Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If ransomware has encrypted your organization’s data, activate your incident response plan, contain affected systems, and coordinate decisions through the people responsible for security, operations, legal matters, privacy, communications, and insurance. Avoid improvised cleanup or a reflexive shutdown: either can make evidence harder to preserve or leave the attacker’s access unaddressed. Work toward recovery in a clean environment using validated backups, while assessing whether data was also stolen.
What should we do first?
Use your organization’s approved incident response and communications plans as the operating framework. Assign an incident coordinator, make decisions through the designated leadership and technical teams, and keep a record of actions and findings. CISA’s #StopRansomware Guide, developed with MS-ISAC, NSA, and FBI, recommends coordinated communications and regular leadership updates.
As an Amazon Associate I earn from qualifying purchases.
- Activate the response plan. Notify the people and providers the plan specifies, including leadership, IT and security, legal, privacy, communications, insurers, and relevant service providers. Use the organization’s established escalation paths.
- Contain the affected environment. Identify impacted devices and isolate them from networks promptly. If multiple systems or subnets appear affected, CISA says taking the network offline at the switch level may be necessary.
- Coordinate safely. When feasible, use out-of-band communications such as phone calls. An intruder may be monitoring internal communications, and a sudden change in activity could prompt them to move laterally or deploy ransomware more widely.
- Establish scope and priorities. Identify affected systems, accounts, services, and data. Use endpoint protection, monitoring tools, and logs to check for signs of earlier or broader compromise. Prioritize services tied to health and safety, revenue, and other critical operations, along with the systems those services depend on.
Containment and continuity decisions may conflict: downtime can harm essential operations, while leaving compromised systems connected can increase the chance of further activity. Weigh spread risk, business and safety impact, evidence preservation, and recovery dependencies together rather than treating one action as right for every system.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchShould we shut down infected computers?
Not as a reflex. Disconnect affected systems from networks where possible, but do not power them off unless they cannot otherwise be disconnected. CISA cautions that shutting down a system can destroy evidence held in volatile memory.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The immediate aim is to stop network access while preserving information that responders may need. Coordinate the choice with the incident lead or qualified responders, especially when a device cannot be isolated without shutting it down.
How can we tell whether data was stolen?
Encryption does not establish whether data was copied. Ransomware incidents may involve both encryption and exfiltration, followed by threats to publish stolen information; data extortion can also happen without encryption. Treat potential access or theft as a separate part of incident scope.
- Assess which sensitive or personal information may have been accessed or taken, using available logs, monitoring, and evidence.
- Have the appropriate legal and privacy teams evaluate the facts against applicable jurisdictional, industry, contractual, and regulatory requirements.
- Keep confirmed facts distinct from claims made by an attacker. Notification decisions should follow the incident plan and legal review.
There is no universal notification deadline established by the general CISA guidance. Whether and when to notify individuals, regulators, customers, or business partners depends on the applicable rules, the information involved, contractual terms, and confirmed circumstances.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How do we preserve evidence and get help?
Preserve relevant information before cleanup or rebuilding changes it. Where feasible, this can include logs, system images, memory captures, malware samples, and indicators of compromise. CISA notes that federal contacts may assist with technical response and evidence-related analysis.
Avoid uncoordinated remediation. Deleting files, reimaging systems, or making broad changes without a response plan can erase useful evidence or leave an attacker’s access active elsewhere. Coordinate technical work with qualified incident responders and document significant actions and findings.
CISA recommends reporting and considering assistance from CISA, the local FBI field office, or the FBI’s Internet Crime Complaint Center (IC3); its guide also lists other federal contacts. Follow existing agreements when coordinating with cyber insurers and managed or security service providers.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Should we pay the ransom?
Do not treat payment as a guarantee that data will be restored, stolen information will remain private, or attacker access will end. CISA advises consulting federal law enforcement about possible decryptors: security researchers sometimes identify flaws and release tools for specific ransomware variants, but that possibility is variant-specific, not a universal recovery method.
Escalate any payment decision through organizational leadership, counsel, the insurer, and appropriate law-enforcement contacts. General guidance cannot settle the legal or operational choice for an individual organization or incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should we restore systems from backups?
Plan recovery around clean systems, validated backups, and the organization’s service priorities. CISA’s guidance is: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.”
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
- Contain and eradicate the compromise. Do not reconnect systems to production merely because a restore is available. Establish that systems entering the recovery environment are clean to reduce reinfection risk.
- Validate backup integrity and availability. Confirm that backups are usable and that the data needed for recovery is intact. Backups accessible to compromised systems may themselves have been deleted or encrypted.
- Restore by operational priority. Bring back essential services in an order that accounts for health and safety, critical business operations, and technical dependencies.
- Test recovery procedures regularly. A backup is useful only if the organization can access and restore it when needed. CISA specifically calls for testing backup availability and integrity in a disaster recovery scenario.
- Review the incident afterward. Document lessons learned and update response, communications, and recovery plans.
Offline backups may use a separate physical storage device, such as an external hard drive, as one component of a broader backup strategy. The appropriate medium and architecture depend on organizational needs. A backup device is a preparedness and recovery measure: it does not decrypt data already encrypted, prove that a backup is uncompromised, or replace incident response.
Which guidance is this response based on?
The primary basis is CISA’s official #StopRansomware Guide, developed with MS-ISAC, NSA, and FBI. CISA’s resource page gives the guide’s revision date as October 19, 2023. That date identifies the guide version noted on the page; it should not be read as a guarantee that every organization’s legal duties or circumstances are covered by general guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
