Separate confirmed reports from unknowns, review DSM patches and backups, and contain suspected encryption.