Protecting Family Photos
From Ransomware

Copies beat criminals — that's the whole strategy

Ransomware is a criminal's program that encrypts — scrambles — your files, then demands payment to unscramble them. It's automated, not personal: nobody is targeting your house. And for a family, the files that actually matter aren't the tax spreadsheets. They're the wedding album, the baby pictures, the photos you can't take again. Those are the ones worth a plan.

The good news is the plan is simple, mostly free, and doesn't require becoming a computer person. A photo that exists in three places — your PC, OneDrive, and a drive unplugged in a drawer — is a photo no criminal can take from you. Everything below builds that setup one calm step at a time, and the 25-page PDF walks through every click.

The 3-2-1 plan, kitchen-table version

• 3 copies of every precious photo — the same rule security agencies give hospitals and banks, scaled down to a family PC.
• 2 kinds of places — your computer plus the cloud, or your computer plus an external drive. Different things fail differently.
• 1 copy out of reach — unplugged, in a drawer. Ransomware scrambles every drive it can see, so the unplugging IS the protection.

Copy two: turn on OneDrive folder backup (10 minutes)

1. Click the little cloud icon near the clock, bottom-right corner. (No cloud? Click Start, type OneDrive, press Enter and sign in.)
2. Click the gear → Settings → Sync and backup → Manage backup.
3. Turn ON Pictures (Documents and Desktop too, if you like) and save.
4. Let the first upload finish — a big collection can take a day or more. After that, every new photo copies itself to the cloud automatically.

Why OneDrive is more than a copy

A fair worry: if the PC's files get scrambled, won't OneDrive faithfully sync the scrambled versions? Yes — and Microsoft planned for it. Every file keeps 30 days of version history, photos included. Microsoft watches for the tell-tale mass-encryption pattern and alerts you by email and on your devices. And for Microsoft 365 subscribers, Files Restore rewinds your entire OneDrive to any point in the last 30 days — one big undo button. The free account includes only 5 GB, but the $1.99/month Basic plan (100 GB, as of mid-2026) covers most family photo libraries and includes the ransomware-recovery features.

Copy three: the drive in the drawer

• Buy any name-brand portable USB drive, 1–2 TB, about $60–$80. That's a few hundred thousand photos' worth of room.
• Copy your whole Pictures folder onto it, open a few photos from the drive to prove they're real, then eject and unplug it.
• Label it with masking tape and a date, and keep it in a drawer — not plugged in. Top it up once a month, fifteen minutes.
• Extra credit: a second drive that lives at an adult kid's house across town covers fire and flood too.

Lock the door for free: Controlled folder access (2 minutes)

1. Click Start, type Windows Security, press Enter.
2. Click Virus & threat protection, scroll to Ransomware protection, click Manage ransomware protection.
3. Switch Controlled folder access to On and click Yes.
4. Done — now only trusted programs can change your Documents, Pictures, Videos and OneDrive folders. If a program you trust gets blocked, "Allow an app through Controlled folder access" fixes it in a minute. If a block appears out of nowhere — that's the feature working. Don't allow it.

The fake ransomware you're more likely to meet

Most "locked computer" screens people actually see are fakes — a noisy web page with alarm sounds and a phone number, claiming to be Microsoft. Real ransomware never gives you a phone number to call. Don't call; close the browser (or restart the computer) and it's gone. Nobody legitimate cold-calls about your computer, and nobody legitimate takes gift cards. Ever.

If the real thing ever happens: the first hour

1. Disconnect from the internet — unplug the cable, turn off Wi-Fi, or just shut the PC down.
2. Leave your backup drive IN the drawer. Don't plug it in to check.
3. Don't pay. Your photos exist in OneDrive's 30-day history and on the drive — the ransom note is just litter.
4. Photograph the ransom note with your phone, change your Microsoft password from a different device, and call for help with the cleanup. With copies in place, it's a lost afternoon — not lost photos.

What's in the 27-page PDF

• What ransomware actually is — automated, not personal, and beatable
• The four doors it uses to get in, and how to keep them shut
• A room-by-room hunt for where your photos hide today (old laptops, memory cards, discs)
• The 3-2-1 plan mapped to your house: PC, OneDrive, drive in the drawer
• OneDrive folder backup, click by click — plus the 5 GB speed bump to know about
• Version history, ransomware detection, and Files Restore — the 30-day undo buttons
• The OneDrive plans compared honestly, from free to Family (mid-2026 prices)
• Buying and setting up the external drive, and the unplugged rule that makes it work
• Controlled folder access: turning it on, and handling the occasional false alarm
• Fake "call Microsoft" pop-ups vs. real ransomware — a side-by-side table
• The first-hour checklist if it ever really happens, and recovery in the right order
• A 15-minute monthly routine to tape to the refrigerator, plus FAQ, glossary, and a fill-in cheat sheet

Why I wrote this

Family photos are the one kind of file money can't replace, and ransomware is the one computer problem where preparation is everything and cleanup is almost nothing. The whole defense costs about two dollars a month and a seventy-dollar drive — it just needs someone to walk through it calmly, once. That's what this guide is for. I print these as handouts for exactly this reason: the plan works best sitting in a drawer next to the backup drive. If you'd rather do it together, that's a normal house call for me. — Bill