Phase 1/6: Physical Containment
READYOpen 'invoice.pdf.exe' to inspect it. If malicious, physically disconnect the backup server immediately!
LOCAL_C:\
invoice.pdf.exe
passwords.txt
family_photo.jpg
tax_return.pdf
code_project.zip
db_dump.sql
Containment Dock
SERVER_Z:
passwords_bkp.txt
family_photo_bkp.jpg
tax_return_bkp.pdf
code_project_bkp.zip
db_dump_bkp.sql
system_image.iso