Protect your backups from ransomware: a practical home checklist

A backup is most valuable when it remains available after something goes wrong. Ransomware can target reachable backup files as well as everyday documents, so a copy that stays permanently connected deserves a closer look. This guide focuses on preparation before an incident.

1. Decide what you cannot afford to lose

List the files that matter: family photos, financial records, work documents, and anything difficult to recreate. Check where they actually live. A backup of your Documents folder will not help with important files stored somewhere else.

Choose how much recent work you could reasonably recreate. That helps determine a backup schedule. Someone editing important documents daily needs a different routine from someone adding photos once a month. Our backup basics guide is a useful starting point.

2. Keep a copy outside the computer’s normal reach

If you use an external drive, disconnect it safely after the backup completes instead of leaving it attached all the time. CISA’s device-data protection guidance warns that ransomware can reach a connected drive and damage its backups.

For cloud services, check the documented recovery features: retained versions, deleted-file recovery, and how long older copies remain available. Do not assume that a synced folder provides an independent recovery history. Verify what your particular plan can restore before relying on it.

3. Test recovery, not just the backup status

Restore a few representative files into a separate test folder and open them. Include a recent file and an older one. Confirm the contents are usable without replacing your working originals. A “completed” backup message is useful, but a successful restore answers a different question.

CISA’s StopRansomware guide recommends offline, encrypted backups and regular recovery testing. If your backup is encrypted, keep its recovery key somewhere secure that you can access even if the original PC is unavailable.

4. Make the routine easy to repeat

Record the last successful backup and restore test, the folders included, and where to find recovery instructions. Keep passwords and encryption keys out of a casually shared checklist. If you are choosing storage, see our backup drive checklist.

If an incident is already happening

Do not attach your clean backup drive to a computer you suspect is infected. Isolate the affected device from the network and seek help before restoring. Recovery needs a clean environment so restored files are not immediately affected again. For a work device, contact your IT team promptly.

Backups improve recovery; they do not prevent every attack or undo stolen information. Keep software updated and maintain good account protection alongside the backup routine.