You want the computer working again, and cleaning it up erases the record of what happened.

What disappears first

NIST’s guide to integrating forensic techniques into incident response (SP 800-86) defines volatile data as data on a live system that is lost after the computer is powered down, or after the passage of time, or through other actions performed on it. It says that in many cases acquiring volatile data should take priority over non-volatile data. It also notes that even stored data can change, such as log files that are overwritten as new events occur.

In plain terms: what the computer is doing right now, and the most recent entries in its logs, go first. A hard drive keeps more, for longer.

Disconnect the network. Leave the power alone.

CISA’s ransomware guidance puts isolation first: take the network offline, unplug affected devices, or remove them from Wi-Fi. Powering off is a fallback, and CISA warns it loses the artifacts held in volatile memory. The FTC’s breach guide says the same thing for compromised equipment: disconnect it from the network, but keep it powered on until forensic investigators arrive.

NIST’s guide lists unplugging power and gracefully shutting down among the containment choices and says the decision depends on the organization’s policies and its assessment of the risk, so the right answer can differ. If you cannot reach anyone who can judge it, disconnecting the network cable is the step both CISA and the FTC agree on.

Before any reinstall, restore, or wipe

1. Photograph what is on the screen with a phone: the message, the pop-up, the ransom note, or the error. Include any date and time the computer shows.
2. Hold off on reinstalling Windows, restoring from backup, deleting files, or wiping the device until a copy has been taken. The FTC says not to destroy any forensic evidence during investigation and remediation.
3. Ask for a system image and a memory capture of a sample of the affected computers. CISA lists this when no immediate fix is possible, and the FTC advises hiring independent investigators who image affected systems.
4. Ask that logs be kept. CISA’s examples of evidence that is highly volatile or limited in retention include Windows security logs, firewall log buffers, and system memory.
5. If a computer is being replaced, set the old one aside, powered down and labeled, rather than recycling it or passing it on.

Mailboxes and cloud accounts

In a Microsoft 365 account, do not delete messages from the mailbox, including the ones sent in your name. Microsoft’s guidance for a compromised account says to review the audit logs from the start of the suspicious activity until you finish remediation, and to look at Sent Items and message trace for what was sent. Disabling the account and revoking its active sessions are recommended steps in the same guidance, and they do not require deleting anything.

For cloud servers, CISA recommends a volume snapshot, a point-in-time copy kept for later forensic review.

Write down what only people know

The FTC says to interview the people who found the problem and to document the investigation. Before memories shift, write down who noticed first, what time, what they saw, what they clicked or typed, and everything anyone has done to the computer since. A computer cannot tell an investigator that someone restarted it at 2 p.m. to see if it would help.

The tradeoff is real, and it is not yours alone

NIST’s guide acknowledges that collecting evidence takes effort, cost, and time, and that containment choices affect how the organization operates. A shop waiting to restore a machine loses working hours. Your insurer, your attorney, and whoever does the technical work should weigh in on how much to keep and for how long.

The copy is taken first because the original is the only place the answer to “what happened” exists, and a rebuild writes over it.

Related

• Ransomware After the First Hour: Scope, Restore, Evidence
• Cyber Insurance Claim: What to Do Before You Call Anyone
• What a Compromise Check Can and Cannot Show You
• What to Write Down Before You Call for Help

Sources

• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• CISA: #StopRansomware Guide
• CISA: I’ve Been Hit by Ransomware
• FTC: Data Breach Response, A Guide for Business
• Microsoft Learn: Respond to a compromised email account in Microsoft 365