Files are being encrypted. Critical systems are disrupted. Your team is containing a ransomware attack—but urgent questions remain: Where did it start? Which endpoints were affected? Was data stolen before encryption?

Join Exterro for a ransomware investigation that follows the evidence from the first alert to a validated attack timeline. See how ARMOUR for FTK Central turns plain-language investigative questions into governed forensic workflows, helping examiners collect relevant endpoint artifacts, reconstruct attacker activity and deliver findings that inform response decisions.

Attendees will learn how to:

• Translate urgent response questions into a focused forensic investigation.
• Use ARMOUR, FTK Central and FTK Connect to coordinate investigative work and reduce manual handoffs.
• Examine endpoint artifacts for evidence of initial access, lateral movement, encryption and possible data exfiltration.
• Correlate findings into an attack timeline and assess the scope supported by the evidence.
• Verify source artifacts and document findings with auditability and examiner control.

A product demonstration will bring the workflow to life. Leave with a practical approach to understanding the attack, establishing its scope and giving responders validated evidence for their next decision.