How to Investigate Ransomware Forensically