How to protect family photos and files from ransomware

Think about what you would be most upset to lose if something happened to your computer. For me, it would be the photos and videos you cannot replace. But your computer may also hold years of tax returns, medical records, scanned IDs, insurance paperwork, legal documents and other files you would hate to suddenly lose access to.

That is exactly what makes ransomware so damaging. It can lock or encrypt files so you can no longer open them, then the attacker demands money to give you access again. Even if you pay, there is no guarantee you will get everything back. By the time a ransom message appears on your screen, a lot of the damage may already be done.

The smarter move is to prepare before that ever happens. Here are the steps I would take to protect the files you care about most and make recovery a lot easier if ransomware ever hits.

Missed CyberGuy LIVE? Watch the replay and discover 5 ways AI can help you get better healthcare.

Our free CyberGuy LIVE class Get Better Healthcare With AI has ended, but you can still watch the full replay. Kurt "CyberGuy" Knutsson walks you through five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.

Watch the free replay + downloadable checklist now at CyberGuyLive.com

153 MILLION DRIVER'S LICENSE SCANS MAY BE ON THE DARK WEB

Before choosing a backup method, make a short list of your most important files. You do not have to organize your entire computer in one afternoon. Start with family photos and videos, recent tax returns, medical and insurance records, passports or scanned IDs, mortgage or lease documents, wills, financial statements and work or creative projects. Include files stored in your Downloads, Desktop and Documents folders if they are important to you.

Give files clear names and place them in easy-to-find folders. For example, you might create folders called "Taxes," "Medical," "Home," "Family Photos" and "Important IDs." This makes it easier to back up the right material and find it later. Avoid keeping the only copy of a document in an email inbox, on a phone or inside a single computer folder. Those locations may be convenient, but they should not be your entire backup strategy.

A backup is another copy of a file stored somewhere else. If your computer fails, is stolen or becomes infected, you have a way to recover your information. One commonly recommended approach is the 3-2-1 backup strategy: keep three copies of important data on two different types of storage, with at least one copy kept somewhere separate from your main device or location. For many households, a practical setup might include the files on your computer, a regularly updated external drive and a trusted cloud backup or storage service.

Keep an external backup drive disconnected when you are not using it. If it remains attached to an infected computer, ransomware may be able to reach files on that drive too. Cloud services can add another layer between your files and your computer. Before relying on one, check what it covers, how much storage is included and how file restoration works. Also remember that cloud storage and cloud backup are not always the same thing. A storage service may sync changes across devices, while a backup service may provide separate copies or previous versions that can help with recovery.

Automatic backups are helpful because you do not have to remember to run them every week. But an automatic backup does you little good if you cannot restore anything from it. Choose a few files occasionally and confirm that they appear in your backup location. Then try restoring a copy to a different folder. This can uncover problems with permissions, file selection or an expired account before you are dealing with an emergency. Protect backup and cloud-storage accounts with strong, unique passwords and multifactor authentication. Multifactor authentication requires another form of verification beyond your password and can make it harder for someone to get into your account if your password is compromised.

Pay attention to the date of your most recent successful backup. A backup that has not run for months may be missing your newest family photos, tax records or work. Also look at whether your service keeps previous versions of files. Version history can be useful if something is accidentally deleted, overwritten or encrypted. Check your provider's retention and recovery policies so you know how far back you can restore files.

SCAMMERS KNOW THE BEST TIME TO TEXT YOU

Ransomware can start with a deceptive email, text message, website, attachment or download. A few habits can help reduce the chances of letting it onto your computer in the first place:

If files suddenly will not open, filenames or extensions have changed or a ransom message appears, act quickly. What you do next can help limit the damage and protect any clean backups you still have.

Disconnect the computer from Wi-Fi and unplug its Ethernet cable if one is connected. This can help stop ransomware from reaching shared drives, other computers or network resources. Also disconnect external hard drives or other backup storage if you can do so safely. If you cannot disconnect the affected computer from the network, powering it down may help stop further spread. Disconnecting it first is preferable because shutting down the computer can erase information from memory that may be useful during an investigation.

Do not start deleting encrypted files or the ransom note. They may contain information that helps identify the ransomware involved. If a ransom message is displayed, take a photo of it with another device so you have a record of what appeared on the screen. Do not open additional suspicious files, install random recovery programs or follow instructions in the ransom note without first getting professional guidance.

Paying does not guarantee that you will receive a working decryption key or get your files back. The FBI does not support paying ransomware demands and recommends that victims report ransomware incidents.

If this is a personal computer, contact your security provider or a reputable computer-repair or cybersecurity professional. You can also report ransomware to the FBI through the Internet Crime Complaint Center at IC3.gov or contact your local FBI field office. If the affected computer belongs to your employer, stop using it and contact your IT or security department immediately. Do not attempt to clean or restore a work computer yourself unless your organization instructs you to do so.

Do not reconnect an external backup drive to an infected computer. The affected device should first be evaluated, cleaned or rebuilt so you do not accidentally expose a good backup to the same ransomware. Once the computer is clean, you can restore files from a backup created before the ransomware infection. If you do not have a usable backup, recovery can be much more difficult. Some ransomware variants have free decryption tools available, but there is no universal tool that can recover every encrypted file.

Strong security software can add another layer between your important files and ransomware. Look for real-time protection that continuously monitors for malware, suspicious downloads and other threats instead of relying only on occasional manual scans.

A firewall can also help monitor network activity and block suspicious connections, while tools such as password managers and scam protection can help reduce other ways attackers may try to get into your accounts or devices.

Security software can lower your risk, but no product can guarantee that every threat will be stopped. That is why it should work alongside safer online habits and a separate, tested backup that gives you another way to recover your files if ransomware gets through.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

You do not need to spend hours managing your cybersecurity. Once a month, set aside a few minutes to check the protections you already have in place.

This routine is not complicated, and it does not require you to become a cybersecurity expert. The goal is to make sure that if ransomware, a device failure or another problem hits, you already have another copy of the files you care about and know how to get them back.

Ransomware can turn years of family photos and important records into files you suddenly cannot open. For me, security software and safer online habits are only part of the protection I want in place. I also want a separate backup of anything I would be devastated to lose, and I want to know that backup actually works before I need it. Spending a few minutes each month checking updates, backups and account security can put you in a much better position if ransomware ever hits.

If ransomware locked your computer today, how confident are you that you could recover the photos and documents you care about most? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.