How do I make sure ransomware cannot destroy my backups?

Home ransomware is much rarer than the coverage suggests, but it is the failure that turns a good-looking backup into nothing, so it is worth designing for. The design rule is simple: something in your setup must be beyond the reach of the machine being attacked.

Safety

Step by step

1. Work out what the infected machine can write to.Open your file browser and list every location that appears with a drive letter or in the sidebar: internal drives, external drives, network shares, and every synced cloud folder. Everything on that list is in scope. This is usually a longer list than people expect.
2. Accept that sync does not save you by itself.Encrypted files are still files. Sync uploads them and overwrites the good copies on the service. What saves you on a cloud service is version history and a bulk restore-to-a-date feature — not the sync itself.
3. Check whether your cloud service has a mass-restore.The major consumer services offer some form of "restore my files to a point in time", designed for exactly this. Find out whether yours does, how far back it goes, and whether it is on your plan, before you need it. If it does not, that leg of your backup is weak.
4. Keep the local backup drive disconnected.Plug it in, run the backup, verify it finished, unplug it. A weekly or monthly rhythm is enough for most households. The disconnected period is the protection, and an always-on drive gives it up entirely.
5. Use two drives on rotation if the data matters.Two identical drives, alternating, with one always away from the house. If an infection is discovered mid-backup, the other drive is untouched and is at most one cycle out of date.
6. Prefer a backup service with immutable retention.Several consumer and small-business backup services keep deleted and changed file versions for a fixed retention period that the client software cannot override, precisely so a compromised machine cannot instruct the server to purge history. That property, not the brand, is what you are buying.
7. Recognise the infection early and pull the plug.Files being renamed with an unfamiliar extension, a sudden burst of disk activity, documents that will not open, a note appearing in folders. Disconnect the machine from the network and power it off. Every extra minute encrypts more, including anything currently connected.
8. Recover by rebuilding, not by cleaning.Wipe and reinstall the operating system on the affected machine, then restore data from a copy you are confident predates the infection. Copying files back onto a machine you have merely scanned risks reinfection and is not worth the time saved.

Tips

• A network drive left permanently mapped with write access is one of the most commonly lost backups in a household. Connect it when you need it.
• Backups made by imaging software to a drive that is only mounted by that software during the run are meaningfully safer than a drive sitting in the file browser all day.
• Photographs and documents that predate the infection by years are the ones people grieve. Those belong on an archive copy you write once and rarely touch, not on the rolling backup.
• Do not pay before speaking to Action Fraud and, if you have one, your insurer. Payment is a transaction with criminals and a decrypting key is not guaranteed.

Common mistakes

• Treating antivirus as the plan — It is a filter, not a guarantee, and it is the newest variants that get through. The backup is what determines whether an infection is a bad weekend or a permanent loss.
• Backing up onto a drive that lives plugged into the machine — It is in scope for the encryption and for a mistaken delete-all. Convenience and protection are directly opposed here.
• Restoring from a backup without checking its date — Ransomware often sits quietly for days. A backup made after the infection may contain encrypted files or the payload itself.

Alternatives

• Rotating external drives: Two drives, alternating, one offsite. Cheapest reliable answer for a household, and the offline period is genuine protection. Requires you to remember the rotation.
• Backup service with fixed retention: Continuous, offsite, and versioned by a server the client cannot instruct to purge. Ongoing cost, and a full restore over a domestic connection takes days.
• NAS with its own snapshots: A network device that keeps read-only snapshots on its own schedule, so an encrypted file on the share does not destroy yesterday's version. Only helps if snapshots are enabled and the device's admin account is not reachable from the infected machine.
• Write-once optical or archival media: For a fixed set of irreplaceable material — photographs, documents, records — a copy that physically cannot be rewritten is immune. Slow, limited in capacity, and needs a plan to re-copy every few years.

Questions people ask