Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
# Active network connections# Windows
netstat -anob > "$EVIDENCE_DIR/netstat_connections.txt" 2>&1
Get-NetTCPConnection | Export-Csv "$EVIDENCE_DIR/tcp_connections.csv" -NoTypeInformation
Get-NetUDPEndpoint | Export-Csv "$EVIDENCE_DIR/udp_endpoints.csv" -NoTypeInformation
# Linux
ss -tulnp > "$EVIDENCE_DIR/socket_stats.txt"
netstat -anp > "$EVIDENCE_DIR/netstat_all.txt" 2>/dev/null
cat /proc/net/tcp > "$EVIDENCE_DIR/proc_net_tcp.txt"cat /proc/net/udp > "$EVIDENCE_DIR/proc_net_udp.txt"# ARP cache
arp -a > "$EVIDENCE_DIR/arp_cache.txt"# Routing table
route print > "$EVIDENCE_DIR/routing_table.txt"# Windows
ip route show > "$EVIDENCE_DIR/routing_table.txt"# Linux# DNS cache
ipconfig /displaydns > "$EVIDENCE_DIR/dns_cache.txt"# Windows# Linux: varies by resolver, check systemd-resolve or nscd
systemd-resolve --statistics > "$EVIDENCE_DIR/dns_stats.txt" 2>/dev/null
# Active firewall rules
netsh advfirewall show allprofiles > "$EVIDENCE_DIR/firewall_rules.txt"# Windows
iptables -L -n -v > "$EVIDENCE_DIR/iptables_rules.txt"# Linux
Step 4: Capture Running Processes
# Windows - Detailed process list
tasklist /V /FO CSV > "$EVIDENCE_DIR/process_list_verbose.csv"
wmic process list full > "$EVIDENCE_DIR/wmic_process_full.txt"
Get-Process | Select-Object Id,ProcessName,Path,StartTime,CPU,WorkingSet |
Export-Csv "$EVIDENCE_DIR/ps_processes.csv" -NoTypeInformation
# Windows - Process with command line and parent
wmic process get ProcessId,Name,CommandLine,ParentProcessId,ExecutablePath /FORMAT:CSV > \
"$EVIDENCE_DIR/process_commandlines.csv"# Linux - Full process tree
ps auxwwf > "$EVIDENCE_DIR/process_tree.txt"
ps -eo pid,ppid,user,args --forest > "$EVIDENCE_DIR/process_forest.txt"cat /proc/*/cmdline 2>/dev/null | tr'\0'' ' > "$EVIDENCE_DIR/proc_cmdline_all.txt"# Process modules/DLLs loaded# Windows
listdlls.exe -accepteula > "$EVIDENCE_DIR/loaded_dlls.txt"# Linuxfor pid in $(ls /proc/ | grep -E '^[0-9]+$'); doecho"=== PID $pid ===" >> "$EVIDENCE_DIR/proc_maps.txt"cat"/proc/$pid/maps" 2>/dev/null >> "$EVIDENCE_DIR/proc_maps.txt"done# Open file handles
handle.exe -accepteula > "$EVIDENCE_DIR/open_handles.txt"# Windows (Sysinternals)
lsof > "$EVIDENCE_DIR/open_files.txt"# Linux
Step 5: Capture Logged-in Users and Sessions
# Windows
query user > "$EVIDENCE_DIR/logged_in_users.txt"
query session > "$EVIDENCE_DIR/active_sessions.txt"
net session > "$EVIDENCE_DIR/net_sessions.txt" 2>&1
net use > "$EVIDENCE_DIR/mapped_drives.txt" 2>&1
# Linuxwho > "$EVIDENCE_DIR/who_output.txt"
w > "$EVIDENCE_DIR/w_output.txt"
last -50 > "$EVIDENCE_DIR/last_logins.txt"
lastlog > "$EVIDENCE_DIR/lastlog.txt"cat /var/log/auth.log | tail -200 > "$EVIDENCE_DIR/recent_auth.txt" 2>/dev/null
