Investigating Data Breaches and Ransomware
Where you are: Part V — Forensics in Practice: Scenarios, Software and Business Cases · Lesson 5.1 · This lesson follows Chapter 9 (scenarios 1, data breach investigation, and 6, ransomware attack investigation) of Dr. Al-Doori's IT Forensics Essentials.
What you'll be able to do
By the end of this lesson you will be able to plan the forensic side of the two incidents organizations fear most.
- List the investigative actions for a data breach and what each one answers.
- Plan a ransomware investigation, including indicators of compromise and recovery.
- Explain how forensics informs, but does not make, the decision about paying a ransom.
Chapter 9: Forensics Meets the Real World
Chapter 9 moves from techniques to scenarios: real-world situations where forensic tools and methods are applied to cybercrime, breaches and other illegal activity. In each scenario the work follows the same pattern you learned in Part I, with identification, preservation, analysis and presentation done to legal and professional standards. This lesson covers the two incident scenarios. Lessons 5.2 and 5.3 cover the scenarios centered on people and on legal cases.
Scenario: The Data Breach
The situation. A company discovers that sensitive customer data, such as personal identification information or card numbers, has been compromised, perhaps by hackers, perhaps by an insider. Forensic experts are brought in to find the source, the method and the scope.
The actions the book lists, and the question each answers:
| Action | What it involves | The question it answers |
|---|---|---|
| Data collection | Logs, network traffic and system images from affected servers and devices | What evidence do we have, and is it preserved? |
| Network forensics | Analyzing traffic to track unauthorized access | How did the attacker get in and move around? |
| File and log analysis | File system and application logs for unusual access or malicious activity | What was touched, by whom, and when? |
| Incident timeline | Reconstructing the sequence of events | When did it start, and how was it carried out? |
The outcome. Investigators can determine whether an external attacker exploited a weakness or whether an insider was involved. The findings are documented both for possible legal action and to improve the organization's security.
Scenario: Ransomware
The situation. Attackers encrypt a company's valuable files and demand payment for the decryption key. The book says forensic teams are called in to identify the attack's origin and to help determine whether paying the ransom is necessary.
The actions the book lists:
- Malware analysis. Examine the ransomware to identify its type and its indicators of compromise (IoCs): observable traces such as IP addresses, file names, hashes or the encryption method. IoCs let defenders search other systems for the same attack.
- Network forensics. Trace how the attackers got in: a phishing email, an unpatched vulnerability or an exposed remote desktop protocol (RDP) service.
- File recovery. Recover files from backups or with recovery tools, while preserving the integrity of the evidence.
- Preventive measures. Work out how the ransomware gained access, for example through phishing or weak passwords, and recommend improvements.
The outcome. The analysis tells the company where the attack came from, whether paying is advisable and how to prevent a repeat. If the attackers are identified, law enforcement may become involved.
Real-World Example
Imagine (a fictional scenario) a manufacturer whose file servers are encrypted overnight, with a note demanding payment. The forensic team preserves memory and disk images from two affected servers before rebuilding begins. Analysis finds the ransomware's executable, its hash and the address of the server it contacted. Those are IoCs, which the IT team uses to check every other machine. The logs show the first entry 19 days earlier: repeated failed sign-ins to an RDP service exposed to the Internet, then a success with a former employee's account that had never been disabled. Firewall logs show 40 GB sent out of the network the night before the encryption, so data was probably stolen as well as encrypted.
That last finding changes the business's decisions. Restoring from backups solves the encryption, but not the stolen data, which may now trigger legal notification duties. The forensic report gives the board facts, not guesses.
From the Book to 2026
What the book teaches. Breach investigations combine data collection, network forensics, file and log analysis and a timeline. Ransomware investigations add malware analysis, IoCs, network tracing, file recovery and prevention, and help decide whether paying is necessary.
Why it made sense. These actions remain the core of every breach and ransomware response.
What has changed. Ransomware has evolved. CISA's #StopRansomware Guide describes attackers who steal data and then threaten to publish it to pressure victims; combined with encryption this is called double extortion, and some attackers now skip encryption altogether and extort with stolen data alone. So "can we restore?" is no longer the only question. "What did they take?" matters just as much. On payment, the general advice of No More Ransom, a project backed by Europol and the Dutch police, is not to pay: payment confirms that ransomware works and gives no guarantee of getting a key. The site also offers free decryption tools for some ransomware families. Paying is ultimately a business, legal and ethical decision for the organization's leaders and advisers. Forensics supplies the facts they need. Breaches of personal data may also trigger legal duties: under the EU's GDPR, for example, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people.
What to do now. In every ransomware case, investigate exfiltration as well as encryption, preserve evidence before rebuilding, check No More Ransom for a free decryptor, involve law enforcement and legal advisers early, and keep the facts separate from the payment decision.
What Would You Do?
The board of the manufacturer above asks you directly: "Should we pay?" What can you, as the forensic investigator, properly tell them, and what is not your decision? Decide, then compare with the model answer in the note below.
Knowledge Check
Which of these is an indicator of compromise (IoC)?
Why should investigators look for data exfiltration in a ransomware case?
In the book's data breach scenario, what does an incident timeline mainly establish?
Answers explained
- Question 1: d. File hashes, IP addresses and similar traces are IoCs, which defenders can search for on other systems.
- Question 2: b. Double extortion means stolen data can be published even after systems are restored. Exfiltration is common (a is wrong).
- Question 3: c. The timeline pinpoints when the breach occurred and how it was executed. Identifying an attacker's home address (d) is rarely possible from a timeline alone.
On "What Would You Do?": Give them facts: how the attackers got in, whether they are still present, what was encrypted, what was probably stolen, whether clean backups exist and how long restoring will take, and whether a free decryptor exists for this ransomware. Tell them that general advice from law enforcement initiatives is not to pay, and recommend that they consult legal counsel and law enforcement. The decision to pay belongs to the organization's leadership, advised by lawyers, not to the forensic examiner.
Key Takeaways
- Breach investigations: collect and preserve, analyze network traffic, files and logs, and build a timeline, then document for legal action and improvement.
- Ransomware investigations: analyze the malware and its IoCs, trace the entry point, recover files with evidence preserved, and recommend prevention.
- Modern ransomware often steals data too (double extortion). Investigate exfiltration, not just encryption.
- Forensics informs the payment decision with facts. The general advice is not to pay, and the decision belongs to leadership and legal advisers.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 9 (scenarios 1 and 6)
- CISA, MS-ISAC, FBI and NSA — #StopRansomware Guide (September 2023)
- No More Ransom (Europol, Dutch police and partners)
- EUR-Lex — Regulation (EU) 2016/679 (GDPR), Article 33: notification of a personal data breach
- NIST — SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)