Ransomware attacks can be devastating, locking you out of your files and demanding payment to regain access. As frustrating as it is, the first rule is: do not pay the ransom. Paying only encourages more attacks and doesn’t guarantee you’ll get your files back. Instead, focus your efforts on trying to recover access to your files through other means. There is hope if you act quickly and methodically.
Backup Your Files
The best protection against ransomware is having regular backups of your important files. Backups allow you to restore your data from a point before the infection happened.
-
Back up files routinely to an external drive that is disconnected from your network after the backup is complete.
-
Use cloud storage services like Dropbox or Google Drive to back up important files.
-
Test your backups regularly to make sure the files are being stored properly and you can restore if needed.
If you are hit with ransomware but have backups, you can simply erase your system and restore your files from the backup.
Isolate Your Infected System
As soon as you detect a ransomware infection:
-
Disconnect your computer from any network, including the Internet and local networks. This prevents the ransomware from spreading.
-
If you have backups, disconnect any external drives or devices that house your backups. You don’t want the ransomware encrypting those too.
Isolating your system right away gives you a chance to recover files before more are impacted.
Try Ransomware Decryptors
Security researchers often create free decryption tools that can unlock files affected by specific ransomware strains.
-
Go to websites like No More Ransom to see if a decryptor exists for the ransomware you are facing.
-
If an applicable tool exists, follow the instructions carefully to attempt decrypting your files using it.
Decryptors don’t exist for every form of ransomware, but are worth looking into. Using one essentially allows you to unlock your files for free.
Restore from Backups
If you have backed up your files, now is the time to restore your system.
-
Wipe your infected system completely and reinstall the operating system and software.
-
Once the system is clean, connect your backups and restore your files from the most recent backup that occurred before the infection.
-
Verify that your files have been restored properly and nothing seems corrupted or compromised.
With backups, you can completely reset your system and eliminate the ransomware rather than paying the criminals behind it.
Use Previous File Versions
Some operating systems like Windows have built-in file versioning that tracks changes over time.
-
Navigate to your user folder and right-click on a file or folder. Select “Restore previous versions” to view backups made by the system.
-
Attempt to restore files and folders to a state before the ransomware infected your system.
This isn’t foolproof, but can help salvage files if you don’t have your own backups.
Summary
-
Make and test backups regularly in case you are hit with ransomware.
-
Isolate infected systems immediately and stop the ransomware from spreading.
-
Check sites like No More Ransom to see if a free decryptor is available.
-
Restore your files from clean backups.
-
On Windows, utilize the Previous Versions feature to restore files to an earlier state.
While ransomware can seem devastating in the moment, there are ways you can potentially recover your files without paying the ransom. Keep calm, act quickly, and remain persistent. You can overcome the ransomware and regain access to your precious data.
