Should systems be rebuilt immediately after ransomware?¶
The practical answer¶
Rebuilding may be necessary, but immediate rebuilding can destroy evidence and obscure how the incident occurred.
The key evidential caution¶
The dangerous assumption is that restoring service and preserving evidence are always the same task.
They are not.
A rebuild may remove:
Key points¶
- malware
- memory artefacts
- active sessions
- persistence
- logs
- configuration changes
- staging files
- encrypted samples
- evidence of the access route
Investigators should balance operational urgency against evidential value.
Before rebuilding, consider preserving:
- representative affected systems
- disk images
- memory
- ransom notes
- malware and scripts
- account and authentication logs
- remote-access records
- network data
- backup-console activity
- security alerts
- response decisions
Not every device needs full preservation.
A proportionate strategy may preserve key systems while allowing wider recovery to continue.
Record which systems were rebuilt, when, by whom and from which source.
A clean rebuild can improve security, but it does not prove the offender’s access route was removed elsewhere.
Check accounts, tokens, remote tools, cloud permissions and management platforms as well.
Where immediate recovery prevents complete preservation, document the reason, the evidence lost and the alternative records retained.
Where several systems perform the same role, preserve at least one representative example from each materially different platform or stage of the incident. A server used for initial access, a system used for staging and a host used to deploy encryption may each preserve different evidence. Recovery planning should therefore be based on evidential function, not only device count.
Operational takeaway¶
Preserve representative and high-value evidence before rebuilding, then document every recovery action and verify that access routes outside the rebuilt device have also been removed.