RIFO - Ransomware Induced File Operations

RIFO is a ransomware-induced file operations dataset collected using Event Tracing for Windows (ETW), a high‑performance logging framework that is agnostic to underlying storage hardware and capable of capturing highly granular file system events. The dataset records verbose file operation traces generated by ten distinct ransomware samples executed in controlled attack scenarios. To reflect realistic victim environments, each execution targets a diverse set of file types, enabling the dataset to capture representative ransomware behavior under varied and practical conditions.