# Enterprise Ransomware Investigation (lab)

> A pharmaceutical company's research archive is encrypted and every recovery point is gone. The board meets in eleven hours.

Canonical: https://codelivly.com/labs/ransomware-investigation

| | |
|---|---|
| Type | Investigation |
| Difficulty | Advanced |
| Points | 500 |
| Session length | 1 h |
| Completions | 2 |

A pharmaceutical company's research archive is encrypted and every recovery point is gone. The board meets in eleven hours. A first responder has already concluded the file server was the origin, on the strength of the earliest attacker event in a merged timeline. Check that conclusion before you build on it.

## Objective

Reconstruct a full intrusion backwards from its final act across five evidence sources, and learn the discipline that makes multi-source timeline work trustworthy: establish what time base each source is in before you merge any of them. You will also establish dwell time from first attacker action rather than from first alert, and read the ordering of backup destruction against encryption to judge intent.

## Tasks

1. Inventory your sources before reading any of them
2. Start at the end and work backwards
3. Establish what happened to the backups, and when
4. Find the true first attacker action
5. Fill in the middle: persistence and movement
6. Compute dwell time and map the impact

## Related

- [All labs](https://codelivly.com/practice?type=lab)