What ransomware does to your options
Ransomware is malicious software that locks or encrypts your files, then demands payment to restore access. The attacker’s leverage rests on one thing: you have no other way to get the files back. A good backup removes that leverage. If you can restore your data from a clean copy, the demand loses most of its power.
This article is about the recovery side. How these programs arrive, and how to avoid infection, are covered in the guide to ransomware attacks, and the risky email attachments article explains one common entry point.
Why paying is a poor plan
Authorities and security organizations generally advise against paying, and the reasons are practical rather than moral:
- There is no guarantee the criminals will provide a working key, or that all files will come back intact.
- Payment can mark you as someone willing to pay, and may invite further demands.
- Paying funds the activity that harms other people.
- In some places, certain payments may carry legal complications. If you are affected, talk to your local police or a relevant national reporting channel about the situation.
None of this makes the situation easy for someone who has lost irreplaceable material and has no copy. That is exactly why preparing beforehand matters more than any decision made in the moment.
Why many backups fail against ransomware
A backup that is always connected is not always safe. Ransomware often searches for files it can reach, including:
- Drives plugged into the computer
- Shared folders on the home or office network
- Folders synced with online storage
If your backup is one of those, the damaged files may be copied over the good ones, or the backup itself may be encrypted. A sync service that mirrors changes can quietly replicate the locked versions everywhere.
This is where design matters. Two qualities protect you.
Offline or disconnected copies
A copy that is not attached to your computer cannot be reached by software running on it. Many people use an external drive that they connect only during the backup, then unplug and store. A rotation of two drives, with one kept somewhere else, adds safety. The cost is some effort, so build it into a routine and pair it with a reminder.
Versioned copies
Versioning means the backup keeps earlier states of your files, not just the newest. If today’s files are encrypted by malware, you can go back to a version from before the infection. Many backup tools and some online services offer this, typically with a limit on how long old versions are kept. Look for terms such as “file history,” “version history,” “snapshots” or “retention” and find out how far back yours reaches. A short retention window may not help if the infection goes unnoticed for weeks.
Some storage services also offer a feature that makes recent copies harder to change or delete for a set time. If you rely on one, read how it works so you know its limits.
Where the 3-2-1 idea fits
The 3-2-1 backup rule suggests several copies on different media, with one kept elsewhere. For ransomware, the useful twist is making sure at least one copy is out of reach of your daily computer, either offline or versioned in a way that cannot be rewritten by an infected device.
If your files are locked
If you see a ransom message or find files you cannot open, move carefully. The general sequence is:
- Disconnect the device from the internet and from the home network, and unplug any attached drives, so the problem does not spread.
- Do not connect your backup drive to the infected machine. This is the most important rule, because connecting it can expose your clean copy.
- Take notes or photos of the message and any file names, which can help when you report it.
- Contact your local police or national cybercrime reporting channel and, if it is a work device, your employer or IT support. For help with a stubborn infection, a qualified professional is a reasonable choice.
- Change passwords from a different, clean device, starting with email and financial accounts, since the infected device may have exposed them. Our notes on a hacked account response walk through that process.
- Rebuild the device, typically by wiping it and reinstalling the operating system, rather than trusting it after cleanup. Professional help may be useful here.
- Restore files from a clean backup once you are confident the machine is clean, then check that the files open.
Free decryption tools exist for some older ransomware families, but there is no guarantee one exists for the strain you face. If you try one, get it from a reputable, well-known source and be aware that scam sites also claim to offer such help.
Prepare before anything happens
- Keep at least one backup disconnected, and one stored away from your home or office.
- Use a service or tool with version history, and learn how far back it goes.
- Test your restore process. The idea of backup restore testing matters here because the worst time to find a problem is during an incident.
- Keep your system and apps updated, so known weaknesses are closed.
- Be careful with software sources; safe software downloads cut off a common route in.
Setting realistic expectations
Backups do not stop an infection and do not protect against everything. Some attacks also threaten to publish stolen data, which a backup cannot undo. Still, a clean, tested copy turns a potential disaster into an inconvenient restore, and gives you the freedom to refuse the demand.