Keep a clean route to recovery
Ransomware may encrypt data and steal it. Recovery needs a trusted source, a controlled environment and a check that the service works.
In 30 seconds
- Do not connect a clean backup drive to a machine suspected of being infected.
- Identify an appropriate restore point and address the compromise before returning recovered systems to service.
- Test data integrity and essential functions; a successful file copy alone is not operational recovery.
Make it concrete
A backup job is green, but nobody has opened the restored files. Write down the evidence needed before calling the recovery successful.
- 01Trusted copy
- 02Controlled restore
- 03Functional check
Check your understanding
Is a successful backup log alone proof that operations can be restored?
- Do not connect a clean backup drive to a machine suspected of being infected.
- Identify an appropriate restore point and address the compromise before returning recovered systems to service.
- Test data integrity and essential functions; a successful file copy alone is not operational recovery.
Go to the source
- Course notes · ThS. Nguyễn Duy Hiếu · An ninh mạng trên tàu biển cho thuyền viên ↗
- CISA · StopRansomware guide ↗
Sources reviewed: 13.09.2026