Colonial Pipeline Ransomware (2021) — Volatile vs Non-Volatile Evidence

A ransomware gang accessed the network via a compromised VPN password. The forensic team had to collect volatile memory from domain controllers to extract encryption keys.

## Background

A ransomware gang accessed the network via a compromised VPN password. The forensic team had to collect volatile memory from domain controllers to extract encryption keys.

## Learning Objective
Distinguish between RAM, pagefiles, HDD, SSD, and cloud storage evidence, and prioritize collection.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: Colonial Pipeline Ransomware (2021) — Volatile vs Non-Volatile Evidence
- Year: 2021
- Domain: Cyber Forensics
- Difficulty: Advanced

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-colonial-pipeline

## Investigation Questions

1. What volatile evidence did the Colonial Pipeline RAM dump contain?
2. Why would shutting down the servers destroy the decryption key?
3. Distinguish between evidence found in RAM vs. on disk in this case.
4. How did the FBI use volatile memory analysis to avoid paying the ransom?
5. Design a forensic triage protocol for a ransomware incident.

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
If you shut down a compromised server to image the hard drive, you just lost the key to the castle.

## Forensic Takeaway
Volatile evidence (RAM) contained the unencrypted negotiation keys. Non-volatile (HDD) contained encrypted files. Collecting RAM first gave the FBI the decryption master key.