Encrypted Files and an Exam at Ten
At 16:00 on a Thursday, a trainee reports that files on PC-14 in a 30-node COPA lab have been renamed with a .enc extension, and a text file on the desktop demands payment in cryptocurrency. The lab is one flat network with a shared folder on the instructor's PC, and two more machines now show the same text file. A semester-end practical examination for 30 trainees is scheduled at 10:00 the next morning. The lab's only disk image is six months old and is stored on an external hard disk kept in the same room. Two spare PCs are in the store. The affected trainee had copied a project from a pen drive brought from a cyber café. The instructor is the only staff member present and has no budget authority.
1. Set out the first 30 minutes in order, with the reason for each step. Address the question of whether to switch machines off.
Read the worked answer
- Contain the network first, not the machines. Disable the Wi-Fi adapter on the instructor's PC and unplug the lab switch uplink (or the switch itself) so the three known machines cannot reach the shared folder and cannot encrypt network shares. Reason: encryption of the shared folder multiplies the loss, and the shared folder is often the largest single target.
- Isolate the three affected machines' network cables. Do not reconnect them to the switch for any reason during triage.
- Do not pay, and do not delete anything. The .enc files and the ransom note are evidence; paying carries no guarantee of a working decryptor and funds the next attack.
- Quarantine the pen drive. Bag it, do not insert it into any other machine, and record who used it and when.
- Notify up the line immediately - department head and the person responsible for IT - in writing, including the exam constraint. A ransomware event is not an instructor-level decision.
Power state. In a forensic context, pulling the plug preserves volatile memory that may hold the encryption key; in a training institute with an exam in 18 hours and no forensics team, the practical rule is: if the machine is still running and actively encrypting, disconnect the network immediately and shut it down cleanly if it responds, so it stops writing. Record what you did and when. Do not start 'cleaning' the machine - reinstalling before imaging destroys the only evidence of how it entered.
2. Given 30 examinees, two spare PCs, a six-month-old image and no budget, decide the recovery plan and how tomorrow's exam proceeds.
Read the worked answer
Recovery decision. Restore, do not pay. Three infected machines from image, then re-patch and re-apply user data from the most recent backup that predates infection - accepting that the last six months of local work on those three machines may be lost. Before restoring, image each affected disk so the evidence survives the wipe; a free imaging tool onto the external HDD is enough.
Critical weakness to fix during recovery: the only image sits on the same external HDD in the same room. If the encryption had reached that drive, the institute would have nothing. Copy the fresh image to a second location off the lab before the exam.
Exam plan for 10:00, in order of preference:
- Restore the three machines overnight from image; verify by logging in and running the actual exam task on each.
- If restoration overruns, move examinees to the two spares and any working machines, and run the exam in two sittings with the same question paper - same conditions, same duration, invigilated.
- Do not run the exam on unreimaged infected machines, even if they boot; residual malware and missing files make the assessment invalid and could spread via the shared folder.
Tell the exam cell tonight, not at 09:00. Contingency communicated early is planning; communicated late is an excuse.
3. Write the follow-up note you would issue to staff and trainees, and name the three policy changes you would push for.
Read the worked answer
Note to staff and trainees (short, factual, no blame):
On Thursday afternoon three lab machines were infected by malware that encrypted local files. The affected machines have been taken out of service, the network was isolated, and the lab is being restored from a clean image. No payment has been made and no institute records were lost. Until further notice: do not insert personal pen drives into lab machines, do not open unexpected attachments, and report any file that changes extension or any unexpected text file on the desktop to the instructor immediately, without deleting it. The examination will proceed as scheduled; venue details follow.
Three policy changes to push for:
- A no-personal-USB rule with a workable alternative - a scanning station with one designated, updated machine, or cloud transfer, so the rule is followed rather than quietly broken.
- 3-2-1 backup with an offline copy - at least three copies, two media, one off-site; the image currently shares a room with the machines it protects. Add a quarterly test restore, because an untested image is a hope.
- Least privilege plus patching - trainees should not run as local administrators on lab machines, and updates should be applied on a schedule; the incident also needs a one-page reporting path so the next person knows whom to call in the first five minutes.