Evidence Preservation During IR

# Run before isolating — collect volatile evidence snapshot
$outputDir = "C:\IR_Collection_$(Get-Date -Format yyyyMMdd_HHmmss)"
New-Item -ItemType Directory -Path $outputDir -Force | Out-Null

# 1. Running processes with full path and parent
Get-Process | ForEach-Object {
    [PSCustomObject]@{
        PID      = $_.Id
        Name     = $_.Name
        Path     = $_.Path
        CPU      = $_.CPU
        Started  = $_.StartTime
        ParentPID = (Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").ParentProcessId
    }
} | Export-Csv "$outputDir\processes.csv" -NoTypeInformation

# 2. Network connections with owning process
Get-NetTCPConnection | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -EA 0
    [PSCustomObject]@{
        State      = $_.State
        Local      = "$($_.LocalAddress):$($_.LocalPort)"
        Remote     = "$($_.RemoteAddress):$($_.RemotePort)"
        PID        = $_.OwningProcess
        Process    = if ($p) { $p.Name } else { "?" }
        Path       = if ($p) { $p.Path } else { "?" }
    }
} | Export-Csv "$outputDir\network_connections.csv" -NoTypeInformation

# 3. Active sessions
query session | Out-File "$outputDir\sessions.txt"

# 4. Export event logs
foreach ($log in @("Security","System","Application",
                   "Microsoft-Windows-PowerShell/Operational",
                   "Microsoft-Windows-Sysmon/Operational")) {
    $safe = $log -replace "[/\\]","_"
    wevtutil epl $log "$outputDir\$safe.evtx" 2>$null
}

# 5. Loaded modules per process (for injection detection)
Get-Process | ForEach-Object {
    $pid = $_.Id; $pname = $_.Name
    $_.Modules | ForEach-Object {
        [PSCustomObject]@{
            ProcessName = $pname; PID = $pid
            Module = $_.FileName
        }
    }
} 2>$null | Export-Csv "$outputDir\loaded_modules.csv" -NoTypeInformation

Write-Host "Collection complete: $outputDir" -ForegroundColor Green

# WinPmem memory acquisition (requires winpmem.exe in PATH or specified path)
# Run as Administrator

$outputPath = "D:\IR\memory_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmmss).raw"

# Acquire full physical memory
.\winpmem_mini_x64_rc2.exe $outputPath
# or: winpmem --output $outputPath --format raw

# Verify the file was created and get its hash
if (Test-Path $outputPath) {
    $hash = Get-FileHash $outputPath -Algorithm SHA256
    Write-Host "Memory acquired: $outputPath"
    Write-Host "SHA256: $($hash.Hash)"
    # Record the hash for chain of custody documentation
    "$($hash.Hash)  $outputPath" | Out-File "$outputPath.sha256"
} else {
    Write-Warning "Memory acquisition failed — check winpmem output"
}

# Alternative: via EDR (CrowdStrike example — if EDR supports remote memory collection)
# Most enterprise EDRs have a built-in memory collection action that doesn't
# require deploying a separate tool to the endpoint