Evidence Preservation

# Memory acquisition with WinPmem
# Run from a USB drive or network share to avoid writing to the target system

# WinPmem acquisition — outputs to specified destination
$destination = "D:\evidence\HOSTNAME-2026-09-20\memory.raw"
$winpmem = "D:\tools\winpmem_mini_x64_rc2.exe"

# Start acquisition — this takes 5-15 minutes depending on RAM size
& $winpmem $destination

# Verify acquisition completed and hash the output
$hash = Get-FileHash -Path $destination -Algorithm SHA256
Write-Host "Memory image: $destination"
Write-Host "SHA-256: $($hash.Hash)"
Write-Host "Size: $((Get-Item $destination).Length / 1GB) GB"

# Document in chain of custody log
$logEntry = [PSCustomObject]@{
    Timestamp     = (Get-Date -Format "yyyy-MM-dd HH:mm:ss UTC")
    Investigator  = $env:USERNAME
    Host          = $env:COMPUTERNAME  # Host you're acquiring FROM
    Action        = "Memory acquisition"
    OutputFile    = $destination
    SHA256        = $hash.Hash
    ToolUsed      = "WinPmem mini x64 rc2"
}
$logEntry | Export-Csv -Path "D:\evidence\chain-of-custody.csv" -Append -NoTypeInformation

# Full disk acquisition on Linux using dc3dd (forensic dd)
# dc3dd adds hashing, progress reporting, and output splitting

# Identify the target drive
lsblk
# → sda: 500G — OS drive (target)
# → sdb: 2T  — evidence drive (destination)

# Mount evidence drive
mount /dev/sdb1 /mnt/evidence

# Acquire with dc3dd — hashes while imaging, splits at 4GB for FAT32 compat
dc3dd \
  if=/dev/sda \
  of=/mnt/evidence/HOST-server01-2026-09-20.dd \
  ofsz=4G \                # split into 4 GB chunks
  hash=sha256 \            # hash while imaging
  log=/mnt/evidence/HOST-server01-acquisition.log \
  verb=on                  # progress output

# dc3dd automatically appends hash to the log file
# Verify: dc3dd if=/mnt/evidence/HOST-server01-2026-09-20.001 hash=sha256

# For E01 format on Linux: use ewfacquire (libewf-tools)
ewfacquire \
  -t /mnt/evidence/HOST-server01-2026-09-20 \
  -f encase6 \
  -C "server01.corp.local" \
  -D "Finance server — confirmed compromise 2026-09-20" \
  -e "analyst@corp.local" \
  /dev/sda

:: KAPE triage collection — key forensic artifacts from live system
:: Run from USB drive; writes to separate evidence drive

:: Variables
set KAPE=D:\tools\kape\kape.exe
set TSOURCE=C:
set TDEST=E:\evidence\HOST-%COMPUTERNAME%-%DATE%\triage
set MDEST=E:\evidence\HOST-%COMPUTERNAME%-%DATE%\modules

:: Collect target artifacts (filesystem collection)
%KAPE% --tsource %TSOURCE% --tdest %TDEST% ^
  --target !SANS_Triage ^
  --tflush

:: Module processing (runs EZTools parsing on collected artifacts)
:: This parses MFT, registry hives, event logs into readable CSV
%KAPE% --msource %TDEST% --mdest %MDEST% ^
  --module !EZParser ^
  --mflush

:: !SANS_Triage includes:
::   - MFT ($MFT)
::   - Windows Event Logs
::   - Registry hives (SYSTEM, SOFTWARE, SAM, SECURITY)
::   - NTUSER.DAT per user
::   - Prefetch
::   - LNK files and Jump Lists
::   - Shellbags
::   - Scheduled Tasks
::   - PowerShell history
::   - Browser artifacts (Chrome, Edge, Firefox)
::   - SRUM database
::   - Amcache.hve / Shimcache

echo Collection complete. Artifacts in %TDEST%
echo Parsed output in %MDEST%

# Live response collection — run BEFORE memory acquisition, BEFORE any shutdown
# Output to evidence drive, not local disk

param([string]$OutputDir = "D:\evidence\live-response")
New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null

$ts = Get-Date -Format "yyyyMMdd-HHmmss"

# Running processes (full detail)
Get-Process | Select-Object Id,Name,Path,CPU,WorkingSet,StartTime |
  Export-Csv "$OutputDir\processes-$ts.csv" -NoTypeInformation

# Process with command line (requires WMI)
Get-WmiObject Win32_Process |
  Select-Object ProcessId,Name,CommandLine,ParentProcessId |
  Export-Csv "$OutputDir\process-cmdlines-$ts.csv" -NoTypeInformation

# Network connections
netstat -anob 2>&1 | Out-File "$OutputDir\netstat-$ts.txt"

# Logged-on users
query user 2>&1 | Out-File "$OutputDir\loggedon-$ts.txt"

# ARP cache
arp -a 2>&1 | Out-File "$OutputDir\arp-$ts.txt"

# DNS cache
ipconfig /displaydns 2>&1 | Out-File "$OutputDir\dnscache-$ts.txt"

# Running services
Get-Service | Where-Object Status -eq Running |
  Export-Csv "$OutputDir\services-$ts.csv" -NoTypeInformation

# Scheduled tasks
Get-ScheduledTask | Where-Object State -ne Disabled |
  Select-Object TaskName,TaskPath,State,@{n="Actions";e={($_.Actions | Out-String).Trim()}} |
  Export-Csv "$OutputDir\tasks-$ts.csv" -NoTypeInformation

# Autorun locations (common persistence points)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" 2>$null |
  Out-File "$OutputDir\autoruns-hklm-run-$ts.txt"
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" 2>$null |
  Out-File "$OutputDir\autoruns-hkcu-run-$ts.txt"

Write-Host "Live response collection complete: $OutputDir"