Example Recovery Checklists
Industry Example: Infected Workstation
This is a starting point for a company checklist. A real one should match the company's own incident response plan, tools and contacts.
1. Report and identify
- Record who reported the problem, when, and what they saw
- Assign one person to lead the incident
- Open an incident ticket and start a timeline
2. Contain
- Disconnect the computer from the network (unplug the cable or turn off Wi-Fi) but leave it powered on
- Disable the user's account or reset their password from a clean computer
- Block any known bad IP addresses or domains at the firewall
- Check whether other computers show the same signs
3. Preserve evidence
- Photograph the screen, including any ransom note or error message
- Capture a memory image if you have the tools and training
- Export the logs (firewall, antivirus or EDR, sign-in logs)
- Record chain of custody for any drive that is removed
4. Notify
- Management, following the incident response plan
- Legal or compliance staff if sensitive data may be involved
- The cyber insurance provider, before hiring outside help, since many policies require this
- Law enforcement, if needed
5. Remove and rebuild
- Decide whether to clean or rebuild (rebuild if in doubt)
- Wipe the computer and reinstall from a current known good image
- Install all patches before reconnecting it to the network
- Restore data, not programs, from a backup taken before the infection, and scan it first
6. Verify and return to use
- Scan with at least two different tools
- Monitor the computer's network traffic for 48 to 72 hours
- Have the user sign in with a new password and MFA
- Confirm with the user that everything they need works
7. Close out
- Finish the incident report and timeline
- Hold a blameless lessons learned meeting within two weeks
- Update this checklist and any training
Personal Example: Your Own Computer or Phone
- Disconnect from Wi-Fi and unplug any network cable
- Don't pay anything, and don't call any phone number shown in a pop-up
- From a different device you trust, change your email password first, then banking, then everything else. Turn on MFA as you go
- Check your email settings for forwarding rules or a changed recovery phone number or email address
- Check your bank and card statements. If anything looks wrong, call the number on the back of your card
- Run a full scan with your antivirus, such as Windows Security or the free version of Malwarebytes
- If problems continue, copy your personal files (documents and photos only) to a backup and factory reset the device
- Restore your files and reinstall apps from official app stores only
- Tell friends and family if your accounts sent strange messages
- Report fraud at ReportFraud.ftc.gov, and if your identity was stolen, go to IdentityTheft.gov