Abstract: Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and/or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and/or compromised systems.

Abstract: Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and/or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and/or compromised systems.