“What do I run, and can I read it first?”
Triage and analysis scripts hosted here in plain text, and the outside tooling worth installing before you need it. Everything hosted is read-only on the target and short enough to read before you run it.
Hashes every file in a collection into a sha256sum-compatible manifest, refuses to overwrite one that exists, and on verification reports changed, missing and new files as the three different findings they are.
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
Other people's tools, chosen because they are free, maintained and do one part of a triage well. What each is for, where it fits, and the tools already on this site that run in your browser.
Normalises ISO times, Unix epochs, Windows FILETIME values and zone-less local times to UTC, keeps each original value beside the conversion so it can be checked, flags anything whose zone it had to assume, and never silently drops a row.
