after a ransomware attack a forensics