So to get started,
let's review what the required triage data would be. Now,
when we perform digital or forensic triage, really it's the
process of collecting, assembling,
analyzing, and then prioritizing digital evidence as part of an
investigation. The triage data can be broken into multiple categories, which
also apply to locations of where that data might actually be. The first
would be volatile, so this is the pulled out of the memory which is running
on the machine, so this is using system commands, and most of this is
temporary and usually disappears, for example,
at the next reboot of the machine, so we need to grab
this information quite quickly.
The next would be windows and file system information.
So, obviously, here we're going to be collecting core windows and
file system information such as the Registry,
any Prefetch files, and of course as we've talked about
in the past, event log information,
which is critical to obviously understanding what's been going on.
Then, of course, we have persistence, so, for example,
anything that is a process or a task that executes
automatically, is on a schedule,
something that runs every time the machine gets restarted.
And then, of course,
we have application‑specific information, so we're talking
about the installed or updated applications,
internet browser history or even just configuration
that's unique to an application.
Now, of course, what is the required information that we need to get, though?
So it's going to be system information, which is going to be
information about the specific machine, for example,
if it's a Windows machine,
maybe a laptop that was made by one of the general vendors,
then it's going to be information about that.
We're also going to look at local users, groups, and memberships
to understand if they are correct, and actually to question are
those local accounts supposed to exist there and what are the
memberships that are associated?
Then, of course,
we're going to grab process BIOS, and memory details as
well, as well as processes and services.
We may also want to grab network adapters and connections so we
kind of know the IP addresses, the routing,
the I P addresses, the sub nets, the all those different things.
And then of course, we have our firewall configuration.
If anything,
we can also then go and grab hard disk folders and file
information to see if anything's been copied,
adjusted or changed, we then can grab the current session information.
So the current user that's logged in what's happening in that specific session.
If it's a corporate machine,
then we can grab the group policy details to see what should have been applied
but didn't or did we also can grab a list of the installed applications as
well as any of the tasks and auto run information.
And then of course, our trusty but really important event logs.
Now, once we've grabbed all this information,
we obviously need to output into some type of format.
So what are our core output options?
Well, the first one is a CSV So a comma separated file,
we can also output as an XML file and then we can also output as HTML So we
have the flexibility of crafting whatever we need to.
We could also go one step further and convert the content
into JSON or whatever type of format we need using any of
the standard para shell commands.
Or if we want to utilize any of the third party commands,
then we could potentially export into multiple different formats.