Ransomware Response, Breach Scoping, and Exfiltration Analysis

Ransomware and Data Breach Analysis for Notification Decisions

A ransom note proves an attacker was inside, but it says nothing about how they got in, how long they stayed or which records left the network. Global Digital Forensics establishes the initial access, the dwell time and the data actually staged and transferred, working from endpoint, identity, cloud and network evidence. Our examiners preserve that record while your team restores operations, so leadership, the insurer and the regulator all work from one account of what happened.

Get Incident Help Now Call (800) 868-8189

Incident response plan beside a hotline handset.

The first hours

Preserve the Evidence Before the First Restore

The pressure in the first hours is to get the business running again, and that is exactly when the evidence explaining the attack is easiest to lose. Memory disappears when a server is powered down, short retention logs roll over overnight, and a reimaged machine takes the attacker's tools and footprints with it. Call before the restore begins. We agree with your team who contains, who restores and who may touch production, capture memory and images from the systems that matter most, and log every response action beside the evidence timeline, so recovery and analysis run on the same clock instead of undoing each other.

Containment is only finished when the way back in is closed. While the restore proceeds we look for the persistence an attacker leaves behind, such as new administrator accounts, scheduled tasks, remote management tools and mailbox forwarding rules, and we bound the incident to the hosts and identities the evidence actually shows. Our work follows the incident handling lifecycle described in NIST SP 800-61 Revision 3, the NIST incident response recommendations.

A server about to be rebuilt is the most urgent call you can make. The 24/7 hotline is (800) 868-8189, and a memory image preserved now cannot be recreated after the restore. While you wait for the callback, our guide to the five mistakes that destroy digital evidence lists what not to do.

Which Records the Attacker Opened or Took

Many ransomware crews steal data before they encrypt it, and each act leaves different traces. We examine file access, staging directories, archive creation, cloud storage uploads and outbound transfers alongside the accounts and hosts involved, so encryption and exfiltration are each proven on their own evidence. Where the intrusion ran through Microsoft 365 or Google Workspace, the mailbox and tenant audit records are examined with the endpoints.

We then identify the personal information and protected health information inside the affected data and line that inventory up against the attack timeline. Confirmed access, records that were reachable and questions the surviving logs cannot answer are reported in separate categories, so nobody reads a possibility as a fact.

A Notification Scope Built on Evidence

Treating every record in the company as affected buries the real incident and can cost more than the breach itself. We help the legal team define the relevant data set, remove duplicates and identify the affected individuals the evidence supports, and we document why each record set was included or excluded. The result is a scope that is neither inflated nor understated.

Access matters as much as theft. Under the HHS HIPAA breach notification rule, an unauthorized acquisition, access, use or disclosure of protected health information can trigger the analysis, which is why our findings state what each account could reach as well as what it moved.

Findings Insurers and Regulators Can Test

Your report carries the technical conclusions, the supporting evidence, the timeline, the methods and the confidence behind each date, in a form counsel can use for regulatory filings, insurance claims and incident reporting. A supported conclusion is stated plainly and an open question is labeled as one, because a report that overstates its certainty does not survive the first hard question from a regulator or an opposing expert. Our examiners have answered those questions in federal and state courts.

If a notification decision is being made now, the first call names the evidence that will carry the scope.

Get Incident Help Now

The engagement

Six Tracks That Run While Operations Recover

A response that restores systems but destroys volatile evidence makes every later decision harder. The notification scope, the insurance claim, the regulatory filing and any litigation that follows all rest on a record that has to exist when someone asks for it.

We follow the intrusion across identity, endpoints, network, cloud and the affected business applications and produce an evidence based timeline and a decision log for leadership and the legal team. When the attack started with a compromised mailbox, our business email compromise analysis traces the account activity that opened the door.

Scope

Rapid forensic triage
Volatile and short retention evidence comes first, collected while containment and restoration decisions are still being made.
Endpoint and server analysis
Execution, persistence, credential theft, lateral movement and payload artifacts show how the attacker moved and what they ran.
Identity and cloud examination
Authentication, administrative, mailbox and tenant audit records show which accounts were used across the incident window and what they reached.
Network and security telemetry
Firewall, EDR, DNS, proxy and VPN records are correlated with the host findings so the timeline rests on more than one source.
Data access assessment
Every claim of access or exfiltration, the attacker's included, is tested against logs, staging artifacts and transfer records.
Legal and insurer reporting
The chronology, scope statements and briefings each audience needs are delivered on the legal, insurance and regulatory tracks in parallel.

All six tracks can start the day you call. Call (800) 868-8189 and tell us where the response stands.

Methodology

The Sequence Behind a Defensible Breach Account

Preserve: Memory, Logs and Images

We capture the evidence most likely to vanish while supporting safe containment, so recovery does not erase the explanation.
Scope: Hosts, Identities and Paths

We follow accounts, hosts, network paths and cloud events to bound the incident, so the affected systems are known rather than assumed.
Test: Every Claim Against the Record

The attacker's leak site claims and your own team's assumptions are both checked against the technical evidence.
Report: One Chronology for Every Audience

A dated chronology, findings and remediation evidence that insurers, regulators and courts can examine later.

Rather have the first call happen before the next incident? Forensic readiness and incident response planning puts log retention, backup owners and decision authority in place ahead of time.

Evidence commonly examined

What We Examine

The examination draws on memory, endpoints and affected servers, together with the identity, VPN and cloud audit logs that show which accounts were used and from where. EDR telemetry and firewall, DNS and proxy records corroborate the host findings, and the malware, scripts and persistence artifacts show what the attacker ran and left behind. Backup, restoration and response records complete the timeline, so a recovery action is never mistaken for attacker activity.

What you can expect

For an active incident call (800) 868-8189 at any hour, or send the details.

What Your Report Establishes

You receive an evidence and decision log, an initial access and activity timeline with the confidence behind each entry, an assessment of affected systems and data that separates confirmed, possible and unknown, and a technical report with briefings for the executives and counsel who decide what to notify, what to claim and what to tell the regulator.

If your insurer has already sent a document request, we map each item on it to the evidence that supports it.

Examiners Who Have Defended Their Findings Under Oath

GDF pairs incident response with courtroom forensics, so the record we build while you recover is the record we could explain to a regulator, an insurer or a jury. Robert Knudsen has carried hundreds of computer and mobile device examinations through federal and state court matters across eighteen years, and Joseph Caruso, founder, CEO and CTO, counts cybersecurity incident response among the work of a technology career that began in 1980. Read the examiner biographies.

To put a senior examiner on this part of the matter, request a free consultation.

Frequently asked

Rebuild, Pay or Preserve: Ransomware Decisions

Should we rebuild affected systems immediately?

Restore what the business needs, but capture memory, images and logs from the affected systems first wherever you can, because a rebuilt machine takes the evidence with it. Call us before the restore and we will agree the sequence with your response lead so recovery and preservation move together.

What if the logs that would show data theft are gone?

Missing logs narrow the evidence; they do not end the analysis. Staging folders, archive tools, cloud sync records, firewall byte counts and the attacker's own leak site claims can all show what was taken. We report what each source shows and where coverage runs out, so every decision rests on an accurate record.

Do you work with breach counsel and cyber insurers?

Yes. We work alongside breach counsel and insurers, delivering the technical facts, the timeline and the scope in the form each one needs for regulatory assessments, claims and incident reporting. The hotline is answered 24/7 when they need us on the call.

Should we talk to the attacker or pay the ransom?

We give leadership, the legal team and the insurer the facts that decision turns on: whether backups are intact and restorable, what data the attacker can actually prove they hold, and whether they still have access. Those three answers set the real value of anything the attacker is offering.

Incident intake

Start the Record Your Insurer and Regulators Will Need

Tell us which systems are affected, what has already been restored and who needs the answers. For an active incident, call the hotline now.

GDF has operated since 1992, and our 24/7 hotline reaches a practice that includes court tested experts.

Get incident help now

Find Out What Happened Before You Have to Explain It

The first call reaches an examiner who will ask what happened, which systems are affected and what has already been rebuilt, then set preservation priorities with your team before the next machine is touched. That first consultation is free, and the hotline is answered around the clock.

Get Incident Help Now Call (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.

Ransomware and Data Breach Analysis for Notification Decisions

Preserve the Evidence Before the First Restore

Which Records the Attacker Opened or Took

A Notification Scope Built on Evidence

Findings Insurers and Regulators Can Test

Six Tracks That Run While Operations Recover

Rapid forensic triage

Endpoint and server analysis

Identity and cloud examination

Network and security telemetry

Data access assessment

Legal and insurer reporting

The Sequence Behind a Defensible Breach Account

Preserve: Memory, Logs and Images

Scope: Hosts, Identities and Paths

Test: Every Claim Against the Record

Report: One Chronology for Every Audience