domains / families / security / investigating-ransomware-attack-artifacts

investigating-ransomware-attack-artifacts

separate

Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.

When to use

• Immediately after discovering ransomware encryption on systems
• When performing forensic analysis to understand the full scope of a ransomware incident
• For identifying the ransomware variant and determining if decryption is possible
• When tracing the attack chain from initial access to encryption
• For documenting evidence to support law enforcement and insurance claims

Skill page

Source