All resourcesIncident Response
The First Hour of a Ransomware Incident
What to do - and what not to do - in the first sixty minutes, with evidence preservation treated as a first-class objective.
· 6 min read · Placeholder Author - DFIR Practice - replace with your author details
Stabilise before you investigate
Containment and investigation compete for the same hour. Isolate affected segments, but avoid mass power-offs that destroy volatile memory you will need later.
Preserve evidence early
Acquire memory and relevant logs before remediation changes them. Hash at acquisition and record custody transfers; the value of an artefact collapses without a defensible custody trail.
Communicate deliberately
Set a single incident channel, a single decision-maker, and a cadence. Regulatory notification clocks may already be running - check your obligations with counsel early.
#DFIR#ransomware#playbook