What evidence may show the sequence of a ransomware incident?¶
The practical answer¶
A ransomware incident should be reconstructed as a sequence rather than one single event.
The key evidential caution¶
The dangerous assumption is that the time files became encrypted marks the beginning of the incident.
The offender may have been present much earlier.
Relevant stages may include:
Key points¶
- initial access
- credential theft
- remote access
- privilege escalation
- discovery
- lateral movement
- security-tool tampering
- backup access
- data collection
- staging
- exfiltration
- encryption
- ransom-note creation
- extortion contact
- payment activity
Evidence to preserve¶
Investigators should preserve exact timestamps, time zones, account context, system identifiers and links between events.
The first visible impact may occur days or weeks after the first foothold.
Evidential limits¶
Do not force every event into one continuous session.
Several accounts, devices or operators may be involved.
Likewise, some stages may be absent, unrecorded or performed automatically.
The strongest reconstruction links source and target systems, accounts, process chains, file activity, network records and communications.
Where the first access route remains uncertain, report the earliest supported event and the available alternatives.
Use system-by-system timelines where the environment is large. One host may show initial access, another staging and a third encryption deployment. A single organisation-wide timestamp can hide these differences and create false precision.
Where clocks differ across systems, preserve the original time zones and any known drift. Encryption deployed simultaneously through a management platform may still appear at slightly different times on each host.
This preserves the sequence without inventing exact simultaneity.
Operational takeaway¶
Reconstruct ransomware from first supported access through disruption and extortion, and keep event, detection and response times separate.