<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: collecting-volatile-evidence
description: >-
  Collects volatile forensic evidence in RFC 3227 order of volatility before
  system state changes, including memory, network connections, processes, and caches.
domain: cybersecurity
subdomain: incident-response
tags:
  - volatile-evidence
  - RFC-3227
  - memory-acquisition
  - evidence-preservation
  - chain-of-custody
  - forensics
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Collecting Volatile Evidence

## Overview

Volatile evidence exists only in system memory and running state — it disappears
on reboot, power loss, or process termination. RFC 3227 defines the order of
volatility that governs collection priority: registers/cache → memory → network
state → running processes → disk. This skill covers acquisition of all volatile
artifacts with cryptographic integrity verification and chain-of-custody documentation.

Every minute of delay means potential evidence loss. Collect first, analyze later.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| AVML | Linux memory acquisition | GitHub release binary |
| LiME | Linux kernel memory module | `git clone` + `make` |
| winpmem | Windows memory acquisition | GitHub release |
| WinPmem (signed) | Signed Windows driver | Velocidex release |
| dc3dd / dcfldd | Forensic disk copy with hashing | Package manager |
| sha256sum | Evidence integrity verification | Built-in |
| UAC | Unix artifact collector | `git clone https://github.com/tclahr/uac` |

## Key Concepts

### RFC 3227 Order of Volatility

1. **Registers, cache** — CPU state (captured via memory dump)
2. **Memory (RAM)** — running processes, encryption keys, network buffers
3. **Network state** — active connections, routing tables, ARP cache
4. **Running processes** — process tree, open files, loaded modules
5. **Disk** — filesystem metadata, temp files, swap space
6. **Remote logging** — syslog, SIEM data (least volatile)

### Chain of Custody

Every evidence artifact must have:
- SHA-256 hash computed immediately after acquisition
- Timestamp of collection (UTC)
- Collector identity
- Storage location and access controls
- Verification hash on every access

### Evidence Integrity

```bash
# Hash immediately after collection
sha256sum /evidence/mem.raw > /evidence/mem.raw.sha256
sha256sum /evidence/*.txt > /evidence/manifest.sha256

# Verify before analysis
sha256sum -c /evidence/manifest.sha256
```

## Workflow

### Step 1 — Prepare Evidence Directory

```bash
# Create timestamped evidence directory
CASE_ID="IR-$(date +%Y%m%d-%H%M%S)"
EVIDENCE_DIR="/evidence/$CASE_ID"
mkdir -p "$EVIDENCE_DIR"
echo "Case: $CASE_ID | Collector: $(whoami) | Start: $(date -u +%FT%TZ)" > "$EVIDENCE_DIR/chain-of-custody.log"
```

### Step 2 — Acquire Memory

```bash
# Linux — AVML (preferred, no kernel module needed)
avml "$EVIDENCE_DIR/memory.lime"
sha256sum "$EVIDENCE_DIR/memory.lime" >> "$EVIDENCE_DIR/manifest.sha256"

# Linux — LiME
insmod lime.ko "path=$EVIDENCE_DIR/memory.lime format=lime"
sha256sum "$EVIDENCE_DIR/memory.lime" >> "$EVIDENCE_DIR/manifest.sha256"

# Windows — winpmem
winpmem_mini_x64.exe "$EVIDENCE_DIR\memory.raw"
certutil -hashfile "$EVIDENCE_DIR\memory.raw" SHA256 > "$EVIDENCE_DIR\memory.raw.sha256"
```

### Step 3 — Capture Network State

```bash
# Active connections with process info
ss -tulnp > "$EVIDENCE_DIR/network-connections.txt"
# Established connections only
ss -tnp state established > "$EVIDENCE_DIR/established-connections.txt"
# ARP cache (neighbor table)
ip neigh show > "$EVIDENCE_DIR/arp-cache.txt"
# Routing table
ip route show > "$EVIDENCE_DIR/routing-table.txt"
# DNS cache (systemd-resolved)
resolvectl statistics > "$EVIDENCE_DIR/dns-stats.txt" 2>/dev/null
# Firewall rules
iptables-save > "$EVIDENCE_DIR/iptables-rules.txt" 2>/dev/null
```

### Step 4 — Capture Process State

```bash
# Full process tree
ps auxf > "$EVIDENCE_DIR/process-tree.txt"
# Process details from /proc
for pid in /proc/[0-9]*; do
    echo "=== PID: $(basename $pid) ===" >> "$EVIDENCE_DIR/proc-details.txt"
    cat "$pid/cmdline" 2>/dev/null | tr '\0' ' ' >> "$EVIDENCE_DIR/proc-details.txt"
    echo "" >> "$EVIDENCE_DIR/proc-details.txt"
    cat "$pid/environ" 2>/dev/null | tr '\0' '\n' >> "$EVIDENCE_DIR/proc-env.txt"
done
# Open files
lsof -nP > "$EVIDENCE_DIR/open-files.txt" 2>/dev/null
# Loaded kernel modules
lsmod > "$EVIDENCE_DIR/loaded-modules.txt"
```

### Step 5 — Capture User State

```bash
# Current users
w > "$EVIDENCE_DIR/logged-in-users.txt"
last -25 >> "$EVIDENCE_DIR/login-history.txt"
lastlog > "$EVIDENCE_DIR/lastlog.txt"
# Recent commands (if accessible)
cp /root/.bash_history "$EVIDENCE_DIR/root-bash-history.txt" 2>/dev/null
```

### Step 6 — Finalize Evidence Package

```bash
# Generate final manifest
sha256sum "$EVIDENCE_DIR"/*.txt "$EVIDENCE_DIR"/*.lime "$EVIDENCE_DIR"/*.raw \
  >> "$EVIDENCE_DIR/manifest.sha256" 2>/dev/null

# Log completion
echo "Collection complete: $(date -u +%FT%TZ)" >> "$EVIDENCE_DIR/chain-of-custody.log"
echo "Artifacts: $(ls -1 $EVIDENCE_DIR | wc -l) files" >> "$EVIDENCE_DIR/chain-of-custody.log"

# Verify integrity
sha256sum -c "$EVIDENCE_DIR/manifest.sha256"
```

### Windows Volatile Collection

```powershell
$EvidenceDir = "C:\Evidence\IR-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $EvidenceDir

# Network connections
netstat -anob > "$EvidenceDir\netstat.txt"
Get-NetTCPConnection | Export-Csv "$EvidenceDir\tcp-connections.csv"
arp -a > "$EvidenceDir\arp-cache.txt"

# Processes
Get-Process | Select-Object Id, ProcessName, Path, StartTime, CPU |
  Export-Csv "$EvidenceDir\processes.csv"
tasklist /V /FO CSV > "$EvidenceDir\tasklist.csv"

# Services
Get-Service | Where-Object {$_.Status -eq "Running"} |
  Export-Csv "$EvidenceDir\running-services.csv"

# Logged-in users
query user > "$EvidenceDir\logged-in-users.txt"

# Scheduled tasks
schtasks /query /fo CSV /v > "$EvidenceDir\scheduled-tasks.csv"

# Hash all evidence
Get-ChildItem "$EvidenceDir" | Get-FileHash -Algorithm SHA256 |
  Export-Csv "$EvidenceDir\manifest.csv"
```

## Detection

```yaml
title: Collecting Volatile Evidence Detection
id: 05135947-4fd7-48e0-98b6-ac4d33ee2e9e
status: experimental
description: Detects suspicious activity related to collecting volatile evidence techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*collecting*volatile*"
  condition: selection
level: high
tags:
  - attack.t1005
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Memory image acquired before any system changes
- [ ] All artifacts hashed with SHA-256 immediately after collection
- [ ] Chain of custody log created with timestamps and collector identity
- [ ] Network state captured (connections, ARP, routes)
- [ ] Process tree and open files documented
- [ ] User session data preserved
- [ ] Evidence manifest verified with `sha256sum -c`
- [ ] Evidence stored on write-protected or separate media

## References

- RFC 3227: Guidelines for Evidence Collection and Archiving
- NIST SP 800-86: Guide to Integrating Forensic Techniques
- AVML: https://github.com/microsoft/avml
- LiME: https://github.com/504ensicsLabs/LiME
- UAC: https://github.com/tclahr/uac
