If ransomware is suspected on a FortiGate-protected network, coordinate containment, preserve available evidence, and investigate across endpoints, identities, servers, cloud services, and backups—not just the firewall. FortiGate logs can help reconstruct network activity, but the firewall’s presence does not show that it was compromised, and its logs cannot establish that every system is clean.
What to do first
Follow your organization’s incident-response plan and bring the incident lead, IT and security teams, and other designated stakeholders into a coordinated response. Before disruptive actions, record what is known and what decisions are made, provided that documentation does not delay urgent containment. Fortinet cautions that actions can alert an attacker or limit evidence and impact analysis; CISA recommends coordinated containment and out-of-band communications where appropriate.
As an Amazon Associate I earn from qualifying purchases.
Preserve logs and other evidence promptly, especially when records may be held only in short-retention or volatile storage. Do not assume that the FortiGate alone contains a complete incident timeline. CISA’s September 2023 #StopRansomware Guide recommends retaining network-device, endpoint, and cloud logs and correlating them through centralized log management.
Free tools Windows power users keep installed
One-click scans. No signup required.
Contain affected systems without destroying evidence unnecessarily
Identify affected hosts and isolate them from the network using the containment plan. If multiple systems or subnets appear affected, network-level isolation may be necessary; coordinate it with the incident lead and prioritize critical services. If a device can be disconnected by another means, avoid powering it down while responders may still need volatile evidence. CISA notes that powering down a host can stop spread when it cannot otherwise be disconnected, but may also destroy volatile infection artifacts and evidence.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Where qualified responders are available, preserve relevant memory, system images, logs, malware samples, and indicators. Use communications channels the incident team considers appropriate; an attacker may be able to observe organizational communications and react to them.
Use FortiGate logs as one part of the timeline
Review available FortiGate traffic and security records around the earliest known encryption and suspected initial access. Look for permitted or blocked connections, unusual outbound traffic, suspicious destinations, and authentication or configuration events where those events are logged. FortiOS 7.4.4 documentation states that logging records traffic that passes through, starts from, or ends on the FortiGate, as well as actions taken during traffic scanning. The available records depend on what was configured, retained, and inspected.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
The FortiOS 7.4.4 documentation lists FortiAnalyzer, FortiAnalyzer Cloud, FortiGate Cloud, syslog, memory, and local disk among log destinations or storage options. That guidance is specific to FortiOS 7.4.4: consult the administration documentation matching the version actually deployed, and verify which records are available in your environment.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Correlate firewall records with endpoint detection and response and antivirus telemetry; identity-provider and directory authentication; VPN or remote-access records; server, email, cloud-storage, and backup logs. Build a timeline that connects observed activity across these sources rather than treating a firewall event as proof of what happened on an endpoint.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Establish the earliest likely access and encryption times, noting uncertainty.
- Identify compromised or unusual accounts, remote-management activity, precursor malware, lateral movement, and signs of persistence.
- Check for large data transfers and unusual server communications with cloud storage, which Fortinet identifies as possible exfiltration indicators.
- Record the systems, accounts, data, and services potentially affected, along with the evidence supporting each conclusion.
An absence of FortiGate alerts does not prove that there was no compromise or data theft. What the firewall can show depends on the logging, retention, inspection, and traffic visibility configured in that environment; encrypted traffic and missing records can limit what can be established.
Determine the scope, including possible data theft
Do not limit the investigation to files that have been encrypted. Determine which systems and accounts were affected, the likely initial-access period, and whether data may have been copied out as well as encrypted. Review outbound transfers and cloud-storage activity alongside endpoint, identity, server, and cloud telemetry.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
A thorough exfiltration investigation may require a digital-forensics team or incident-response consultant, as Fortinet notes. CISA’s guide also recommends reporting and response coordination. No particular ransomware family, FortiOS build, or incident evidence is established here, so no specific decryptor or indicator can be recommended. CISA advises consulting law enforcement about possible decryptors because tools have been released for some variants; availability depends on identifying the variant and checking trusted, current sources.
Validate backups and select a safe recovery point
Before restoring, establish that the backups are operational and that their data integrity has been checked. Compare candidate restore points with the earliest likely attacker access, not only with the time encryption became visible: attackers may have been present before encrypting files, and a later backup may preserve malicious content. Fortinet also warns that online backups may have been corrupted.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
CISA’s September 2023 guide recommends offline, encrypted backups of critical data and regular testing of their availability and integrity in a disaster-recovery scenario. For each candidate recovery point, assess:
- Whether the backup is offline and encrypted.
- Whether integrity checks and restore tests succeeded.
- Whether the point predates likely attacker access.
- Whether systems can be rebuilt or restored in a clean, isolated environment.
- Which critical services and dependencies must be restored first.
Restore in isolation and reconnect deliberately
Use the organization’s known asset list and recovery priorities to restore critical services and their dependencies in an orderly sequence. Restore from a validated recovery point into a clean or isolated environment. If persistence cannot be confidently removed, rebuild affected systems rather than returning them to production as they are.
Validate and monitor restored systems before reconnecting them to production. CISA’s recovery guidance emphasizes keeping recovery systems clean and avoiding reinfection during reconnection. Coordinate reconnection with the incident team so that restored systems do not reintroduce compromised accounts, malware, or other persistence into the network.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCoordinate notifications and document lessons
Use the incident-response and communications plans to involve internal stakeholders, insurers, and appropriate government or law-enforcement contacts. Consult legal counsel about potential regulated-data obligations and reporting duties; those depend on the affected data, sector, jurisdiction, and incident facts, and cannot be determined by a general guide.
After recovery, document the incident timeline, decisions, evidence gaps, and recovery results. Use those findings to update response plans and exercises, and to improve log retention, backup testing, and recovery readiness.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
