The first hour of a ransom note
A note is on a screen and files have new names. Record what you see and who you call before anyone clears the machine or restores a copy you have not checked.
Write the scene before you change it
Write the time, the host name, which folders changed, and the exact words of the note that name a contact. A photo of the screen is a record. A retelling in chat an hour later is not.
Leave the machine powered on and off the network if you can do that without guessing. Powering it off, or clearing the disk, throws away the memory and the files a responder still needs. This page does not tell you how to clear a disk. It tells you not to.
Who you call
Call the incident lead and the owner of the system. If the files include personal data, legal needs to know the clock has started. A public post and a payment decision come after that call, not before it.
Use a phone number you already had. A number printed on the note is not your incident bridge.
The copy you would restore
Ask whether a backup exists that the affected account could not change. Name the copy and the time it was made. Restoring from a disk the same account could reach can put the same problem back.
The restore drill is where you practice that question. Do it before you need the answer on a file server people are waiting on.
Evidence you can still read
Forensics is how you read a disk and a memory image after the first hour, not a substitute for the phone calls. The playbooks are the order of those calls. The first-hour lab is five decisions and what each one costs if you skip it.