<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Volatile Data Collection (Order Matters)

Collect volatile data before ANYTHING else — it evaporates on reboot. NIST 800-86 order:

## Linux Volatile Collection

```bash
# 1. Capture running process list (with full command lines)
ps auxf > /tmp/ir/processes.txt
cat /proc/*/cmdline 2>/dev/null | tr '\0' ' ' | sort -u > /tmp/ir/cmdlines.txt

# 2. Network connections (established + listening)
ss -tulnp > /tmp/ir/netstat.txt
ss -anp > /tmp/ir/all_sockets.txt

# 3. Logged-in users
who -a > /tmp/ir/who.txt
last -F > /tmp/ir/last.txt
lastlog > /tmp/ir/lastlog.txt

# 4. Open files
lsof -nP > /tmp/ir/lsof.txt

# 5. Loaded kernel modules (rootkit check)
lsmod > /tmp/ir/lsmod.txt
cat /proc/modules > /tmp/ir/proc_modules.txt

# 6. ARP cache + routes
arp -an > /tmp/ir/arp.txt
ip route show > /tmp/ir/routes.txt

# 7. Scheduled tasks
crontab -l > /tmp/ir/crontab_user.txt
cat /etc/cron* /var/spool/cron/crontabs/* 2>/dev/null > /tmp/ir/cron_all.txt
systemctl list-timers --all > /tmp/ir/timers.txt
```

## Windows Volatile Collection

```powershell
# Processes with hashes (for IOC matching)
Get-Process | Select-Object Id,Name,Path,@{N='Hash';E={Get-FileHash $_.Path -EA SilentlyContinue | Select -Expand Hash}} | Export-Csv processes.csv
# Network connections with owning process
Get-NetTCPConnection | Select State,LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess | Export-Csv netconn.csv
# Services (check for unusual binary paths)
Get-WmiObject Win32_Service | Select Name,State,PathName,StartMode | Export-Csv services.csv
# Autoruns (requires Sysinternals autorunsc.exe)
autorunsc.exe -a * -c -h -s > autoruns.csv
```

## Memory Acquisition

### Windows

```bash
# winpmem (recommended, kernel driver, gets all memory)
winpmem_mini_x64.exe mem.raw
sha256sum mem.raw > mem.raw.sha256

# MAGNET DumpIt
DumpIt.exe /OUTPUT mem.raw
```

### Linux

```bash
# LiME (Loadable Kernel Module — most forensically sound)
# Compile on matching kernel version
make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
insmod lime.ko "path=/tmp/mem.lime format=lime"
sha256sum /tmp/mem.lime

# AVML (Microsoft, static binary, no compile needed)
./avml /tmp/mem.lime

# /dev/mem (legacy, incomplete on modern kernels — avoid)
```

## Volatile Data Order Reference

running processes → network connections → logged-in users → loaded modules → ARP cache

## Anti-Patterns

- **Rebooting before collection:** Reboots destroy memory; atime updates overwrite last-access timestamps that place attacker on the filesystem.
- **Hard-isolating before memory acquisition:** Network isolation is fine, but powering off destroys volatile artifacts. Image memory first, then isolate.
- **Running commands that modify atime:** Use `noatime` mount or avoid accessing evidence files before imaging.

---
v1.1 | Validated: 2026-03-13
