Ransomware Investigation for Offshore Teams: What to Preserve and What Clients Will Ask

ARA Industries / Forensics · Facts checked 11 November 2026 (PHT).

When ransomware hits, the natural instinct is to get everyone working again as quickly as possible. For an offshore or outsourced team serving an international client, recovery is only half of the job. The client will also want to know how the attackers got in, whether its data was taken, and whether the problem is really gone.

This guide is for IT, operations and data protection teams in Philippine offshore and outsourced operations, and for the international companies that rely on them. It covers what to preserve, why wiping too early causes problems, how investigators scope what happened before encryption, and the questions the client will ask. It is practical guidance from ARA Industries, not legal advice. For how attacks unfold, see our anatomy of a ransomware attack.

Prepare before anything happens

The investigation goes faster when a few things are in place beforehand. NIST's incident response guidance treats preparation as part of everyday risk management, and CISA's #StopRansomware Guide lists preparation steps such as offline backups and keeping logs for critical systems. [1][2]

• Offline, tested backups of critical systems and data. [1]
• Logs kept long enough to help. CISA suggests keeping and backing up logs for critical systems for at least a year where possible. [1]
• An asset list that maps each server, laptop and cloud account to the client it serves.
• Agreed contacts and reporting routes in the contract between the team and its client, including a channel that does not rely on the affected email system.
• A one-page plan: who isolates systems, who preserves evidence, who calls the client, and who you will call for forensic help.

What should be preserved first?

CISA's checklist starts with isolating impacted systems, and recommends using out-of-band communication, such as phone calls, so the attackers are not tipped off. [1] Once systems are isolated, preserve before you rebuild:

1. Isolate, don't power off by default. CISA advises powering devices down only if you cannot disconnect them from the network, because doing so loses evidence held in volatile memory. [1][3]
2. Image and capture memory on a sample of affected workstations, servers and virtual machines. [1]
3. Snapshot cloud volumes to get a point-in-time copy for later forensic review. [1]
4. Collect logs that expire, such as Windows Security logs, firewall buffers, VPN and identity provider sign-ins, and endpoint security alerts. [1]
5. Keep the ransom note and a sample of encrypted files, and record file names, times and affected shares.
6. Keep samples of suspicious tools or binaries found during triage. [1]
7. Write a timeline of what was noticed and every action taken, with times and the time zone.

Why is wiping or reimaging too early a problem?

Rebuilding is part of recovery, and CISA's guidance includes prioritising the restoration of critical systems on a clean network. [1] The risk comes from rebuilding everything before a sample has been preserved.

CISA notes that a ransomware event may be evidence of a previous, unresolved compromise, and that care must be taken to find earlier "dropper" malware before rebuilding from backups, to avoid re-infection. [1] If every affected machine is wiped first, the records that show the entry point, the accounts used and any data copied out may be gone. The client then gets recovery without answers.

Our analysis: the practical balance for most teams is to preserve a representative sample, including the first machine affected, a file server and any system that holds client data, then rebuild the rest in priority order.

How do investigators scope what happened before encryption?

Encryption is usually the last stage, not the first. CISA notes that attackers sometimes copy data out and then threaten to release it publicly to pressure victims into paying. [1] Scoping therefore looks back from the encryption to the first access:

Question	Where the evidence usually is
How did they get in?	VPN and remote access logs, identity sign-ins, email, exposed services
Which accounts did they use?	Domain controller and identity logs, new or elevated accounts [1]
Where did they go?	Endpoint telemetry, remote management tool use, internal connections [1]
Was data taken?	Unusual outbound volumes, file-transfer and cloud-sync tools, file-access records [1]
Which client data was involved?	Asset list, file shares and systems mapped to each client
Is access closed?	Persistence checks: scheduled tasks, services, remote tools, accounts

The report should state which systems and logs were examined, for which dates, and what was not available. A finding that no data transfer was seen applies to the evidence examined.

What notification questions come up?

Several sets of rules may apply at once, and the roles matter:

• Philippines: under NPC Circular 16-03, a personal data breach can be an availability breach (loss or unlawful destruction), an integrity breach or a confidentiality breach. The personal information controller notifies the NPC within 72 hours of knowledge or reasonable belief of a notifiable breach, and controllers are expected to make sure their processors report breaches to them. [4]
• European clients: under the GDPR, a processor notifies the controller without undue delay, and the controller notifies its supervisory authority, where feasible, within 72 hours. [5]
• US-listed clients: a material cybersecurity incident is generally disclosed on Form 8-K within four business days of the company determining that it is material. [6]
• Ransom payment questions: the US Treasury's Office of Foreign Assets Control has warned that facilitating ransomware payments can carry sanctions risks. [7] Any payment decision needs legal advice.

Our analysis: in a cross-border setup, the outsourced team usually holds the systems and logs while the client holds the notification decision. Clear, preserved evidence is what lets both meet their deadlines with facts rather than estimates.

What will the international client ask?

Expect precise questions. A clear report answers them directly:

1. Entry: how did the attackers get in, and when?
2. Scope: which systems, accounts and client environments were affected?
3. Data: was any client data accessed or copied out, and which categories?
4. Containment: when was the attack contained, and how do you know it is closed?
5. Recovery: what was restored, from which backups, and how were they checked?
6. Limits: what could not be examined, and how does that affect the conclusions?

How does ARA Industries help?

ARA Industries can arrange digital forensics and incident response for organisations in the Philippines and the international companies that work with them. With your written authorisation, we can help you preserve evidence while recovery continues, scope what happened before encryption, and report findings in a form your management, your DPO, your client, your insurer and legal counsel can use. Notification and legal decisions stay with you and your advisers.

ARA Industries is a registered WithSecure partner. To talk it through, contact ARA Industries. Please don't send evidence files, passwords or personal data in your first message; we will arrange a secure way to collect what is needed.

General guidance, not legal advice. Notification duties depend on your role, your contracts and the laws that apply to you and your clients.

Which sources support this guide?

All links checked 11 November 2026 (PHT).

1. CISA and partners: #StopRansomware Guide, Part 1 (preparation) and Part 2 (response checklist).
2. NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
3. NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, August 2006.
4. NPC Circular 16-03: Personal Data Breach Management.
5. GDPR Article 33: Notification of a personal data breach to the supervisory authority; official text at EUR-Lex.
6. US SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, 26 July 2023.
7. US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, 21 September 2021.