery priority |
|---|---|---|---|---|
| Individual or household device | One computer, phone, NAS or a small home network | A trusted IT professional, managed service provider or incident-response specialist if the cause is unclear | Keep the note, timeline and device state; report according to your location and circumstances | Protect irreplaceable personal data while avoiding reinfection of other devices and backups |
| Organization | Multiple endpoints, servers, identities, cloud workloads or network segments | Internal security and IT teams, incident-response counsel and relevant service providers | Preserve images, memory, logs and indicators; follow the incident and communications plan; meet applicable legal and sector duties | Contain the intrusion, protect critical services and restore in a controlled order |
The joint CISA guide is principally organizational guidance. A home user should not attempt enterprise forensic procedures alone, but should still isolate the device, preserve the note and seek help before reinstalling or restoring.
Call for help and report the incident
Organizations
Activate your incident-response and communications plans. Notify internal IT and security, senior decision-makers, cyber-insurance contacts and affected service providers through approved channels. Your legal team should determine whether personal-data, financial, health, education or other regulated information creates notification duties; those duties depend on jurisdiction, sector and the facts of the breach.
In the United States, the FBI says victims should contact their local field office or file a report with the Internet Crime Complaint Center (IC3). The CISA guide also identifies CISA, a local FBI field office and a local U.S. Secret Service field office as reporting options. Preserve the original note and technical indicators for investigators. Reporting does not guarantee recovery, but it can help correlate an active campaign and support assistance or decryption research.
Individuals
Contact your employer’s IT team if a work account or device is involved. Otherwise, use a reputable local computer professional or incident-response firm, especially if the machine contains financial records, tax files, health information or evidence of identity theft. Report to the appropriate national or local cybercrime authority; U.S. residents can use the FBI’s local-field-office or IC3 routes. If you suspect data theft, fraud or threats, contact law enforcement promptly.
Investigate and contain the underlying compromise
Encryption may be only one stage of a broader intrusion. Attackers may have stolen credentials, created new accounts, deployed remote-access tools, copied data or left a pathway to return. Simply deleting the ransom note or reinstalling one computer can leave the rest of the compromise intact.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
What an organizational investigation should establish
- Which systems, accounts, cloud tenants and data stores were accessed or encrypted, and when.
- How the attacker entered: for example, a vulnerable internet-facing service, stolen credentials, remote-access software or a malicious attachment.
- Whether security tools, domain controllers, backup systems or administrative accounts were disabled or altered.
- Which accounts, tokens, keys and service credentials must be disabled, rotated or reissued.
- Whether data was copied before encryption, creating privacy, contractual or regulatory consequences.
Use endpoint, identity, firewall, VPN, email, cloud and backup telemetry to build that timeline. Preserve logs before retention periods erase them. Keep affected devices isolated while responders remove persistence, close the initial access route and verify that administrative access is trustworthy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What a home user should do
Do not connect the isolated computer to “check” another account, install a tool from the ransom note or attempt registry edits based on an online post. From a separate, known-clean device, change passwords for important accounts and enable multifactor authentication, but first ask a professional whether the same credentials were exposed and whether a password manager or email account may also be compromised. If other household devices share the same router, accounts or storage, have them checked before reconnecting the encrypted one.
Should you pay the ransom?
The FBI’s official guidance states: “The FBI does not support paying a ransom in response to a ransomware attack.” CISA, the FBI and the NSA discourage payment because it finances criminal operations, can expose victims to repeat extortion and does not guarantee that files will be recovered. A criminal may provide a defective key, demand more money or publish stolen data even after payment.
Do not infer your legal position from general advice. Sanctions, reporting rules, insurance terms and obligations to customers or employees vary by jurisdiction and by the identity of the recipient. An organization considering any payment should involve legal counsel, law enforcement and its insurer before communicating with an attacker. Individuals should obtain qualified advice rather than negotiating alone or sending cryptocurrency to an unverified address.
Can a decryptor recover the files?
Sometimes a ransomware family has a known weakness or a law-enforcement-supported decryptor. CISA advises consulting federal law enforcement about possible tools, but the existence of a tool for one variant does not establish that it works for your files. Availability depends on the exact family, version, encryption implementation and whether the attacker also damaged or deleted data.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Keep the ransom note, a small sample of encrypted files and the original file extensions for a responder. Do not upload confidential files to an untrusted “free decryptor” site, and do not run a program that modifies originals before a forensic copy is made. A professional can identify the family, check reputable sources and test any candidate tool on copies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Restore only after containment
Restoration is safe only when responders have contained the intrusion and identified a clean recovery point. Reconnecting a compromised server or restoring onto an infected network can immediately encrypt the replacement data.
- Confirm containment. Verify that compromised accounts, remote-access paths, persistence and vulnerable services are closed. Rotate credentials and keys as directed by responders.
- Prepare a clean recovery environment. Use rebuilt systems or a clean network segment with patched operating systems, security controls and restricted administrative access. Do not restore onto machines that have not been examined.
- Identify viable backups. Prefer offline, encrypted or otherwise isolated copies created before the attacker entered. Check backup logs and timestamps; an untouched backup that was reachable with compromised credentials may also be encrypted or tampered with.
- Scan and validate backups. Have responders examine backup media and restored data for malware and unauthorized changes. Preserve a copy of the original encrypted data in case a later decryptor becomes available.
- Prioritize critical services. Restore identity, communications, safety and revenue-critical systems first, followed by lower-priority file shares and workstations. Keep restored services segmented until monitoring shows no renewed malicious activity.
- Test operations. Open representative documents, verify permissions and application dependencies, and confirm that users can work without reconnecting compromised credentials or devices.
- Monitor after reconnection. Watch endpoint, identity, network and backup alerts closely. A return of encryption, new administrator accounts or unusual outbound traffic is a reason to isolate again and call responders.
If no clean backup exists, do not improvise by buying a new drive and treating it as a recovery source. Preserve the encrypted data, ask responders to identify variant-specific options and decide whether files can be recreated from paper records, email attachments, third parties or other clean copies. Recovery may be partial.
Backup choices for future resilience
CISA recommends backing up local device data to an external hard drive and disconnecting that drive whenever it is not actively backing up. That protects the backup from ransomware that can reach a continuously attached drive; it does not decrypt files that are already encrypted.
| Backup approach | Isolation from a compromised account | Restore testing | Immutability and control | Best operational fit |
|---|---|---|---|---|
| Offline physical drive | Strong when unplugged and stored separately; weak while attached | Requires scheduled manual test restores | You control the media; protect it from theft, damage and unauthorized access | Individuals and small teams able to rotate and store drives safely |
| Cloud or cloud-to-cloud backup | Depends on separate credentials, access controls and provider design | Can be automated, but restoration must still be exercised | Some services offer immutable or versioned copies; configuration and compliance requirements vary | Organizations needing frequent, geographically separate copies and managed operations |
Use separate administrator credentials, multifactor authentication, least-privilege backup accounts and retention that attackers cannot shorten. Schedule test restores and document recovery time and recovery point objectives. Immutable storage can help, but CISA cautions that its configuration and compliance implications must be evaluated for the organization; it is not a universal requirement.
Common mistakes that make recovery harder
- Leaving the network connected: ransomware can spread to shares, servers and backups while you investigate.
- Shutting down immediately: volatile evidence may disappear, reducing the chance of identifying the attacker or a decryptor.
- Deleting notes or encrypted files: responders lose indicators and original material needed for analysis.
- Running random tools: an untrusted decryptor or cleaner can destroy evidence, add malware or overwrite recoverable data.
- Restoring too soon: an unresolved compromise can encrypt restored systems again.
- Assuming payment is a guarantee: criminals may not provide a working key and may still release stolen data.
- Treating a newly purchased drive as a backup: a blank drive stores future copies; it cannot reverse encryption that already occurred.
After recovery: close the gap
Document the timeline, affected assets, decisions, costs and technical findings while they are fresh. Update incident-response, communications and backup procedures, train staff on the entry path that was identified, patch exposed services, remove unnecessary remote access and verify that logging and alerting cover identity, endpoint, network and backup systems.
Organizations may share useful indicators with CISA or an appropriate sector information-sharing and analysis center (ISAC), subject to legal, privacy and contractual review. Continue monitoring for delayed extortion, stolen-account use and data publication. A recovery is complete only when normal operations are restored and the access route that enabled the attack is no longer available.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
