If the drive was unplugged when the ransomware ran, it is very likely fine: these programs encrypt what they can reach while running, and a disconnected drive is not reachable. If it was attached, it may hold encrypted copies. Either way, do not plug it back into the infected computer to find out.
| Symptom | Likely cause | Safe first step | When to call |
|---|---|---|---|
| Drive was unplugged before the ransom note appeared | Out of reach while the ransomware ran | Keep it unplugged; verify on a clean machine | Before reconnecting it to anything |
| Files on the drive have an added extension | The drive was attached during encryption | Identify the variant from the note before deleting anything | Same day — some variants have free decryptors |
| A ransom note sits in folders on the drive | Encrypted; the note names the family | Photograph the note and keep one copy of an encrypted file | Before any wipe or reformat |
| Cloud-synced folder now shows encrypted versions | Sync propagated the encrypted copies | Stop the sync client, then use version history | Quickly — version retention windows expire |
Ransomware encrypts what it can reach at the moment it runs: the internal drive, any attached USB or eSATA drive, mapped network shares, and folders that sync to cloud storage. A drive sitting in a drawer is outside all of that. So the question is not whether ransomware can jump to an unplugged drive — it cannot — but whether the drive was attached, or was attached again afterwards, while the machine was still infected.
On a clean computer, look for the signatures rather than guessing:
This is the single most common way people lose their last copy. The machine still has the infection, you attach the drive to check whether the backup survived, and the encryption resumes on the one set of files that was still clean. If you only read one line here, read that one. Check the drive somewhere else.
Use a computer that was never connected to the infected one, or at minimum a different machine that is fully updated. A USB write blocker is ideal; if you do not have one, mount the drive and browse without opening files. Scan it with current security software before trusting anything on it. Copy what you need off to a third location rather than restoring in place, so you still have the original if a copy turns out to be damaged.
Do not pay first. Payment is not a recovery plan: it funds the operation, and a working decryptor is not guaranteed even after payment. Some families have free decryptors published through the No More Ransom project, so identifying the variant is worth doing before anything else — the ransom note and the added extension usually give it away. Shadow copies, older backup sets, cloud version history and the sync service's own recycle bin are all real recovery paths that cost nothing to check. If the drive is physically failing rather than encrypted, that is a different specialty — our sister lab at kingwooddata.xyz handles the hardware side.
Containment first: isolate, assess, then plan recovery.
Local response for Kingwood homes and small offices.
Local response for Atascocita and Humble.
Our sister lab for physical drive failure rather than encryption.
A battle-tested 5-step methodology that gets your business back online — fast, clean, and fortified.
Isolate infected systems, cut ransomware's lateral movement, and prevent further encryption of your data.
Identify the ransomware variant, remove all malicious code, and document the attack vector for your records.
Recover your files from clean, verified backups — no ransom payment needed. We validate data integrity at every step.
Rebuild affected systems with enhanced security configurations, patched vulnerabilities, and updated defenses.
Comprehensive security assessment, detailed forensic report, and a custom prevention plan to stop future attacks.
Straight answers before you spend a dollar. If your case needs someone else, we say so and help you escalate.
Operating disclosure: Virus Pros is the malware and ransomware specialty service of Atascocita IT Services, the local IT brand serving Kingwood, Atascocita, Humble and the wider Northeast Houston territory. Work is delivered by the same local technicians under that company.
Local experts who know your community. On-site response available throughout the greater Northeast Houston area.
Calls are answered 24/7 and screened, so urgent cases reach a technician fast.