INCIDENT RESPONSE · BOCA RATON, FL
Ransomware Incident Response in Boca Raton and South Florida
If your files are encrypted right now and a ransom note is on the screen, stop and read this section before you touch another machine. What you do in the next sixty minutes will decide what evidence you still have tomorrow.
Enetsec is a digital forensics laboratory in Boca Raton, Florida that responds to active ransomware attacks. Call (561) 846-9010 before you restore, rebuild or wipe anything. Founder Wanderson Castilho has analyzed more than 6,000 cases since 1999 and has given 40 depositions in the past four years.
Most of the damage we see is not caused by the attacker. It is caused by well-meaning people trying to fix things fast. Servers get rebooted. Backups get restored over live disks. Someone wipes a workstation to “clean it.” Each of those actions destroys the record of what happened.
What to Do in the First Hour
Work through this list in order. Do not skip ahead.
-
Disconnect, but do not power down
Pull the network cable or disable the wireless adapter on affected machines. That stops the spread. Do not shut the machine down and do not pull the plug. Volatile memory holds encryption keys, running processes, and active network connections, and all of it disappears the moment power is lost. In our experience, the memory image taken from a still-running machine is often the single most useful piece of evidence in the entire case.
-
Leave the ransom note where it is
Photograph it. Do not delete it, do not close the window, do not rename the file. The note carries the strain identifier, the payment channel and often a case reference the attacker uses to track your organization. That is investigative material.
-
Stop the restore
This is the hardest instruction to follow and the most important one. Restoring from backup writes over the disk you need to examine. If you restore before the disk is imaged, you have chosen recovery over knowing what happened, and you usually cannot have both after that point.
-
Preserve the logs before they roll
Firewall logs, VPN logs, domain controller logs, email gateway logs and endpoint telemetry all have retention windows. Some roll over in seven days. Some roll over in twenty-four hours. Ask your IT team to export and hold everything immediately, and tell them not to clear anything.
-
Call someone who can testify about what they found
Then call us at (561) 846-9010. We will tell you on that first call what to freeze and what you can safely keep operating.
What Not to Touch
Do not log into affected servers with a domain administrator account. Do not run antivirus removal tools on the compromised hosts. Do not reimage anything. Do not open a suspicious attachment “to see what it does.” Do not negotiate with the attacker before you know the scope, because you cannot value a negotiation when you do not yet know what was taken.
And do not delete the mailbox rules you find. Attackers commonly plant inbox rules to hide their own traffic. Those rules are dated, attributable artifacts.
Why Evidence Degrades From the Moment an Incident Starts
Digital evidence is not stable. It decays on a clock, and the clock starts when the intrusion starts.
Memory is gone at the next reboot. Free space that still holds deleted file fragments gets overwritten by ordinary background activity. Log files rotate on schedule. Cloud tenants purge sign-in telemetry on their own retention policies, and no support ticket brings it back. Shadow copies get deleted by the ransomware itself as a first step.
FROM THE CASELOAD
We have handled cybercrime response since 1999, and the pattern is consistent: the organizations that end up with a defensible answer are the ones that made preservation the first decision instead of the last one (Source: Enetsec, from the 6,000+ cases we have analyzed since 1999).
Call Before You Rebuild, Restore or Wipe
There is a sequence that works, and rebuilding is not the first step in it.
First, preserve. Forensic images of affected systems, memory captures where machines are still live, log exports held with hash values. Second, contain. Third, determine scope. Fourth, rebuild and restore into a clean environment.
Run in that order and you can rebuild without losing the ability to answer questions later. Run it backwards and you will be asked, by an insurer, a regulator, a customer or a court, what data left your network, and your honest answer will be that you no longer know.
Containment Without Destroying the Record
Containment and preservation are often treated as opposites. They are not, if you plan the order.
We isolate at the network layer rather than at the host layer wherever possible. Segment the affected subnet, disable the compromised accounts, revoke the active sessions and rotate credentials from a clean administrative workstation. That halts the attacker’s access while leaving the evidence on the endpoints intact.
Where a machine must be taken out of service, we image it first and take it offline second. It costs an hour. It saves the case.
Determining Scope: What Was Taken, Not Just What Was Locked
Encryption is the loud part of a ransomware event. Exfiltration is the expensive part.
Most modern ransomware operations copy data out before they encrypt anything, so that they still have leverage if you restore cleanly from backup. That means the question your board, your insurer and your counsel will ask is not “are we back up.” It is “what left the building.”
THE LIMIT
Answering that takes outbound traffic analysis, staging directory identification, archive artifacts left on the host, cloud audit logs and account activity review. We reconstruct what was accessed, what was collected, what was moved and when. Where the record supports a conclusion, we state it. Where the record does not, we say that too, and we say why. An examiner who overstates is an examiner who gets excluded.
Evidence Preservation During an Active Event
Everything we collect during a live incident is handled under documented chain of custody from the moment of acquisition. Images are hashed at collection and verified at every transfer. Working copies are examined, never originals. Every step is logged with a time, a tool version and an examiner name, so the process is reproducible by another qualified examiner.
That matters because a ransomware event rarely ends when the systems come back. It continues into an insurance claim, a regulatory notification, a customer dispute or litigation. The evidence you collected in hour one is what you will be standing on in month nine.
An IT Provider and a Forensics Laboratory Do Different Jobs
Your IT provider is very good at getting you running again. That is the job they are hired for, and after an attack you need them.
But restoring service and producing court-admissible evidence are two different disciplines with two different priorities. Recovery wants the machine back in production. Forensics wants the machine untouched. When one team is asked to do both, evidence loses, because the pressure in the room is always to get the business working.
We do not replace your IT team. We work alongside them, and we take the evidence side of the incident so they can take the recovery side. What we produce is a documented, reproducible examination and a written report from a certified examiner who can be deposed on it. Wanderson Castilho, founder of Enetsec, is Cellebrite, AccessData and Certified Computer Examiner (CCE) certified, holds a BSc in Physics from the Federal University of Paraná, and has given 40 depositions in the past four years (Source: SEAK Expert Witness Directory).
What Our Clients Say
ON THE RECORD
“They quickly assessed the extent of the breach, explained the risks in a way we could easily understand, and immediately got to work.”
Go Deeper
Identification of the Origin of Internet Attacks.
Containment tells you the attack stopped. Attribution tells you how it got in, which credential was used, and whether the same access still exists somewhere you have not looked. In several matters the initial access point was a months-old account nobody had disabled.
Read about the identification of the origin of internet attacks. 02Digital Security.
Most of the organizations that call us during an attack had at least one warning signal in their logs weeks earlier that nobody was reading. Assessment work is largely about finding those signals before an attacker uses them.
Read about our digital security services.Frequently Asked Questions
NO. 1 What should I do right now to preserve evidence?
Disconnect the affected machines from the network but leave them powered on. Photograph the ransom note and do not delete it. Tell your IT team to export firewall, VPN, domain controller and cloud sign-in logs immediately and to clear nothing. Do not restore from backup, do not reimage, and do not run cleanup tools on the affected hosts. Then call (561) 846-9010. Every one of those actions takes minutes and each one preserves evidence that is otherwise gone within days.
NO. 2 What are your evidence handling procedures?
We acquire forensic images and hash them at the point of collection. Original media is sealed and stored; all examination happens on verified working copies. Every acquisition, transfer and analysis step is logged with a timestamp, the tool and version used, and the examiner responsible. Hash values are re-verified at each handoff so any alteration would be immediately detectable. The result is an examination another qualified examiner can repeat and reach the same findings from.
NO. 3 How do you maintain chain of custody?
With a written custody record that begins the moment we take possession of a device, an image or a log export, and never has a gap. It records who held the item, when, where it was stored, and why it moved. Storage is access-controlled. Transfers are signed. If a device is shipped, it is sealed and tracked. Chain of custody is the first thing opposing counsel attacks, so we document it as though it will be challenged, because it usually is.
NO. 4 How long does a digital forensic examination take?
For an active ransomware event, preservation happens the same day and a preliminary scope picture usually forms within the first three to five days. A full written report typically takes two to four weeks. The variables are the number of systems involved, whether cloud tenants are in scope, log retention on your side, and encryption on the acquired media. We give you a timeline in writing after the initial acquisition, not before it, because a date given before we see the environment is a guess.
NO. 5 Can an investigation begin remotely?
Yes, and in a ransomware event it usually does. We start on the phone with preservation instructions, then move to remote acquisition of cloud logs, email tenant records and endpoint telemetry. Remote collection is performed with documented tooling and hashed at capture, so it holds the same evidentiary standard as onsite work. Where physical media must be imaged, we come onsite in South Florida or arrange sealed, tracked shipment to the laboratory in Boca Raton.
NO. 6 What makes an independent examiner different from a law enforcement examiner?
Timing, scope and availability. Law enforcement examiners work criminal matters on a criminal caseload and their queue is set by prosecutors, not by you. An independent examiner starts when you call, examines the questions you and your counsel need answered, and produces a report you control. We also work civil and internal matters that law enforcement will not open at all. The standards for handling and documentation are the same. The difference is who sets the priority.
Talk to Us Before You Rebuild
If an attack is active, call (561) 846-9010 now and we will walk you through preservation on that call, at no charge, before anything else is decided. If you are past the immediate event and need to know what left your network, we can still work from what remains. Reach us through our contact page or call the laboratory in Boca Raton directly.
Call (561) 846-9010, email [email protected], or start at /contact-us/. Trace how the intrusion began with identification of the origin of internet attacks, or close the gaps it used with our digital security assessment work.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES