The Locked Files and the Missing Cause List
You are the junior assistant in charge of the computer room of a court office with 12 desktop computers on a local network. There is no server: staff save the daily cause list and the despatch register in a folder on one workstation (PC-4) which is shared to everyone. On Monday morning you find the following. (1) PC-4 does not boot and its hard disk is not readable; the cause list prepared on Friday exists nowhere else. (2) On three other PCs every document has been renamed with a '.locked' extension, and a text file on the desktop demands payment. (3) Two assistants edited the same despatch register file at the same time on Friday, and one person's entries are gone. (4) A pen drive used to carry files between PCs is suspected as the source. (5) Three PCs still run an operating system that has not received security updates for over a year. The office has one external hard disk, kept in the record room, and an internet connection used for official email.
1. What do you do in the first hour, in order?
Read the worked answer
Containment first, cure second.
- Isolate, do not delete. Unplug the network cable and disable Wi-Fi on every affected machine so the encryption cannot spread to the shared folder or to other PCs. Do not run 'clean-up' tools, do not delete the ransom note and do not reboot repeatedly - the note and the renamed files are evidence.
- Inform upwards immediately: the head of the office or Registrar, and the IT cell or NIC support. A court office cannot investigate this on its own, and the delay is what turns an incident into a cover-up.
- Quarantine the pen drive and stop all use of removable media in the room; note which PCs it was used on.
- Do not pay, and do not reply to the demand. Payment is no guarantee of a key and is itself a reportable act.
- Restore, after checking. Identify the most recent backup on the external disk, scan or restore it on an isolated clean machine, and rebuild it. Rebuild the three encrypted PCs from known-good installation media rather than trusting a cleaned disk.
- Record a timeline - who saw what, at what time, and every action taken. That log is what the IT cell and any inquiry will rely on.
2. The lost cause list and the lost despatch entries both stem from the same design fault. State the fault and three changes that fix it.
Read the worked answer
The fault is single-copy storage on a workstation combined with uncontrolled concurrent editing. PC-4 was acting as a server without being one, the folder had no versioning, and anybody could open the same file for writing.
Changes:
- Move shared data to proper central storage - a file server, or NIC or government-approved cloud storage if the rules permit, with folder-level permissions. Case data of a court should not be parked on a clerk's desktop, and personal email or consumer cloud accounts should not be used for it.
- Fix the editing model. Give view-only rights to everyone who only needs to read, and designate one editor per register with a check-out-and-lock routine. Where simultaneous work is unavoidable, split the register into sections, keep the master read-only, and use tracked changes so that a deleted entry is visible rather than silent.
- Adopt versioned file naming and a real backup. A name such as CauseList_2025-03-14_AO.docx, never 'final_final(2)', plus a nightly copy to the external disk that is kept outside the computer room, with a restore test once a month. The 3-2-1 rule - three copies, two media, one off-site - is the minimum for records that cannot be recreated.
3. How do you deal with the pen drive and the unpatched machines without stopping the office's work?
Read the worked answer
Both are policy problems, and both are solvable without shutting the office down.
Pen drives. Prohibit casual use by office order. Where transfer is genuinely needed, nominate one machine as the transfer point, scan every device before it is opened, disable autorun and auto-play through policy so that nothing executes on insertion, and keep a small register of who used which device and when. Blank media can be issued to staff instead of allowing personal drives in.
Unpatched machines. Do not connect the three old PCs to the network until they are rebuilt or replaced - that is the single decision that protects the other nine. Meanwhile, reschedule the work: the operators on those PCs move to the working machines in shifts, or their work is done on paper and entered later. Update the operating system, enable automatic updates, install and update antivirus, remove administrator rights from ordinary users so that a mistake cannot encrypt the whole machine, and set a date for replacing the unsupported systems.
Review after a month: count the incidents, check that the backup restore actually works, and record the review in writing, since a written review is what converts a one-day scramble into an office procedure.