Recommended Free Tools
Ransomware encryption does not prove that attackers stole files. To determine whether data was exfiltrated, preserve evidence first, then correlate endpoint, network, firewall, identity, storage, and cloud records across the suspected compromise window. Look for abnormal outbound traffic, unexpected transfer tools, suspicious account activity, access to sensitive repositories, and attempts to disable or erase logging. Each signal needs context; a tool, login, or large transfer by itself is not conclusive proof.
The investigation should end with one of three defensible findings: a transfer is confirmed, the evidence supports but cannot prove exfiltration, or the result is unresolved because records are missing or incomplete. Document which conclusion the evidence supports and involve an experienced incident-response provider when internal capability is not sufficient.
As an Amazon Associate I earn from qualifying purchases.
Encryption and data theft are separate events
A ransomware operation can encrypt systems, copy data, do both, or do neither in the same way. Encryption demonstrates that files or systems were affected; it does not establish that an attacker successfully received a copy. Treat exfiltration as a separate question with its own evidence trail.
Start with a precise question: which accounts, hosts, applications, and data stores could the intruder reach, during what time period, and do records show those data moving to an external destination? A threat actor’s extortion message or a leak-site claim is an allegation to preserve and investigate, not a substitute for your own logs and forensic evidence.
#1 Best Overall
- Backlit Interface - Device status, device information, logical unit (LUN) select, and bridge information are easily accessible
- Supports USB 1.0/2.0/3.0, Flash Drives, Mass Storage Drives, and any "bulk storage" drive
- Kit Includes - TP2 Power Supply with US-Style power cord, TC-USB3 USB 3.0 (A to B) cable, 6 foot length, Soft-Sided bag and Quick Start Guide
- Hardware-Based USB 3.0 Write Blocker
Separate facts from inferences
- Fact: a file-transfer process ran under a particular account on a particular host at a recorded time.
- Fact: the host opened an outbound connection to an external address and transferred a measured amount of data.
- Inference: the transferred bytes contained a specific database or document set.
- Unresolved: a sensitive repository was accessed, but no reliable record shows whether its contents left the environment.
Keep those categories distinct in notes and reports. CISA guidance provides indicators and preservation procedures, but no single indicator proves that files reached an attacker.
Contain the incident without destroying evidence
Use the organization’s incident-response plan and coordinate containment with the people responsible for security, infrastructure, legal matters, privacy, and communications. The CISA #StopRansomware Guide, described by CISA as updated in May 2023, warns that powering a device down can remove evidence held in volatile memory.
- Set up out-of-band coordination. Assume compromised email, chat, and identity systems may be monitored. Use a communication channel that is not dependent on affected infrastructure.
- Isolate affected systems in a controlled way. Disconnect or quarantine hosts, segments, accounts, and remote-access paths according to the response plan. Avoid improvised actions that overwrite logs or interrupt a collection already in progress.
- Capture volatile evidence where feasible. Memory can contain running processes, network sessions, encryption keys, and command history that will disappear after shutdown or reboot. Have trained responders collect it before taking systems offline when circumstances permit.
- Protect short-retention records. Export relevant endpoint, firewall, identity, cloud, and network logs immediately. Record the collection time, source, time zone, retention setting, and person or system that performed the export.
- Image a representative sample. If immediate mitigation is not possible, CISA recommends system images and memory captures from a sample of affected devices, along with relevant logs, malware samples, and indicators. Preserve originals and work from verified copies.
- Record every containment action. Note which host or account was isolated, by whom, at what time, and what evidence might have been changed as a result. This prevents an emergency action from being mistaken for attacker activity later.
Do not let the desire to restore operations erase the information needed to answer the theft question. If safety, availability, or active attacker movement requires an immediate shutdown, document that decision and the evidence that could no longer be collected.
Build an evidence picture across the environment
No single console normally shows the complete story. Correlate records from the systems below, keeping their timestamps normalized to a common time zone and noting gaps in retention. CISA’s guidance on logging on business systems emphasizes centralized collection so activity can be examined across devices and services.
| Evidence source | Questions it can answer | Important limitations |
|---|---|---|
| Endpoint detection, antivirus, and operating-system logs | Which process ran, under which account, on which host? Were archives created, scripts executed, or security tools stopped? | Attackers may delete local logs, disable agents, or use a host whose agent was never installed. |
| Network sensors and flow records | Did a host establish an external session? How much data left, over which protocol, port, and destination? | Flow volume may not identify the files, and encrypted traffic can hide content. |
| Firewalls, secure web gateways, and VPN systems | Which outbound destinations were allowed or blocked? Did a new remote-access path appear? | Short retention, NAT, proxies, and incomplete export can make attribution to a specific host difficult. |
| Identity and directory services | Were there suspicious logins, new accounts, privilege changes, token use, or access from unusual locations? | A valid credential can look normal unless location, device, and timing are correlated. |
| Cloud control-plane and storage logs | Which objects, repositories, snapshots, or sharing links were accessed or downloaded? | Logging varies by service and plan; object-level events may not have been enabled. |
| File, database, and application audit logs | Which records or folders were read, exported, compressed, or queried during the compromise window? | Access does not by itself prove successful transfer to an external recipient. |
For each source, preserve the original export and a working copy. Write down the clock basis, retention period, query filters, collection time, and any missing interval. This chain of documentation lets another responder understand what was examined and what could not be recovered.
Rank #2
- Includes Tableau T356789iu Forensic Universal bridge, TC2-8-R2, TC4-8-R2, TC6-8, TC-USB3, TC7-9-9 and USB B Male to USB 19 Pin Header Cable
- The Tableau Forensic Universal Bridge is an integrated write-blocker that mounts in a drive bay of a forensic workstation and supports forensic acquisitions of SATA, USB 3.0, PCIe, SAS, FireWire 800, and IDE.
- Mounts in one 5.25” half-height drive bay
- Color LED indicators for “Write Block” or “Read/Write” mode visibility
- USB 3.0 host computer connection, Two SATA power connectors
Indicators that may point to exfiltration
Investigate the following signs in context. CISA specifically identifies abnormal outbound data and unexpected use of Rclone, Rsync, web-based storage services, and FTP or SFTP as possible exfiltration indicators in its ransomware guidance. Their presence is a reason to investigate, not proof that files left the network.
Unusual outbound volume or destinations
Compare outbound traffic during the suspected window with the host’s normal pattern. A sudden increase, sustained transfer at unusual hours, or traffic to a destination never used by that system deserves review. Check the protocol, port, destination ownership, DNS history, proxy record, and whether the volume is consistent with a legitimate backup, software update, or replication job.
Volume alone can mislead. A database replica or cloud backup may be large and expected, while a small but highly sensitive export could matter more than a large transfer of public data. Look for a matching process, account, and data-access event on the sending host.
Unexpected transfer utilities and services
Search endpoint and command-line telemetry for Rclone, Rsync, FTP, SFTP, archive utilities, and connections to consumer or web-based storage. Check when the tool first appeared, who installed or launched it, which configuration or credentials it used, and whether its activity overlaps access to sensitive files. A legitimate administrator may use the same software, so establish a baseline and validate the business purpose.
Suspicious account and privilege activity
Review newly created accounts, unexpected elevation, password or multifactor changes, logins from unusual locations, service-account use outside its normal schedule, and access through a host the account had not previously used. Map each identity event to endpoint and network activity. A suspicious login without data access is different from a suspicious login followed by archive creation and an outbound session.
Rank #3
- Kit Includes: Tableau T6u Forensic SAS Bridge, TP2 Power Supply and Power Cord, TC-USB3 3.0 A to B Cable, TC4-8-R2 Unified SATA/SAS Signal Power Cable, T6u Quick Reference Guide, and TB1 Zippered Nylon Bag.
- Imaging speeds up to 200 MB/second
- USB 3.0 host computer connection
- User-switchable read-write mode via internal DIP switch supports wiping and formatting of SAS devices without the need of an expensive SAS controller card
- Integrated, backlit LCD presents useful bridge and SAS device information. Six LEDs provide status on power, host connection, SAS device detection, write-block status, and activity
Persistence and staging activity
Look for newly installed services, scheduled tasks, startup entries, scripts, temporary staging directories, and large archives created shortly before outbound connections. Record the archive path, creator, process, and files included when that information is available. Staging indicates preparation; it does not establish that an archive was successfully uploaded.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Disabled or altered security controls
Check for deleted event logs, cleared shell history, disabled endpoint agents, modified firewall rules, stopped audit services, or unusual changes to retention settings. These actions can indicate attempts to conceal access or transfer. They also create uncertainty: a missing record cannot be treated as evidence that no transfer occurred.
Access to sensitive repositories followed by egress
Identify the repositories containing personal information, credentials, intellectual property, or regulated records. Compare object or file access with archive creation and outbound connections in the same time window. The strongest hypothesis is supported when the same account and host accessed sensitive data, prepared it for transfer, and then generated correlated egress to an external destination.
Correlate the evidence into a timeline
A timeline turns isolated alerts into an answerable sequence. Use a common time zone and preserve the original timestamp as recorded by each system.
- Define the window. Start before the first known compromise or encryption event and extend through containment. Include the period in which stolen data might have been staged or uploaded.
- Identify initial access and control. Mark suspicious authentication, exploitation, remote-management use, or malware execution. Note the first account and host associated with the activity.
- Map privilege and lateral movement. Add account changes, remote sessions, new services, scheduled tasks, and access to file servers, databases, backups, and cloud consoles.
- Mark data access and preparation. Record file reads, database queries, exports, compression, staging directories, and creation or modification of transfer-tool configuration.
- Match outbound events. Place network connections, DNS lookups, proxy decisions, firewall events, and byte counts beside the data-access events. Determine whether the same host, account, and process are involved.
- Test alternative explanations. Compare the event with approved backups, replication, vulnerability scans, administrator work, and scheduled maintenance. Document why a benign explanation was accepted or rejected.
- Preserve the reasoning. For every conclusion, cite the underlying records and state what remains inferred rather than directly observed.
| Timeline pattern | What it supports | What it still cannot prove |
|---|---|---|
| Sensitive files read, archive created, and outbound connection from the same host and account | A strong, corroborated exfiltration hypothesis | That the attacker successfully received every file in the archive |
| Transfer tool executed and external session recorded, but no file-access telemetry | Possible transfer activity requiring scope and content analysis | Which data, if any, was copied |
| Large outbound transfer with no matching process or repository access | An anomaly that may be backup, replication, or theft | That ransomware actors caused it |
| Repository access with no reliable outbound records | Exposure of data to a compromised identity | Whether the data left the environment |
Classify the conclusion honestly
Use a confidence category that matches the evidence instead of forcing a yes-or-no answer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Includes: Tableau T3iu Forensic SATA Drive Bay and 17" USB B to USB 19 Pin Header Cable
- The Tableau Forensic SATA Drive Bay is an integrated write-blocker that mounts in a drive bay of a forensic workstation and supports forensic acquisitions of 3.5” and 2.5” SATA hard drives.
- Mounts in one 5.25” half-height drive bay
- USB 3.0 host computer connection
- Read/write mode capability via internal DIP switch
| Finding | Use it when | Suggested wording |
|---|---|---|
| Confirmed transfer | Reliable records show the data or an identified archive was sent to an external destination, with corroborating host, account, process, and network evidence. | “Records confirm that [identified data or archive] was transferred from [host or service] to [destination] during [time window].” |
| Supported but unconfirmed | Multiple indicators align—such as sensitive access, staging, and egress—but the available records cannot establish the content or successful receipt. | “The evidence supports a reasonable exfiltration hypothesis, but does not confirm which data was received externally.” |
| Unresolved | Logs were absent, overwritten, too short-lived, or too incomplete to correlate access with transfer. | “The investigation could not determine whether data was exfiltrated because [specific evidence gap].” |
| No evidence identified in reviewed sources | The examined records show no exfiltration indicator, while their coverage and retention are known to be adequate for the window. | “No exfiltration evidence was identified in the reviewed sources; this finding is limited to their documented coverage.” |
A “no evidence identified” result is not the same as proof that no theft occurred. State the systems, time period, and retention that make the result meaningful.
Understand what missing logs mean
Short retention periods, disabled auditing, unmonitored cloud services, clock drift, and attacker tampering can all leave gaps. The absence of a transfer record is especially weak when the relevant firewall, proxy, endpoint, or cloud logs were never collected or have already expired. Record the gap itself, including when the data source stopped, how long it retained events, and whether an attacker could alter it.
Do not fill a gap with certainty. If a compromised account accessed a sensitive database but no network or object-level records survive, report exposure and explain that transfer status remains unresolved. Conversely, do not label every large transfer as theft when approved replication or backup records explain it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Preserve evidence and obtain specialist help
CISA’s fact sheet, Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches, advises avoiding destruction of forensic evidence and strongly considering a reputable third-party incident-response provider experienced in data breaches. Bring in qualified help when the team lacks memory-capture, forensic-imaging, malware-analysis, cloud-log, or legal-discovery expertise, or when the attacker may still have access.
CISA describes Velociraptor as a tool incident responders can use to hunt for malicious activity, collect artifacts, and perform file analysis. It is an option for trained response teams, not a replacement for coordinated containment, evidence preservation, or expert interpretation. Any collection tool should be used under a documented plan so that timestamps, originals, and chain of custody remain reliable.
Best Value
- This comprehensive forensic imaging kit includes four different Tableau write-block bridges, a variety of adapters to support most common device interfaces, and durable SiForce Rugged Case.
- Tableau write-block bridges included: T8u (USB 3.0), T7u (PCIe), T35u (SATA/IDE), and T6u (SAS).
- PCIe Adapters (Compatible with T7u) Include: TDA7-1 PCIe Card SSD Adapter, TDA7-2 M.2 PCIe SSD Adapter, TDA7-3 Apple SSD 2013-2016 Adapter, TDA7-4 U.2 PCIE SSD Adapter, TDA7-7 Apple SSD 2016+ Adapter, PCIE-4 Tableau Pigtail Cable.
- Other Adapters/Components Include: Tableau TDA3-3 mSATA/m.2 SATA SSD Adapter (Compatible with T35u), SiForce USB Media Card Reader (Compatible with T8u), TC3-8 SATA Signal Cable, TC4-8-R2 Unified SAS Cable, TC5-8-2 SATA to 2M Drive Power Cable, TC6-8 IDE Cable, TC2-8-R2 Molex Drive Power Cable, TC-USB3 USB 3.0 A to B Cable (x2), TP2 Tableau Power Supply with A/C Power Cord (x2), and SiForce Rugged Case.
- Kit List: T8u, T7u, T35u, T6u, TKDA-PCIE-5PC (TDA7-1, TDA7-2, TDA7-3, TDA7-4, TDA7-7, PCIE-4), TC3-8, TC4-8-R2, TC5-8-R2, TC6-8, TC2-8-R2, TP2 + AC power cord (x2), TC-USB3 (x2),TDA3-3, SiForce USB Media Card Reader, and SiForce Rugged Case.
Handle breach response and notifications
If the investigation determines that personal or sensitive information was stolen, activate the organization’s breach-response and notification plans. Include legal, privacy, security, leadership, communications, and affected business owners in decisions about scope and messaging. Requirements depend on the type of information, affected people, contractual duties, and applicable jurisdictions.
CISA specifically advises notifying other businesses when personal information stored on their behalf was stolen. Preserve the factual basis for every notice: what was accessed, what transfer evidence exists, which populations may be affected, what remains unknown, and what containment actions were taken. Do not claim that encryption alone proves theft, and do not claim that no data was stolen merely because a leak-site post was false or no longer available.
Improve logging so the next investigation is answerable
Logging is an investigation capability, not just a compliance setting. Centralize records from endpoints, identity systems, network devices, firewalls, and cloud services; protect them from alteration; and test that collection works before an incident.
Free tools Windows power users keep installed
One-click scans. No signup required.
In its LockBit advisory, CISA and partner agencies recommend network-traffic logging and enhanced PowerShell logging as defensive measures. The advisory also points to retaining specified PowerShell logs for at least 180 days and, where possible, keeping critical-system logs for one year. These are operational recommendations, not measured breach statistics; adapt retention to your risk, legal obligations, storage capacity, and threat model.
- Synchronize system clocks and record the time zone in every export.
- Capture process, command-line, account, file-access, and network connection details on high-value systems.
- Enable cloud object-access and administrative audit logs before they are needed.
- Forward logs to centralized storage with access controls that attackers cannot easily disable.
- Alert on unusual outbound volume, new transfer utilities, privilege changes, and logging-service tampering.
- Exercise restoration and forensic collection so responders know what survives a host isolation or shutdown.
What the final investigation report should contain
Write the report for a reader who was not present during the incident. Identify the suspected compromise window, affected systems, data repositories considered, evidence sources collected, collection times, and retention limits. Present the timeline that links identity, host, data-access, staging, and network events. For every major statement, distinguish a directly observed fact from an inference.
State the conclusion using the confidence categories above and list unresolved questions separately. Explain whether missing logs, disabled monitoring, encryption, or attacker tampering limited the answer. Attach preserved indicators, relevant malware samples, system-image references, and hashes or chain-of-custody records according to the response team’s procedures.
The defensible answer is not always “yes” or “no.” It is a documented determination of what the records prove, what they strongly suggest, and what they cannot resolve. That distinction lets leadership make accurate notification decisions and prevents an encryption event from being mistaken for proof—or lack of proof—of data theft.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
