Lab 9.1 — Evidence Collection

Lab Overview

The Scenario

Your organization's IDS triggered an alert on a Windows workstation (WIN-ENDPOINT-01). The SOC has confirmed suspicious outbound connections and elevated process activity. You've been assigned as the forensic investigator. Your job is to collect volatile evidence in the correct order before the endpoint is isolated — every second counts, because volatile data disappears when the system powers off or reboots.

You must document everything: what you collected, when, how, and maintain an unbroken chain of custody.

Part 1: Understanding Order of Volatility

The Volatility Hierarchy

Digital evidence has a "shelf life." Some data persists for years on disk; other data vanishes in milliseconds. The Order of Volatility (RFC 3227) dictates collection priority:

Click to enlarge

Exercise: Rank the Evidence

Before touching the endpoint, rank these items by collection priority:

1. Browser download history
2. Active TCP connections
3. Contents of RAM
4. Windows Event Logs
5. Running processes with command-line arguments

Write your ranking in your evidence log. (Correct order: 3 → 2 → 5 → 1 → 4)

Part 2: Setting Up Your Evidence Log

Create Your Collection Template

Before collecting anything, prepare your documentation. Open a text editor and create this template:

DIGITAL EVIDENCE COLLECTION LOG
════════════════════════════════
Case ID:        IR-2026-[today's date]
Examiner:       [your name]
Date/Time Start: [UTC timestamp]
Endpoint:        WIN-ENDPOINT-01
Reason:          IDS alert — suspicious outbound connections

CHAIN OF CUSTODY
────────────────
Date/Time | Action | Examiner | Description
----------|--------|----------|------------
[UTC]     | BEGIN  | [name]   | Evidence collection initiated

Chain of Custody Principles

Click to enlarge

Every piece of evidence must have an unbroken record of:

• Who collected it
• When it was collected (UTC timestamps)
• How it was collected (tool, method, command)
• Where it was stored
• Integrity verification (hash values)

Part 3: Collecting Volatile Data with Velociraptor

Step 1: Connect to Velociraptor

1. Open the Velociraptor Web UI from your lab environment
2. Navigate to the client list — you should see WIN-ENDPOINT-01 connected
3. Click on the client to open its details

Step 2: Collect Network State (Priority 3)

Network connections are highly volatile — they disappear when a process closes or the attacker disconnects.

1. Navigate to the Collected Artifacts tab
2. Click New Collection
3. Search for and select: Windows.Network.Netstat
4. Launch the collection

Document in your log:

[UTC] | COLLECT | [name] | Network connections via Windows.Network.Netstat
  Hash: [note the flow ID]
  Results: [number of active connections]
  Notable: [any suspicious external IPs or unusual ports]

Review the results. Look for:

• Connections to unusual external IP addresses
• Processes with connections on non-standard ports
• Any connections to known-bad IP ranges

Step 3: Collect Running Processes (Priority 4)

1. Create a new collection
2. Select: Windows.System.Pslist
3. Launch the collection

Document in your log and look for:

• Processes running from unusual paths (e.g., C:\Users\Public\, C:\Temp\)
• Processes with suspicious parent-child relationships
• Processes with encoded or obfuscated command-line arguments

Step 4: Collect Logged-On Users

1. Create a new collection
2. Select: Windows.Sys.Users
3. Launch the collection

Document in your log and identify:

• Which accounts are currently logged on
• Any unexpected service accounts or admin sessions
• Remote logon sessions (RDP, network logons)

Step 5: Collect Process Memory (Targeted)

For any suspicious processes identified in Step 3:

1. Create a new collection
2. Select: Windows.Memory.Acquisition or target specific process memory
3. Launch the collection

Part 4: Collecting Persistent Evidence

Step 6: Collect System Information

1. Select: Windows.Sys.Info
2. Launch the collection

This gives you the baseline: OS version, hostname, timezone, last boot time. Critical for your report.

Step 7: Collect Prefetch Files

1. Select: Windows.Forensics.Prefetch
2. Launch the collection

Prefetch files prove program execution. Document:

• Any suspicious executables in the Prefetch results
• Execution counts and timestamps
• Executables that match your process findings from Step 3

Step 8: Collect Recent File Activity

1. Select: Windows.Forensics.RecentApps
2. Launch the collection

This reveals recently accessed files and applications.

Part 5: Evidence Integrity and Finalization

Hash Everything

For each collection you've completed:

1. Note the Velociraptor Flow ID (this uniquely identifies each collection)
2. Record the collection start and completion timestamps
3. Document the result count for each artifact

Complete Your Chain of Custody

Add a final entry:

[UTC] | END | [name] | Evidence collection completed. 7 artifacts collected.
  Total Collections: 7
  Flow IDs: [list all]
  Endpoint Status: [still running / isolated]
  Next Steps: [analysis phase / handoff to senior examiner]

Evidence Storage

In a real investigation, you would:

1. Export all collections from Velociraptor
2. Store in a write-protected evidence container
3. Generate SHA-256 hashes of all exported files
4. Store hashes separately from evidence
5. Restrict access to authorized examiners only

Deliverable Checklist

Before completing the lab, ensure you have:

• Evidence Collection Log — complete with UTC timestamps for every action
• Chain of Custody Record — unbroken chain from start to finish
• 7 Artifact Collections — network, processes, users, memory, sysinfo, prefetch, recent files
• Suspicious Findings — at least 3 notable items identified across your collections
• Order of Volatility Ranking — correctly prioritized collection order documented
• Flow IDs — all Velociraptor collection IDs recorded for evidence integrity

What's Next

In Lab 9.2 — Disk Artifact Analysis, you'll analyze the persistent artifacts on disk: Prefetch files, Amcache entries, and ShimCache. These artifacts tell the story of what programs were executed, when, and how many times — even after the attacker tries to delete their tools.