Encrypting backup data protects its confidentiality, but it does not guarantee that a backup will survive an attack or restore cleanly. If attackers can reach the backup system, if it contains already-damaged files, or if restoration has never been tested, encryption alone will not preserve a usable recovery point. AI can help attackers with tasks such as reconnaissance and phishing; it does not, on the evidence available, break backup encryption by itself.
What AI changes—and what it does not
The UK National Cyber Security Centre’s assessment, The near-term impact of AI on the cyber threat, says threat actors, including ransomware actors, are already using AI to improve the efficiency and effectiveness of some cyber operations, including reconnaissance, phishing and coding. A 2023 CISA, FBI and Australian Cyber Security Centre advisory on LockBit also notes that AI-generated phishing can make malicious messages harder to distinguish from legitimate email.
As an Amazon Associate I earn from qualifying purchases.
These findings support a measured conclusion: AI can assist parts of an attack, including attempts to trick people or find a way into an organization. They do not show that every ransomware group uses AI, that attackers can automatically defeat sound encryption, or that AI defeats a properly isolated and tested backup. The central backup risks remain access, retention, restore-point quality and recovery readiness.
Why an encrypted backup may not be recoverable
It is still reachable by an attacker
Encryption at rest does not make storage inaccessible to someone who has compromised an account or the system that manages the backup. A connected backup share, mounted drive or cloud account may remain within an attacker’s reach; ransomware operators may seek to delete or encrypt accessible copies. CISA’s U.S. #StopRansomware Guide recommends keeping offline backups for this reason.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
It preserves files that were already damaged
A backup can faithfully preserve encrypted or otherwise compromised files. If ransomware is present before it is detected, a scheduled job may copy the damage, while retention rules may eventually remove older clean versions. NIST’s 2020 SP 1800-11 recovery material describes this risk and the need to identify an appropriate restore point rather than assume the newest copy is safe.
The job succeeded, but restoration has not been proved
A “successful” backup job confirms that a process reported success; it does not establish that all critical data and configuration were captured or that the organization can restore them in time. Files may be incomplete or corrupted, or a recovery may depend on unavailable software, hardware, keys or expertise. NIST’s 2020 guide for managed service providers addresses planning, maintaining and testing backup files as part of disaster recovery.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Cloud storage is separated only if its controls make it so
Cloud storage is not automatically isolated from compromised identities or management accounts. CISA advises organizations to understand their cloud provider’s shared-responsibility model, retain versions, monitor logs, and consider controls such as object lock or delete protection and cloud-to-cloud backup. Immutable-storage settings need careful review: misconfiguration can create costs, and a setting may not suit every regulatory requirement. CISA also notes that multi-cloud can reduce dependence on one provider if an account at that provider is affected, but it is not a substitute for a tested recovery plan.
Recommended Free Tools
Restoration can bring the compromise back
A clean copy does not make a compromised network clean. Reconnecting restored systems to an environment that still contains an attacker or malicious software can undo recovery. CISA advises containing compromised systems, restoring by service priority and taking care not to reinfect clean systems.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Restored data cannot reverse data theft
Some ransomware operations also steal data and threaten to publish it. Restoring files can address availability, but it cannot undo exfiltration or remove related privacy, legal or reputational consequences. CISA’s 2023 LockBit advisory discusses data theft and publication threats as extortion tactics.
How to compare backup approaches
No single storage type is a universal winner. Compare the options you can operate against the risks that matter to your organization:
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Approach | Isolation and deletion resistance | Restore-point and recovery considerations |
|---|---|---|
| Offline removable storage | Can be disconnected from routine network access; while connected, it may still be exposed to compromised accounts or systems. | Keep versions rather than relying on one current copy, protect encryption keys separately, and test that files can be restored. CISA identifies a hard drive or other storage device as an example of physically separate storage. |
| Network-connected backup storage | Continuously reachable storage can be exposed if an attacker compromises systems or credentials with access to it. Segmentation and tightly limited privileges reduce exposure but do not make it offline. | Check version history, logs and the ability to identify a clean point before relying on the latest copy. |
| Cloud backup with retention controls | Cloud separation depends on account security and configuration. Object lock or delete protection can resist deletion when correctly configured; cloud accounts and their administrative controls still need protection. | Review retention, recovery-key access, provider dependencies, costs and compliance needs. CISA advises understanding shared responsibility and monitoring cloud activity. |
For a simple planning framework, CISA’s June 2023 LockBit advisory describes the 3-2-1 approach: three copies of data in total (the production copy plus two backups), stored on two media, with one copy off-site. It is a way to think about separation, not a guarantee that the copies are clean or restorable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBuild protections around the backup, not just inside it
- Keep separated copies. Maintain more than one backup and keep at least one copy offline or appropriately isolated from routine network access.
- Protect access and keys. Encrypt backup data, store recovery keys separately, restrict privileged access, use multifactor authentication, segment backup systems and monitor for suspicious access or deletion.
- Preserve versions and evidence. Set retention that can preserve older restore points, and retain logs that help identify when files changed or accounts accessed backup storage.
- Protect against deletion. Consider immutable retention, object lock or delete protection where suitable; validate the configuration, retention period, costs and compliance requirements before relying on it.
- Back up what it takes to rebuild. Include more than user files where needed: preserve system images, configuration, applications and recovery materials for critical services. CISA recommends golden images and offline copies of relevant templates and software.
- Match the design to operational constraints. Account for storage capacity, retention duration, staffing, recovery dependencies, compliance obligations and the consequences of relying on a single cloud provider.
Test whether recovery will work
Use regular restoration exercises to verify availability and integrity, not just that backup jobs complete. CISA’s #StopRansomware Guide calls for testing backup availability and integrity in a disaster-recovery scenario. NIST’s guidance likewise treats testing as part of backup planning and maintenance.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
- Restore representative files and systems from the copies you expect to use, including an offline or isolated copy.
- Check that the recovered data is readable and usable, and confirm that the required keys, software, configuration and hardware are available.
- Record how long restoration takes and compare it with the time your organization can tolerate for each service.
- Practice identifying a clean restore point, especially when an intrusion may have gone undetected for some time.
- Update the recovery plan when systems, accounts, applications or retention settings change.
Recover in a clean, prioritized environment
- Contain the incident. Isolate compromised systems and investigate whether accounts or backup management systems were affected before using their credentials or reconnecting them.
- Establish a clean recovery environment. Rebuild or validate the systems that will receive restored data; do not reconnect suspect machines simply because files are available.
- Select a known-clean restore point. Use version history, logs and file monitoring to avoid restoring a backup that captured the attack’s damage.
- Restore by service priority. Bring back the systems needed for critical operations first, following the organization’s recovery plan.
- Verify before returning to normal operations. Check restored systems and data for integrity and signs of compromise before reconnecting them broadly.
These recovery steps reflect CISA’s advice to use offline encrypted backups, prioritize critical services and avoid reinfecting clean systems during restoration. Encryption supports confidentiality; a usable recovery depends on separation, sound restore points, controlled access and practiced recovery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
