[CaliforniaKarl]

Yup. Records of inbound/outbound connections might be enough.

[hsbauauvhabzb]

If a network has been built such that your backups can be compromised by ransomware, I’d doubt network traffic is logged to an immutable store, if at all.