collecting-volatile-evidence-from-compromised-host

name	collecting-volatile-evidence-from-compromised-host
description	Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
domain	cybersecurity
subdomain	incident-response
tags	["incident-response","dfir","forensics","volatile-evidence","memory-forensics","chain-of-custody"]
mitre_attack	["T1059.001","T1057","T1049","T1003.001","T1543.003"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Collecting Volatile Evidence from Compromised Hosts

When to Use

• Security incident confirmed and compromised host identified
• Before system isolation, shutdown, or remediation begins
• Memory-resident malware suspected (fileless attacks)
• Need to capture network connections, running processes, and system state
• Legal proceedings may require forensic evidence preservation
• Incident requires root cause analysis with volatile data

Prerequisites

• Forensic collection toolkit on USB or network share (trusted tools)
• WinPmem/LiME for memory acquisition
• Write-blocker or forensic workstation for disk imaging
• Chain of custody documentation forms
• Secure evidence storage with integrity verification
• Authorization to collect evidence (legal/HR approval for insider cases)

Workflow

Step 1: Prepare Collection Environment

# Mount forensic USB toolkit (do NOT install tools on compromised system)
# Verify toolkit integrity
sha256sum /mnt/forensic_usb/tools/* > /tmp/toolkit_hashes.txt
diff /mnt/forensic_usb/tools/known_good_hashes.txt /tmp/toolkit_hashes.txt

# Create evidence output directory with timestamps
EVIDENCE_DIR="/mnt/evidence/$(hostname)_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"
echo "Collection started: $(date -u)" > "$EVIDENCE_DIR/collection_log.txt"
echo "Collector: $(whoami)" >> "$EVIDENCE_DIR/collection_log.txt"
echo "System: $(hostname)" >> "$EVIDENCE_DIR/collection_log.txt"

Step 2: Capture System Memory (Highest Volatility)

# Windows - WinPmem memory acquisition
winpmem_mini_x64.exe 


insmod /mnt/forensic_usb/lime.ko 


 =/proc/kcore of= bs=1M


osxpmem -o 


 * >