What to Do When Malware Encrypts an External Hard Drive

When ransomware or another file-encrypting threat reaches an external hard drive, files may suddenly become unreadable, renamed with unfamiliar extensions, or replaced by ransom notes. The damage can affect documents, photos, backups, databases, and media stored outside the computer itself.

The safest response is controlled and methodical. Disconnecting the drive, preserving evidence, removing the infection, and choosing the right recovery method can prevent additional encryption and reduce the risk of permanently destroying recoverable data.

Do not pay immediately, delete encrypted files, or format the drive. Payment does not guarantee a working decryption key, and some criminals continue demanding money after receiving it.

Disconnect the Drive Without Altering It

Unplug the external hard drive as soon as suspicious encryption activity is noticed. On Windows, use the system’s safe removal option if the drive is still responsive; if ransomware is actively changing files, disconnecting the USB cable or power may be more important than a graceful eject. On a Mac, eject the volume if possible, then disconnect it.

Do not open encrypted files repeatedly, run cleanup utilities against the drive, or move files between folders. Avoid connecting the device to other computers “just to check” whether the files work. A worm or ransomware payload could spread to another system, especially if the drive contains executable files or shared installers. Review additional guidance in the worms and self-spreading malware category if multiple computers show unusual behavior.

Label the affected drive and keep it disconnected. If the data is important, create a sector-by-sector image using a suitable forensic or recovery tool rather than experimenting with the original device.

Identify the Encryption and Infection

Record the new file extension, ransom-note name, displayed contact address, and approximate time the changes began. Photograph or copy the ransom note without opening suspicious links or attachments. These details may help match the incident to a known ransomware family and determine whether a free decryptor exists.

Look for signs on the computer that hosted the drive, including disabled security software, unfamiliar startup entries, unusual processor activity, or a second ransom note. A credential-stealing infection may have been involved before the encryption began; learn how to respond to a banking trojan if passwords or financial accounts may have been exposed.

Never upload confidential files to random “decryptor” websites. Use reputable sources such as established cybersecurity vendors, law enforcement projects, or recognized ransomware research initiatives. A tool that claims to decrypt every variant is often a scam or may contain additional malware.

Clean the Host Computer First

The external drive should remain offline until the computer is considered safe. Scan the internal system with a trusted, updated security product, preferably from a clean boot environment or Safe Mode when normal Windows operation is compromised. Remove detected malware and suspicious persistence mechanisms before reconnecting any storage.

If security tools cannot update or security websites will not open, the infection may be blocking protective resources. Follow a controlled troubleshooting process for blocked security websites, using a clean device to download legitimate tools when necessary.

Changing passwords from the infected computer is risky. After cleaning, use a separate trusted device to reset important passwords, enable multifactor authentication, and review email, cloud storage, banking, and remote-access accounts for unauthorized activity.

Compare Available Recovery Paths

The correct recovery method depends on the ransomware family, the condition of the disk, and whether clean copies exist elsewhere. Encrypted files should usually be preserved because future decryptors or professional analysis may become available. Recovery software cannot decrypt strong encryption; it may only restore deleted originals when the ransomware created replacement copies.

Recovery option	Best use	Main risk or limitation
Offline backup	A verified copy exists from before the attack	The backup may also be encrypted or outdated
Official decryptor	The ransomware has a known weakness or released key	Many variants have no working public decryptor
File recovery software	Original files were deleted after encrypted copies were created	Continued disk use can overwrite recoverable data
Professional recovery lab	Data is highly valuable or the disk is failing	Services can be expensive and cannot guarantee decryption
Cloud or version history	Files were synchronized before encryption	Sync software may have propagated damaged versions

Before restoring anything, verify that the malware is gone and that the backup is clean. Restore a small sample first, open the files, and confirm that filenames, permissions, and folder structures are intact.

Follow Safe Recovery Priorities

Use this order when handling encrypted external storage:

• Preserve the original drive and avoid writing new data to it.
• Identify the ransomware using file extensions, notes, and trusted research tools.
• Search offline, cloud, and versioned backups created before the incident.
• Test only reputable decryptors that match the identified malware family.
• Document affected files, devices, dates, and actions for security professionals.

If a decryptor is available, make a duplicate of the encrypted data before using it. Test the tool on a small sample and confirm that the utility comes from a verifiable source. Keep in mind that a decryptor may fail when the ransomware used a different variant, damaged file headers, or encrypted only selected file types.

Know When to Use Professional Recovery

Professional assistance is appropriate when the data has high financial, legal, medical, or personal value; the drive is making unusual noises; the filesystem is disappearing; or previous recovery attempts have changed its contents. Stop using a failing disk immediately, because repeated power cycles can worsen mechanical damage.

Choose a reputable incident-response or data-recovery provider that explains its process, costs, privacy controls, and success conditions in writing. Be cautious of anyone demanding payment for a guaranteed ransomware decryption result or asking for unrestricted access to unrelated accounts.

After recovery, rebuild the storage strategy. Keep at least one backup disconnected from the computer, use another copy in a separate location or cloud service, enable version history where available, and test restoration periodically. Limit write access to shared drives and keep operating systems, browsers, and security software patched.

Act quickly, but avoid rushed decisions that overwrite evidence or expose more devices. Disconnect the affected drive, secure the host computer, preserve encrypted data, and seek trustworthy analysis or recovery support before attempting major repairs.