iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use the FortiGate as one source of evidence—not as proof that the firewall was compromised or that every other system is safe. Coordinate containment, preserve logs and other evidence, determine whether attackers stole data as well as encrypted files, then restore critical systems from a verified recovery point in a clean, isolated environment. Adapt each step to your incident-response plan, deployed FortiOS version, affected systems, and applicable jurisdiction.
Coordinate the response before taking disruptive action
Activate your organization’s incident-response plan and assign people to coordinate containment, evidence handling, technical recovery, and communications. Record observations and decisions before actions that could alter evidence, provided doing so does not delay urgent containment. Fortinet’s ransomware checklist cautions that actions can alert an attacker or limit later evidence collection and impact analysis.
Use a coordinated communication channel outside potentially affected systems when appropriate. An attacker may be able to observe organizational communications and react. Preserve relevant network-device, endpoint, and cloud logs promptly, especially where retention is short or data may be held in a volatile buffer. CISA’s September 2023 #StopRansomware Guide recommends retaining these records and using centralized log management to correlate activity.
Free tools Windows power users keep installed
One-click scans. No signup required.
Contain affected systems while preserving evidence
Identify affected hosts and isolate them from the network. If several systems or subnets are involved, network-level isolation may be necessary; coordinate changes so containment does not unnecessarily disrupt critical services or destroy useful evidence.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Preserve available memory, logs, system images, malware samples, and indicators with qualified responders where possible.
- Do not make powering down an automatic first step. CISA notes that shutting down a host that cannot be disconnected another way may stop spread, but can also destroy volatile infection artifacts and evidence. Make that trade-off deliberately.
- Keep containment decisions and their timing documented so investigators can interpret later gaps or changes in system and network records.
Build a timeline from multiple evidence sources
Use FortiGate records for network activity
Review available FortiGate traffic and security logs for permitted or blocked connections, unusual outbound activity, suspicious destinations, and activity near the first known encryption. Where records exist, examine relevant authentication and configuration events as well. FortiOS 7.4.4 documentation says logging records traffic that passes through, starts from, or ends on the FortiGate, along with actions taken during traffic scanning. It lists FortiAnalyzer, FortiAnalyzer Cloud, FortiGate Cloud, syslog, memory, and local disk among log destinations or storage options. These details are specific to the 7.4.4 documentation; consult the manual for the version actually deployed because available records and menus can differ.
FortiGate logs show only activity covered by the organization’s logging, retention, and inspection configuration. An absence of alerts does not establish that there was no compromise or data theft, and firewall records cannot demonstrate that every host is clean.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Correlate with endpoint, identity, server, and cloud records
Compare firewall observations with endpoint detection and response or antivirus telemetry; identity-provider and directory authentication; VPN or other remote-access records; server, email, cloud-storage, and backup logs. The goal is to identify initial access, affected accounts and systems, earlier malware, suspicious remote-management activity, lateral movement, persistence, and the likely period of attacker access.
Recommended Free Tools
Assess possible exfiltration as well as encryption. Fortinet’s ransomware checklist identifies large transfers at firewall edge devices and unusual server communications to cloud storage as possible indicators. A thorough assessment may require a digital-forensics team or incident-response consultant; the available logs and technical facts determine what can be established.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Determine the scope and whether decryption is an option
Establish which systems, accounts, and data were affected, when the attacker may first have gained access, and whether the incident involved data theft in addition to encryption. These findings inform containment, recovery-point selection, and any notification assessment.
CISA advises consulting law enforcement about possible decryptors: tools have been released for some ransomware variants where researchers found weaknesses. Availability depends on identifying the specific variant and checking trusted, current sources. The general guidance does not establish a decryptor for an unidentified incident.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choose and validate a recovery point
Do not assume that an online backup is intact or that a successful restore test alone makes a recovery point safe. Fortinet warns that attackers may corrupt online backups and that a backup created after attacker access may contain malicious content. CISA recommends keeping offline, encrypted backups of critical data and regularly testing their availability and integrity.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Confirm that the backup is operational and that its data integrity has been checked.
- Establish whether the restore point predates the earliest likely attacker access—not merely the moment files were encrypted.
- Consider whether the backup is offline and encrypted, and whether restore testing succeeded.
Treat these as separate checks: a usable backup may still be too recent to trust, while a suitable date does not by itself prove integrity.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Restore critical services in a clean environment
Use an asset list and service dependencies to decide what must return first. Restore from a validated recovery point into a clean or isolated environment, and rebuild systems when persistence cannot be confidently removed. Before reconnecting restored systems to production, monitor and validate them to reduce the risk of reinfection. CISA’s recovery guidance emphasizes keeping recovery systems clean and avoiding reinfection during reconnection.
Sequence restoration around the services and dependencies the organization has identified as critical; the guidance does not prescribe a universal order for every network. Keep affected systems isolated until the response team is satisfied with the checks required by the incident plan.
Handle notifications and post-incident follow-up
Use the incident and communications plans to inform appropriate internal stakeholders, insurers, and government or law-enforcement contacts. Involve legal counsel to assess whether regulated data or other circumstances create reporting duties. Those duties depend on the facts, sector, and jurisdiction; general guidance cannot determine them for an unidentified organization.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →After recovery, document lessons learned and update response plans and exercises. CISA’s #StopRansomware Guide and Fortinet’s ransomware checklist provide general operational guidance, not findings about a particular incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
