Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Triage collection Pro

One PowerShell file that gathers the artifacts the playbooks reference, in order of volatility, using only what ships with Windows. Read-only. Nothing installed, nothing modified, nothing transmitted.

what it does, in order

The order is the whole design. Volatile first, because that evidence expires whether or not you were ready, and the filesystem last because it is still there tomorrow.

  1. 1

    Volatilegone on reboot

    Network connections with owning process · running processes with command lines · logged-on sessions · ARP · DNS cache · services

  2. 2

    Event logsrolling by size

    Security · System · Application · PowerShell Operational · Task Scheduler · WMI Activity · RDP · Defender

  3. 3

    Registrysaved, not copied

    SYSTEM · SOFTWARE · SAM · Amcache

  4. 4

    Filesystemstill here tomorrow

    Prefetch · scheduled task XML · WMI subscriptions · autorun keys · local accounts

  5. 5

    Manifestproves nothing changed after

    SHA-256 of every file collected, with sizes

why it writes elsewhere

The default is a folder on the Desktop, which is fine for a lab and wrong for a real collection. Writing to the disk you are collecting from consumes the unallocated space you may later want to carve, and every megabyte you write is a megabyte of somebody else’s deleted file you have just overwritten. Point -OutputPath at an external drive.

For the same reason: do not analyse the output on the host it came from. Copy it off, work on the copy, and keep the manifest with it.