Ransomware Incident Response Checklist & Recovery Template for Home and Small Business

Overview

Ransomware commonly prevents access to files by encrypting them or by locking the device. A ransom note may identify the strain, but the note is not proof that recovery is possible, and changing the extension of a file will not decrypt it. Treat the incident as both a malware event and a potential data-loss or account-security event.

Your priorities are, in order:

1. Contain the incident: prevent the affected device from communicating with other devices, servers, and storage locations.
2. Protect evidence: preserve ransom notes, suspicious messages, timestamps, and relevant logs before deleting anything.
3. Assess the scope: identify affected endpoints, accounts, shared folders, cloud services, and backups.
4. Recover safely: remove the threat or rebuild affected systems before restoring clean data.
5. Strengthen controls: determine how access was gained and close the same path before reconnecting systems.

If a business system, customer record, regulated data set, or shared server is involved, involve the person responsible for IT and security as early as possible. Legal, contractual, insurance, or notification requirements may apply, and those decisions should not be improvised during recovery.

Checklist by scenario

Scenario 1: One home PC or Mac is showing a ransom note

1. Disconnect it immediately. Unplug the network cable and disable Wi-Fi and Bluetooth. Disconnect external drives, USB storage, and backup disks. Do not connect the computer to another network to test it.
2. Leave other devices alone but isolate shared storage. If the computer uses a home NAS, shared folder, or cloud-sync application, pause synchronization from a clean device if possible. Do not browse the affected files from another computer.
3. Photograph or record the screen. Capture the ransom note, file extension, contact instructions, desktop changes, and visible timestamps. Keep the original note and any related files.
4. Do not delete encrypted files. They may be needed for identification or future decryption attempts. Make a separate copy of a small sample only if it can be done safely and without reconnecting the affected device.
5. Use a trusted clean device to change important passwords. Prioritize email, banking, cloud storage, password managers, and accounts that were logged in on the affected computer. Enable multifactor authentication where available.
6. Arrange a professional assessment if the data matters. A reputable incident responder or qualified technician can help preserve evidence, identify the strain, and decide whether the computer should be cleaned or rebuilt.

Scenario 2: A small-business workstation or server is affected

1. Activate the incident lead. Assign one person to coordinate decisions, one to maintain notes, and one to handle technical containment when staffing permits.
2. Isolate affected systems at the network level. Disable network ports, remove VPN access, disconnect mapped drives, and quarantine suspected endpoints. Avoid shutting down systems blindly if memory or live forensic evidence may be important; obtain qualified advice first.
3. Protect backup systems. Disconnect backup destinations that are not required for operation, disable unnecessary synchronization, and restrict administrative access. Confirm that backup credentials were not exposed.
4. Preserve a timeline. Record when the first warning appeared, which systems were affected, who noticed it, recent software installations, remote logins, phishing messages, and actions taken after discovery.
5. Notify the right parties. Use the business incident plan to contact management, IT, insurers, legal counsel, service providers, and affected customers or partners where appropriate. Keep messages factual and avoid guessing about the cause or scope.
6. Do not restore production systems yet. First identify the entry point, contain active access, verify backups, and decide whether systems should be rebuilt from trusted installation media.

Scenario 3: Files are encrypted but no ransom note is visible

Do not assume the incident is harmless. Look for unusual file extensions, inaccessible documents, disabled security tools, unknown administrator accounts, and recent changes to shared folders. Disconnect the affected systems and preserve samples. An antivirus scan can help identify related malware, but a clean scan after encryption does not prove that the system is safe. For background on quarantine results and false positives, see our antivirus scan results guide.

Scenario 4: Backups or cloud files may also be affected

Pause sync and verify the recovery history from a clean, separately secured device. Check whether older versions or snapshots exist and whether they predate the incident. Do not overwrite the only usable copy by restoring directly into the compromised environment. Prepare a clean destination and test a small selection of restored files before a full recovery.

What to double-check

• Scope: Check laptops, desktops, servers, NAS devices, virtual machines, removable drives, and cloud accounts—not only the computer that displayed the note.
• Accounts: Review administrator accounts, recent sign-ins, forwarding rules, remote-access tools, and API or application credentials. Revoke sessions and rotate secrets from a clean device.
• Backups: Confirm the backup date, retention point, restore permissions, and whether the backup is isolated from normal user credentials. A backup is not verified until a test restore opens successfully.
• Recovery tools: Search trusted security-vendor or law-enforcement resources for a decryptor only after identifying the ransomware family. Use tools from their original publisher, verify instructions, and keep an untouched copy of affected data. A decryptor may not exist, may not support the exact variant, or may damage files if used incorrectly.
• Evidence: Preserve ransom notes, suspicious email headers, file samples, endpoint alerts, firewall logs, and a written timeline. Label copies clearly and record who handled them.
• Reconnection: Before returning a rebuilt device to the network, install current security updates, change credentials, remove unauthorized remote access, enable endpoint protection, and verify that monitoring is active.

For prevention and recovery planning, compare these steps with our ransomware protection checklist. If the incident also involved account takeover or other malware, use the broader malware incident recovery checklist.

Common mistakes

• Paying before understanding the scope: Payment does not guarantee decryption, deletion of stolen data, or restored access. It can also complicate legal, insurance, and internal decisions. Seek appropriate professional advice first.
• Reconnecting to check whether the threat is gone: A short test can allow malware or an intruder to reach shared folders again.
• Running cleanup tools before preserving evidence: Removing files may erase useful indicators and make the cause harder to determine.
• Restoring everything at once: Start with a clean, isolated recovery environment and test representative files. Keep the original encrypted data unchanged.
• Trusting a ransom-note contact or online helper: Treat unexpected decryption offers, support chats, and payment instructions as untrusted. Verify tools through an independent, official source.
• Stopping after the files return: Recovery is incomplete if the original access route, stolen credentials, or vulnerable service remains open.

A security product can assist with detection and cleanup, but no antivirus scan replaces containment, backup verification, and account review. Our safe antivirus verification checklist can help after systems have been rebuilt and updated.

When to revisit

Review this checklist before travel, seasonal business planning, major software changes, or any period when backups and staffing will be harder to reach. Small businesses should review contact names, escalation numbers, recovery priorities, and clean administrator accounts at least quarterly or whenever responsibilities change.

Test backups on a planned schedule rather than waiting for an incident. Record which files were restored, how long recovery took, which credentials were required, and whether the restored system could operate without reconnecting to compromised infrastructure. Recheck security software, operating-system support, cloud-sync settings, and recovery tools when platforms or workflows change. Decryptor availability and ransomware indicators can change, so verify that any tool or identification guidance is still current before using it.

Print-ready action list: isolate affected devices; disconnect shared and backup storage; photograph the note; preserve samples and logs; change priority passwords from a clean device; identify affected systems and accounts; verify backups; obtain qualified help when business or sensitive data is involved; rebuild or clean systems; restore a small test set; monitor after reconnection; and document the lessons learned. Keep the completed notes with your recovery plan so the next response starts with evidence rather than guesswork.