Ransomware and Backups: The Home-User Version of Disaster Recovery

TLDR: Keep important files in an automatic cloud system with usable version history, and make a second backup to an external drive that you disconnect when the backup finishes. Protect the cloud account, check how long deleted and changed files remain recoverable, and test a restore before an emergency. If ransomware strikes, isolate and clean the affected device before reconnecting backup media or restoring files.

The practical answer to ransomware backup home users can maintain is not an elaborate server or expensive disaster-recovery service. It is a small system with multiple copies that do not all share the same point of failure. Your working files are one copy, a cloud copy with recoverable versions is another, and a disconnected external drive provides a separate recovery path.

That separation matters because ransomware can encrypt files on a computer and any storage the computer can reach. A permanently connected backup drive may therefore be exposed at the same time as the original files. CISA and the FTC recommend regular backups and disconnecting external backup media after use. CISA’s broader StopRansomware guidance also emphasizes backups that are isolated from the systems being protected and tested so they can actually be restored.

The best ransomware backup setup for most homes

A sensible baseline has three parts: automatic cloud protection, a local external-drive backup, and a routine for checking both. This resembles the familiar 3-2-1 principle—multiple copies, more than one storage type, and at least one copy kept away from the primary device—but adapts it to tools a household can realistically maintain.

Choose the files that would be painful or impossible to replace, including family photos, personal documents, current projects, financial records, and scans of important paperwork.
Put those folders in a reputable cloud service that offers version history or whole-account rollback appropriate to your needs. Confirm the recovery window instead of assuming every old version is retained indefinitely.
Back up the computer to an external drive on a schedule. Disconnect and store the drive after the backup completes.
Protect the cloud account with a unique password and multifactor authentication or a passkey where supported.
Once every few months, restore a small sample of files from both the cloud and the external drive. Open the restored copies to verify that they are usable.

This design covers more than ransomware. The cloud copy can help when a laptop is lost or a single file is deleted. The local backup can help when an account is locked, cloud synchronization propagates an unwanted change, or an internet connection is too slow for a large restore. Neither layer is perfect, but they fail in different ways.

Sync, version history, and backup are different tools

The word “backup” is often applied to several features that behave differently. Understanding the difference prevents a dangerous assumption: seeing files in a cloud folder does not automatically mean every previous version can be recovered.

Tool	What it does	Main limitation
Cloud sync	Keeps selected files consistent across devices and the cloud	Deletions, encryption, or unwanted edits may synchronize too
Version history	Retains earlier versions of changed files for a defined period	Retention and eligibility vary by service and plan
Local backup	Copies files or a system to local storage	A connected backup may be reachable by ransomware
Disconnected backup	Keeps a backup unavailable to the computer between sessions	It is only current if backups are performed regularly

Synchronization is useful because it creates an off-device copy quickly. It can also reproduce trouble quickly. If ransomware replaces readable documents with encrypted versions, the synchronization client may upload those changed files. Version history or a rollback feature can provide a route back, but only if the incident falls within the service’s retention window and the account remains accessible.

A true backup is intended for restoration rather than merely keeping devices synchronized. It may preserve folders, older file states, application data, or an entire system. A disconnected backup adds another property: ransomware running on the computer cannot modify storage that is not connected or otherwise reachable.

How to build a manageable home backup routine

Start with irreplaceable data

Do not let a perfect whole-house plan delay protection for the files that matter most. Begin with photos, videos, tax records, identification scans, creative work, school projects, and documents needed to run the household. Software installers, streamed media, and replaceable downloads usually deserve lower priority.

Check where those files actually live. Some cloud applications leave full files on the computer, while others keep online-only placeholders. A local backup cannot copy content that has not been downloaded, so confirm that critical folders are available offline before relying on an external-drive backup of them.

Choose a backup frequency based on acceptable loss

There is no universal schedule. Ask how much recent work you could tolerate losing. Someone editing family photos every weekend might connect the backup drive after each session. A household that creates few files might use a weekly schedule. Tax preparation, a major writing project, or a large photo import justifies an immediate backup rather than waiting for the usual day.

Automatic backup software reduces forgotten sessions, but disconnection still requires attention unless the storage system provides genuine isolation. A practical habit is to connect the drive at a predictable time, let the job complete, confirm its status, eject it properly, and put it away.

Secure the account that controls the cloud copy

Cloud recovery is less useful if an attacker can take over the account, delete stored files, or interfere with recovery settings. Use a password that is not reused elsewhere, enable a strong second factor, save recovery codes somewhere safe, and review unfamiliar account sessions. Where available, passkeys can reduce reliance on typed passwords; our guide to how passkey sign-in works across devices explains the practical experience and recovery considerations.

Account recovery deserves the same attention as file recovery. Make sure the recovery email and phone number are current. If encryption is enabled for an external backup, preserve its recovery password separately. Encryption protects a lost or stolen drive, but a forgotten password can also lock its owner out.

Platform recovery features are useful, but conditional

Major platforms provide recovery tools that can help after widespread file changes, but their terms are not interchangeable. Treat the following as examples rather than permanent guarantees, and verify the current documentation for your account and plan.

Microsoft OneDrive

Microsoft states that whole-OneDrive restoration is available to Microsoft 365 subscribers and can reverse file and folder actions from the preceding 30 days. Individual files may also have earlier versions available. The important constraints are subscription eligibility, the recovery period, and continued access to the account.

Google Drive

Google documents a bulk restoration feature intended to help restore files encrypted by ransomware. Its documentation describes a 25-day revision window. That window makes prompt detection important: a problem discovered long after the changes occurred may fall outside the available history.

Apple Time Machine

Apple says Time Machine can automatically back up a Mac to external storage and restore individual files or an entire Mac. Apple recommends a backup disk with at least twice the Mac’s storage capacity. For ransomware resilience, the critical operational detail is still whether the backup destination remains accessible to the Mac. A removable drive should be disconnected between backup sessions rather than treated as permanently attached storage.

Test restores, not just backup status messages

A successful status icon confirms that software completed a task; it does not prove that the files you care about can be recovered. NIST guidance stresses maintaining and testing backup files and restoration procedures. A home test can be simple and should not overwrite the original data.

Create a temporary folder for the test restore.
Choose several file types, such as a photo, PDF, spreadsheet, and document.
Restore an older version from the cloud into the temporary folder.
Restore different files from the external backup.
Open each restored file and check that its contents are intact.
Record the test date, which source was used, and any missing folders or confusing steps.
Delete the temporary copies only after the test is complete.

Repeat the test after changing backup software, replacing a computer, moving important folders, or changing cloud plans. Also inspect available storage. A full backup disk or exhausted cloud quota can stop new data from being protected even when older copies remain present.

What to do when ransomware is suspected

Do not begin by connecting the backup drive. The immediate goal is to stop additional damage and avoid contaminating recovery copies.

Disconnect the affected computer from Wi-Fi, Ethernet, shared drives, and other reachable storage.
Pause or stop synchronization if you can do so without reconnecting the affected system. Use a separate, trusted device to review the cloud account and contact support when necessary.
Leave external backup drives disconnected. Do not use them to investigate the infection.
From a clean device, change passwords for important accounts if account compromise is possible. Start with email because it often controls password resets elsewhere.
Clean, reset, or reinstall the affected computer using trusted guidance. If uncertain, seek qualified technical help rather than experimenting on the only copy of important data.
Identify a known-safe recovery point from before the suspicious changes began.
Restore a small sample first. Confirm that the files open normally before performing a larger restore.

Microsoft specifically advises cleaning connected devices before restoring OneDrive content after ransomware, which reduces the risk that restored files will simply be encrypted again. The same principle applies regardless of platform: establish a clean destination before bringing good data back.

Preserve information about the incident if it may be needed for a report or professional investigation. A full reset may be appropriate for recovery, but it can also remove logs and other evidence. When the consequences are serious, pause and get expert help before wiping the system.

What backups cannot fix

A backup can reverse data loss caused by encryption, deletion, device failure, or some unwanted changes. It cannot make every consequence of a ransomware incident disappear. Modern attacks may involve stolen files as well as encrypted ones. Restoring a clean copy does not retract data that an attacker already obtained.

Backups also do not secure compromised email accounts, replace exposed passwords, remove malicious software, or determine how the attacker entered. Recovery therefore has two tracks: restore trustworthy data and address the underlying security incident. Update vulnerable software, reset affected credentials, review account activity, and determine whether personal or financial information needs additional monitoring.

Common home-backup questions

Can ransomware encrypt an external hard drive?

Yes, if the drive is connected and accessible to the infected computer. That is why an external backup should be disconnected after the backup finishes. A second drive rotated to another safe location can add protection against theft, fire, and failure of the first drive.

Is cloud storage enough by itself?

It is better than keeping the only copy on one device, but it should not be the sole recovery method for important data. Synchronization can propagate damaging changes, retention windows can expire, and account access can fail. Pair cloud protection with a disconnected local backup.

How long should old versions be retained?

Long enough to notice a problem and respond. The right period depends on how often you review the files. If a computer or archive is opened only occasionally, a short history may expire before anyone discovers the damage. Check retention for changed files, deleted files, and whole-account rollback separately because services may handle them differently.

How often should a restore be tested?

Every few months is a reasonable starting habit for a typical household, with additional tests after major changes. Increase the frequency when the data changes rapidly or is unusually valuable. The purpose is to discover missing folders, expired history, inaccessible credentials, and failed backup jobs while the original files are still available.

A small recovery system is better than a perfect plan postponed

Start today with the files you cannot replace. Put them in a protected cloud account with verified version recovery, copy them to an external drive, disconnect that drive, and restore one test file from each location. That short exercise turns a vague promise of protection into a recovery process you know how to use.

The strongest home setup is not the product with the boldest ransomware claim. It is the one that preserves separate copies, keeps at least one copy beyond the infected computer’s reach, retains history long enough to be useful, and has already passed a restore test.