← All Tools
IR Flow · interactive playbook
Ransomware Response
Guided triage, evidence gathering and recovery decisions for a suspected ransomware incident, structured on NIST SP 800-61 (detection & analysis → containment, eradication & recovery → post-incident).
Playbooks: Phishing Investigation Ransomware Response
⚠ Educational guidance only, not a certified procedure.
Follow your organisation's incident response plan, your legal and regulatory obligations, and your insurer's and counsel's instructions. Nothing you enter here leaves your browser. The case lives in memory only unless you tick "Keep this case in my browser"; closing the tab wipes it.