If ransomware or a data-extortion demand is suspected, coordinate containment first, preserve volatile evidence before it disappears, save the attacker’s messages and payment details, and report promptly through official channels. Do not reflexively shut down every device or contact the attacker from an unprotected account. The sequence below is written for incidents in the United States; other countries use different authorities and deadlines.
1. Coordinate containment without destroying evidence
Activate your organization’s incident-response plan and communications plan immediately. Bring in the IT or security team, an incident-response lead, and any qualified digital-forensics personnel already under contract. Assign one person to coordinate decisions and another to maintain the incident log. Keep executives, legal counsel, insurers and operational leaders informed through the approved process.
As an Amazon Associate I earn from qualifying purchases.
Use communications the attacker cannot monitor
Assume that compromised email, chat, file-sharing and remote-access systems may be visible to the intruder. Move sensitive coordination to an out-of-band channel that the response team has verified as separate from the affected environment. CISA warns that an attacker who can observe your response may react by moving laterally or deploying ransomware more widely. Do not post investigation plans, administrator credentials, recovery steps or negotiation positions in a system that may be compromised.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Limit spread while preserving the scene
Containment is a risk decision, not a single command. Segment or disconnect affected hosts when your responders can do so safely, block known malicious connections at the firewall, disable compromised accounts and protect clean backups. Record each action, the person who approved it and the time it occurred.
#1 Best Overall
- Backlit Interface - Device status, device information, logical unit (LUN) select, and bridge information are easily accessible
- Supports USB 1.0/2.0/3.0, Flash Drives, Mass Storage Drives, and any "bulk storage" drive
- Kit Includes - TP2 Power Supply with US-Style power cord, TC-USB3 USB 3.0 (A to B) cable, 6 foot length, Soft-Sided bag and Quick Start Guide
- Hardware-Based USB 3.0 Write Blocker
| Action | Why it may help | Evidence or operational risk |
|---|---|---|
| Isolate a confirmed affected host from the network | Can stop lateral movement and additional encryption | May interrupt live memory collection or remote forensic access; coordinate with responders first |
| Segment a suspected network zone | Reduces the attacker’s path to other systems | Can disrupt essential services and alter network logs; document the exact change |
| Disable a compromised account | Prevents continued use of stolen credentials | May remove access needed to observe the attacker; preserve authentication records before retention expires |
| Power off a device | Stops activity when network isolation is impossible | Destroys volatile memory and can remove infection artifacts; use only when temporary network shutdown or host disconnection is not otherwise possible |
CISA specifically cautions against powering down systems as a reflex. If a device can be isolated by network controls or disconnected from affected segments, that approach may preserve memory and other live artifacts. If immediate safety or containment requires shutdown, record why, when and by whom it was done.
2. Capture volatile evidence before it disappears
Volatile evidence can vanish when a system reboots, a log buffer rolls over or a short-retention service purges records. Ask qualified responders to prioritize collection in the live environment before routine cleanup, patching or restoration begins.
Prioritize short-retention material
- System memory: A memory capture can contain running processes, encryption keys, network connections and attacker tooling that never reaches disk.
- Windows Security logs: Export relevant records before retention settings overwrite them. Preserve the original timestamps, host identity and time-zone context.
- Firewall and boundary log buffers: Save records showing connections to and from suspicious or foreign IP addresses, including the period before encryption was discovered.
- Other relevant logs: Depending on the environment, responders may collect authentication, endpoint, VPN, cloud, DNS, proxy, email and file-server records. The exact set depends on what the organization runs and how long each service retains data.
CISA’s response guidance recommends taking system images and memory captures from a sample of affected devices when immediate mitigation is not possible, and collecting relevant logs and precursor malware samples. A sample should be selected to represent different user roles, operating systems, network locations and times of infection rather than chosen at random by an untrained person.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Have responders acquire images and samples safely
Forensic imaging, memory capture and malware handling can change the evidence if performed incorrectly. Let qualified incident responders or digital-forensics specialists choose the collection method, storage media and hashing process for your environment. A forensic write blocker may be used by specialists during storage-media acquisition, but it is not a required consumer purchase and does not replace professional collection.
Do not open a suspicious executable, run a decryptor or upload samples to an online scanner from a production machine unless your responders have approved the method. Keep any collected sample in a controlled location with access limited to the response team.
Rank #2
- Includes Tableau T356789iu Forensic Universal bridge, TC2-8-R2, TC4-8-R2, TC6-8, TC-USB3, TC7-9-9 and USB B Male to USB 19 Pin Header Cable
- The Tableau Forensic Universal Bridge is an integrated write-blocker that mounts in a drive bay of a forensic workstation and supports forensic acquisitions of SATA, USB 3.0, PCIe, SAS, FireWire 800, and IDE.
- Mounts in one 5.25” half-height drive bay
- Color LED indicators for “Write Block” or “Read/Write” mode visibility
- USB 3.0 host computer connection, Two SATA power connectors
3. Start a time-stamped incident log
Create one controlled log as soon as the incident is suspected. The log is an operational record, not a place for speculation. Use a consistent time zone, identify the person making each entry and distinguish observed facts from working hypotheses.
- Record who first noticed the problem, what they saw and the exact date and time.
- List affected hosts, accounts, services, locations and backup systems as they become known.
- For every containment or recovery action, note the approver, operator, system, time, command or setting changed, and observed result.
- Record ransom notes, attacker contacts, reporting reference numbers and meetings with responders, counsel, insurers or regulators.
- Track who handled each collected file or device, where it is stored, and when it was transferred.
The official guidance identifies incident dates, scope, impact, contacts and evidence as important reporting information, but it does not prescribe a complete chain-of-custody protocol. Your counsel, forensic provider or applicable regulator may require additional forms, signatures, hashing or retention controls.
4. Preserve the extortion trail in its original form
Save the demand and every related communication before deleting spam, resetting accounts or negotiating. Preserve originals where possible, including message headers, timestamps, sender addresses, attachment metadata and the file path of a ransom note. Export a working copy for analysis and keep the original read-only or in a restricted evidence repository.
Record the attacker’s identifiers and demand
- Ransomware or extortion-variant name, if known.
- Encrypted-file extension and a safely handled sample of an encrypted file.
- Ransom-note text, screenshots and the original note file.
- Attacker email addresses, chat handles, websites and URLs. Do not click links merely to gather information.
- Cryptocurrency type, wallet address, payment instructions, transaction IDs and any decryptor files supplied.
- Demand amount, deadline, negotiation messages, payment decision and amount actually paid, if any.
Do not alter a ransom note to make it easier to read, rename the original attachment or copy attacker text into a new document as your only record. If a communication is available only as a screenshot, keep that screenshot and document how it was obtained.
5. Document infection, scope and business impact
Investigators and law-enforcement agencies need more than the ransom note. Build a factual picture of how the incident began, what it touched and what it cost operationally.
Rank #3
- Kit Includes: Tableau T6u Forensic SAS Bridge, TP2 Power Supply and Power Cord, TC-USB3 3.0 A to B Cable, TC4-8-R2 Unified SATA/SAS Signal Power Cable, T6u Quick Reference Guide, and TB1 Zippered Nylon Bag.
- Imaging speeds up to 200 MB/second
- USB 3.0 host computer connection
- User-switchable read-write mode via internal DIP switch supports wiping and formatting of SAS devices without the need of an expensive SAS controller card
- Integrated, backlit LCD presents useful bridge and SAS device information. Six LEDs provide status on power, host connection, SAS device detection, write-block status, and activity
Capture the incident timeline
- Date and time of suspected initial access, first malicious activity, encryption and discovery.
- Suspected attack vector, such as a compromised account, exposed service, phishing message or remote-access path, while labeling it as suspected until confirmed.
- Systems, users, facilities and data stores affected; systems checked and found unaffected; and whether the attacker still appears to have access.
- Host-based and network-based indicators, including filenames, hashes, domains, IP addresses, processes and persistence mechanisms supplied by responders.
- Actions already taken, such as isolation, credential resets, backup protection, restoration or communication with customers.
Describe operational and financial effects
- Services unavailable, degraded or operating manually.
- People, customers, patients, students or partners affected.
- Estimated loss, recovery expense, business interruption and other operational impact.
- Organization point of contact, technical contact and a secure method for follow-up.
Use estimates when exact figures are not yet available and label them as estimates. Update the report when facts change instead of guessing to fill a field.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall6. Report promptly through U.S. official channels
For a U.S. victim, the FBI identifies both a local FBI field office and the Internet Crime Complaint Center (IC3) as reporting routes. The joint FBI, CISA and Multi-State Information Sharing and Analysis Center advisory also names CISA’s Incident Reporting System, CISA’s 24/7 Operations Center and a local FBI field office. CISA’s general ransomware guidance additionally lists a local U.S. Secret Service field office.
| Channel | Use it for | What to do |
|---|---|---|
| FBI Internet Crime Complaint Center (IC3) | Detailed online ransomware complaint and evidence about the extortion | Provide the variant, extension, cryptocurrency details, attacker contacts, demand and payment status, then save the complaint reference |
| Local FBI field office | Direct law-enforcement coordination | Contact the field office serving your location and provide the incident log and secure point of contact |
| CISA Incident Reporting System | Cyber-incident reporting and federal coordination | Submit the current form through CISA’s official reporting page and retain the confirmation |
| CISA 24/7 Operations Center | Urgent coordination by email or phone | Use [email protected] or 1-844-Say-CISA (1-844-729-2472), and verify current details before sending sensitive material |
| Local U.S. Secret Service field office | Additional federal reporting route listed by CISA | Use the current field-office contact information for your area |
Portals, email addresses and telephone instructions can change. Confirm current contact details on the relevant agency’s official page immediately before submitting. Do not send passwords, private keys or unnecessary personal data in an initial report; ask the receiving agency how it wants sensitive evidence transferred.
What IC3 asks you to include
FBI guidance for a ransomware complaint calls for the variant name if known, encrypted-file extension, cryptocurrency type and address, attacker email addresses and URLs, ransom demand, and whether payment was made and in what amount. Include the incident timeline and your secure contact details so investigators can follow up.
Expanded material identified in the Medusa advisory
The FBI, CISA and MS-ISAC Medusa advisory, published March 12, 2025, gives a broader example of investigative material that may be useful:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Includes: Tableau T3iu Forensic SATA Drive Bay and 17" USB B to USB 19 Pin Header Cable
- The Tableau Forensic SATA Drive Bay is an integrated write-blocker that mounts in a drive bay of a forensic workstation and supports forensic acquisitions of 3.5” and 2.5” SATA hard drives.
- Mounts in one 5.25” half-height drive bay
- USB 3.0 host computer connection
- Read/write mode capability via internal DIP switch
- Boundary logs showing communications to and from foreign IP addresses.
- A ransom-note sample and attacker communications.
- Bitcoin wallet information, transaction IDs and any decryptor files.
- A benign encrypted-file sample.
- Organization point of contact, infection status, affected scope, estimated loss and operational impact.
- Infection and discovery dates, suspected initial attack vector, and host and network indicators.
This list describes information of interest, not a claim that every victim has every item or must disclose every item. Share voluntary information consistently with applicable state and federal laws, as the advisory instructs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.“Regardless of whether you or your organization have decided to pay the ransom, FBI, CISA, and MS-ISAC urge you to promptly report ransomware incidents to FBI’s Internet Crime Complaint Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center ([email protected]) or by calling 1-844-Say-CISA (1-844-729-2472).”
FBI, CISA and MS-ISAC, #StopRansomware: Medusa Ransomware, March 12, 2025
7. Treat payment as a separate legal and business decision
Reporting does not depend on whether the organization paid. The joint advisory explicitly urges reporting regardless of that decision. If payment is being considered, involve counsel, the insurer, qualified responders and any required compliance or sanctions specialists before transferring funds. Keep the decision, authorization, wallet address, transaction ID, amount and time in the incident log.
The FBI says payment does not guarantee that data will be returned and does not support paying a ransom. The joint advisory states: “The FBI, CISA, and MS-ISAC do not encourage paying ransoms as payment does not guarantee victim files will be recovered.” That statement is a warning about uncertainty, not individualized legal, sanctions, insurance or negotiation advice.
Best Value
- This comprehensive forensic imaging kit includes four different Tableau write-block bridges, a variety of adapters to support most common device interfaces, and durable SiForce Rugged Case.
- Tableau write-block bridges included: T8u (USB 3.0), T7u (PCIe), T35u (SATA/IDE), and T6u (SAS).
- PCIe Adapters (Compatible with T7u) Include: TDA7-1 PCIe Card SSD Adapter, TDA7-2 M.2 PCIe SSD Adapter, TDA7-3 Apple SSD 2013-2016 Adapter, TDA7-4 U.2 PCIE SSD Adapter, TDA7-7 Apple SSD 2016+ Adapter, PCIE-4 Tableau Pigtail Cable.
- Other Adapters/Components Include: Tableau TDA3-3 mSATA/m.2 SATA SSD Adapter (Compatible with T35u), SiForce USB Media Card Reader (Compatible with T8u), TC3-8 SATA Signal Cable, TC4-8-R2 Unified SAS Cable, TC5-8-2 SATA to 2M Drive Power Cable, TC6-8 IDE Cable, TC2-8-R2 Molex Drive Power Cable, TC-USB3 USB 3.0 A to B Cable (x2), TP2 Tableau Power Supply with A/C Power Cord (x2), and SiForce Rugged Case.
- Kit List: T8u, T7u, T35u, T6u, TKDA-PCIE-5PC (TDA7-1, TDA7-2, TDA7-3, TDA7-4, TDA7-7, PCIE-4), TC3-8, TC4-8-R2, TC5-8-R2, TC6-8, TC2-8-R2, TP2 + AC power cord (x2), TC-USB3 (x2),TDA3-3, SiForce USB Media Card Reader, and SiForce Rugged Case.
8. Coordinate with counsel, insurers and regulators
Ask counsel to identify the notification, privacy, sector, contractual and evidence-disclosure duties that apply to your organization and affected people. Engage the cyber insurer according to the policy’s notice and vendor requirements. Your sector regulator, state authorities, customers or partners may have separate reporting rules. The federal guidance summarized here does not establish a universal deadline or determine whether a particular event is a legally reportable breach.
Keep legal advice and factual evidence distinct in the record. Preserve messages that establish what was known and when, but avoid labeling an unverified theory as a conclusion. If counsel directs a special retention hold, follow it even after systems are restored.
9. Maintain evidence during recovery
Recovery can overwrite the same artifacts investigators need. Before reimaging or restoring a host, confirm that responders have completed the approved collection or have documented why collection is impossible. Preserve a forensic image or memory capture when feasible, retain relevant logs for the agreed period, and keep the original ransom materials separate from sanitized copies used for business analysis.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhen restoring from backups, record which backup was selected, its date, integrity checks, malware scanning results and the systems restored. Do not delete encrypted files solely because a clean copy exists; a benign sample may help identify the variant or support investigation. Continue updating the timeline with restoration milestones, new indicators and any evidence that the attacker retained access.
Quick Recap
10. Common mistakes and safer alternatives
- Turning off every machine: Isolate or disconnect where possible and let responders capture volatile evidence; shut down only when necessary to contain an otherwise uncontrollable threat.
- Using compromised email to coordinate: Move response discussions to a verified out-of-band channel.
- Editing or opening attacker files: Preserve originals and let trained personnel examine copies in a controlled environment.
- Waiting for a complete investigation before reporting: Submit known facts promptly and provide updates as the scope becomes clearer.
- Reporting only after payment: The FBI, CISA and MS-ISAC urge reporting whether or not payment was made.
- Assuming a decryptor proves recovery: Keep expectations realistic; payment or a decryptor does not guarantee that files will be recovered.
- Guessing legal deadlines: Ask counsel and relevant regulators about the rules for your jurisdiction, sector, contracts and affected data.
Immediate-action checklist
- Activate the incident-response and communications plans.
- Move sensitive coordination to an out-of-band channel.
- Assign an incident lead, evidence custodian and factual log owner.
- Contain affected networks and accounts without reflexively powering off hosts.
- Preserve memory, Windows Security logs, firewall buffers and other short-retention data.
- Have qualified responders collect system images, memory captures, logs and precursor malware where feasible.
- Save original ransom notes, messages, headers, URLs, wallet details, transaction records and encrypted-file samples safely.
- Record infection and discovery dates, suspected access path, scope, indicators, contacts and operational impact.
- Report promptly to IC3 or a local FBI field office, and to CISA through its Incident Reporting System or 24/7 Operations Center; use the local Secret Service field office route listed by CISA when appropriate.
- Coordinate legal, insurance, privacy, regulatory and sector-specific decisions before disclosure, payment or recovery actions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
