Customer Exclusive: From Question to Evidence: Agentic Investigations with ARMOUR for FTK

Files are being encrypted. Critical systems are disrupted. Your team is containing a
ransomware attack—but urgent questions remain: Where did it start? Which endpoints
were affected? Was data stolen before encryption?

Join Exterro for a ransomware investigation that follows the evidence from the first alert
to a validated attack timeline. See how ARMOUR for FTK Central turns plain-language
investigative questions into governed forensic workflows, helping examiners collect
relevant endpoint artifacts, reconstruct attacker activity and deliver findings that inform
response decisions.
Attendees will learn how to:

• Translate urgent response questions into a focused forensic investigation.
• Use ARMOUR, FTK Central and FTK Connect to coordinate investigative work and
• Examine endpoint artifacts for evidence of initial access, lateral movement, encryption
• Correlate findings into an attack timeline and assess the scope supported by the
• Verify source artifacts and document findings with auditability and examiner control.