Ransomware on the File Server: Reboot or Preserve Memory
At 06:40 on Monday, a 4 TB Windows file server at Lakeside Manufacturing begins renaming files with .locked and dropping a ransom note. The server has 64 GB RAM and hosts the accounting share. EDR shows PsExec launched from 10.0.0.25 at 06:12, followed by deletion of volume shadow copies. The on-call admin has already unplugged the network cable but left the server powered on. The admin wants to reboot the server to stop encryption. The backup NAS is on the same network and already shows encrypted backup files; the cloud backup completed at 02:00. The company has 200 employees and no dedicated forensic team. The server room is badge-controlled, and the admin has domain admin rights. Legal asks whether to notify regulators; the state breach law has a 72-hour clock triggered by confirmed unauthorized acquisition of personal data. The server holds HR records and customer contact data.
1. What should be done in the first 30 minutes, in order, and why? Include the reboot question.
Read the worked answer
Do not reboot yet. A reboot destroys memory-resident evidence and may not stop encryption if the malware has a persistence mechanism; it also loses the ability to capture the running process, network connections, and injected code. First 30 minutes:
- Keep the host powered and network-isolated (already unplugged). Confirm no Wi-Fi or secondary NIC is active.
- Capture volatile data with a trusted, forensically sound tool: memory image, running processes, network connections, logged-on users, scheduled tasks, and service list. Hash the memory image.
- Preserve EDR telemetry and Windows event logs; export before they roll.
- Identify the PsExec source 10.0.0.25 and isolate it too, but do not power it off.
- Ask the admin to stop using domain admin credentials on the affected host; use a separate incident account.
- Notify legal and IR and start a timeline. If encryption is still actively spreading across the 4 TB share, consider suspending the encryption process or powering off after memory capture, with a documented decision. The cloud backup at 02:00 reduces the urgency to reboot.
2. How do you scope the incident and preserve chain of custody for the cloud backup and NAS?
Read the worked answer
Scope: build a timeline from EDR (PsExec at 06:12), Windows security logs, firewall and NetFlow to 10.0.0.25, file server SMB sessions, and the ransom note creation time. Check other hosts for PsExec service creation and .locked files. For the NAS, do not restore or delete; image or snapshot it, record serial numbers, and hash the images. For the cloud backup, export a snapshot to a separate, access-controlled account; preserve provider audit logs and the backup catalog. Chain of custody: a form for each item with who collected, when, where, hash algorithm and value, and every transfer; use write blockers for disk images; store evidence in a locked safe or encrypted evidence repository with restricted access. Keep the admin actions documented, including the unplugging, and have the admin sign a statement. Do not let the admin use domain admin rights on evidence systems.
3. Does the 72-hour breach clock start now? What facts are missing?
Read the worked answer
Not automatically. The clock is triggered by confirmed unauthorized acquisition of personal data, not by encryption alone. Facts missing:
- Whether data was exfiltrated before encryption. Encryption is primarily an availability incident; check for outbound transfers, RDP or SSH sessions, cloud uploads, and staging archives.
- What personal data the HR and customer files contained, and whether it was accessible to the attacker.
- Whether the attacker had domain admin or only the file server.
- Whether the cloud backup or NAS was accessed.
- Whether the ransom note includes proof of exfiltration. Legal should make the notification decision with IR. Document the analysis and the time of confirmation. If exfiltration is confirmed, start the 72-hour clock from confirmation and preserve the evidence used to make that call. If not, continue monitoring and reassess as the scope becomes clear.