ransomware first response, contain before you touch anything

the moment you find ransomware, your instincts are wrong

every normal human reaction to finding a ransom note on the screen is the opposite of what you should actually do. you want to unplug it, shut it down, panic-google, maybe throw the laptop in a lake. all of that destroys evidence and doesn't stop the bleeding the way you think it does. there's an order of operations here, and it matters. containment first, forensics second, recovery last. skip a step and you either lose the ability to figure out what happened, or you make the outbreak worse.

isolate, don't power off

the first move is to cut the infected machine off from everything else it can talk to, without killing it. that means disabling the network adapter or pulling the network cable, not hitting the power button. ransomware that's still encrypting will keep encrypting whether the box is on the network or not, but the network is how it spreads to your other machines, your file shares, your backups if they're mapped. cutting that connection stops lateral movement without touching the running processes.

why not just power it off since that also stops it? because ram is volatile. the second you cut power, everything living in memory disappears, and that includes stuff you desperately want later: the decryption key sitting in process memory for some ransomware families, the malicious process itself, injected code, command and control connections, credentials the attacker used to move around. shutting down is basically shredding your own evidence before the investigators show up.

find patient zero by following the timestamps

once the bleeding is stopped, you need to know where this started and how far it's spread. the fastest way to do that on a single host is to sort encrypted files by modification time. ransomware works through a filesystem in a pattern, not randomly, so the earliest encrypted files point you toward the initial point of compromise, and the timeline tells you the blast radius. if you're doing this across a network, you're comparing encryption timestamps across machines to figure out which one got hit first and how it jumped from there. that's the difference between "we had one bad laptop" and "the ransomware has been sitting in our network for three weeks and this is just when it decided to detonate."

this is also where you'd look at things like new scheduled tasks, new admin accounts, and unusual outbound connections around that same time window, since ransomware crews love to establish persistence and steal data before they ever drop the ransom note.

capture memory before anything else touches the machine

before you reboot, before you run a cleanup tool, before you let anyone "just restart it and see if that helps," you need a memory image. tools like a memory acquisition utility (something like winpmem, or a dedicated forensic imager depending on your environment) let you dump the full contents of ram to an external drive. that memory dump can contain the malware's running process, network connections it had open, and sometimes encryption keys or credentials that never touch disk. once you reboot, all of that is gone forever. this step is boring, it takes time, and it's the single most valuable piece of evidence you'll have if law enforcement or an incident response firm gets involved later.

check your backups before you celebrate anything

while all of that is happening, someone needs to verify that your backups are actually offline and actually intact. ransomware operators specifically hunt for connected backup systems and encrypt or delete them first, because a working backup is the thing that removes their leverage. if your backup server was on the same network with a live connection, don't assume it survived. check it in isolation, confirm the data is readable and not encrypted, and only then start thinking about recovery.

the takeaway

ransomware response has an order for a reason: contain it so it can't spread, capture the evidence while it still exists, then recover once you actually understand what happened. protect yourself before any of this ever happens by segmenting your network so one infected machine can't reach everything else, keeping true offline or immutable backups that ransomware can't touch, and having a written incident response plan so nobody's making these decisions for the first time while panicking. the calmest response is the one you rehearsed before you needed it.