The 0 KB file, the found USB and the 24-hour email
The tehsil office runs on one desktop computer: Windows 7, unlicensed, no antivirus, automatic updates switched off, shared by four clerks who all log in as 'tehsil' with the password 'tehsil123'. The mutation register, the daily diary and the monthly progress report live in a single folder on the desktop; there is no other copy. On Monday the machine will not open the report - the file shows 0 KB - after a power cut during load-shedding, and a USB drive that a visitor left plugged in is being blamed. On the same morning an email arrives from '[email protected]' with the subject 'Account blocked in 24 hours' and a link asking for the office login ID and password to 're-verify' the land-records account; a junior clerk has already typed the office ID into the page but stopped before the password. The district office wants the monthly report by Thursday, the UPS has failed, and no one knows when the IT team will visit.
1. Set out your actions in the first hour, in priority order, covering the 0 KB file, the email and the USB. Explain why that order and not another.
Read the worked answer
Priority order: (1) the file, (2) the email, (3) the USB - and nothing downloaded from the internet.
- Stop the damage. Disconnect the network cable; do not open or 'repair' the workbook; do not plug the found USB into any office machine. A 0 KB file is usually a file truncated when the power failed - the data may still be recoverable, and every attempted open writes to the disk.
- Recover from the office's own sources, in order: the ~$ temporary or .tmp copy of the same name in the same folder; Excel's AutoRecover/UnsavedFiles folder; Windows Previous Versions or shadow copies if enabled; the copy attached to the district office's email - that is the master template; and the manual diary and patwari's register for the day's entries. The report is reconstructable even if the file is not.
- The email. A gmail address claiming to be a land-records helpdesk, with a 24-hour threat, is phishing. Government systems do not ask for credentials by mail. Do not click. The ID is compromised even though the password was not typed: change the password from a different machine and report the sender address and headers to the district IT focal person in writing.
- The USB. Quarantine it; scan only on a standalone machine, or hand it to IT. Do not use it to move the recovered report - that is how an infection reaches the district office.
- The report goes on Thursday from the reconstructed template with a short covering note explaining the loss and the recovery route. A candid note now is cheaper than a discrepancy discovered at audit.
The order follows one rule: preserve what can still be preserved before investigating what caused it.
2. Write the standing rules the office must adopt on accounts, backup and media handling, and explain why each rule exists in terms of this incident.
Read the worked answer
Accounts and access.
- One named account per clerk; no shared login, no password written on the wall, no 'tehsil123'. Clerks get entry rights to the register, not deletion rights; the naib-tehsildar keeps the administrative account.
- Why: a shared account makes the phishing email dangerous - an attacker who guesses one password has the office, and the audit trail shows no individual.
Backup - the 3-2-1 rule.
- Three copies, on two different media, one off-site: the working file on the PC; a daily copy on an external drive kept in a locked cupboard; a weekly copy sent through the department's approved channel to the district office.
- Why: what was destroyed here was not the file but the only copy, and the power cut that killed the file also killed the UPS.
Media and macros.
- Antivirus installed and updating; macro-enabled workbooks from outside opened with macros disabled and only after IT clearance; USB ports used only for department-issued media.
- Why: the monthly report is itself a macro workbook received from outside; it is a plausible vector, and so is a drive left in a port.
Physical.
- A working UPS and a written shutdown routine.
- Why: the likeliest cause here is the power cut, not the visitor, and a UPS costs less than one lost register.
The general principle: an unpatched, single-copy, single-password machine converts any ordinary mishap - a power cut, a stray email, a found drive - into an office-wide emergency.
3. The clerk typed the office ID but not the password. What risk remains, what should be done today, and what does this incident reveal about the office's real vulnerability?
Read the worked answer
Residual risk. Even an ID alone is valuable: it confirms a live account to the attacker, it reveals the naming pattern for guessing colleagues' accounts, and with a 'forgot password' route tied to an easily found phone number or a weak security question it can be escalated. Submitting the ID to a look-alike page may also have exposed session data or installed nothing at all - but that cannot be assumed.
Actions today.
- Change the password on that account from a different, clean machine.
- Check last-login records and any changed contact details or forwarding rules on the account.
- Report to district IT in writing with the sender address and the time the ID was entered.
- Warn all four clerks and look for the same message in other mailboxes.
- Check the machine for anything downloaded that morning; the phishing click and the 0 KB file are on the same day and the same machine, and coincidence should not be assumed in either direction.
What the incident reveals. The office is attractive to a sender precisely because it runs one shared account with a guessable password and no antivirus. The phishing email and the shared password are the same problem seen twice: fix the access model and the email becomes noise; leave it and the next one succeeds. The correct lesson is not 'teach the junior clerk to spot a link' but 'stop giving four people one identity and one copy of the register'.