<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-endpoint-forensic-collection
description: >-
  Collect volatile and non-volatile forensic artifacts from endpoints during
  incident response. Covers memory acquisition, disk triage, log collection,
  chain of custody, and evidence preservation using KAPE, Velociraptor,
  and standard forensic tools.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - forensics
  - kape
  - velociraptor
  - memory-acquisition
  - evidence-collection
  - incident-response
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1005
    - T1074
    - T1560
---

# Performing Endpoint Forensic Collection

## Overview

Endpoint forensic collection captures evidence from compromised systems for
analysis during incident response. Collection follows the order of volatility:
memory first, then running processes, network connections, disk artifacts, and
logs. Chain of custody must be maintained throughout.

## Prerequisites

| Requirement | Purpose |
|---|---|
| KAPE | Kroll Artifact Parser and Extractor for Windows triage |
| Velociraptor | Endpoint monitoring and forensic collection agent |
| WinPmem / LiME | Memory acquisition tools for Windows/Linux |
| FTK Imager | Forensic disk imaging tool |
| sha256sum / certutil | Hash verification for evidence integrity |

## Workflow

1. **Establish scope** — Identify systems requiring collection based on IOCs
2. **Acquire memory** — Capture RAM before any other actions (highest volatility)
3. **Collect volatile data** — Running processes, network connections, logged-on users
4. **Triage artifacts** — Use KAPE/Velociraptor for targeted artifact collection
5. **Disk imaging** — Full or targeted disk image if needed for deep analysis
6. **Hash evidence** — SHA256 hash all collected files for integrity verification
7. **Package and transfer** — Securely transfer evidence to analysis workstation
8. **Document chain of custody** — Record who collected what, when, and how

## Key Commands

```bash
# Memory acquisition — Windows (WinPmem)
winpmem_x64.exe -o memory.raw
certutil -hashfile memory.raw SHA256

# Memory acquisition — Linux (LiME)
insmod lime.ko "path=/tmp/memory.lime format=lime"
sha256sum /tmp/memory.lime

# KAPE triage collection
kape.exe --tsource C: --tdest E:\Evidence --target KapeTriage --vhdx evidence

# Velociraptor triage
velociraptor collect -i Windows.KapeFiles.Targets --output triage.zip
velociraptor collect -i Linux.Collection.BasicInfo --output linux-triage.zip

# Collect running processes
tasklist /V > processes.txt       # Windows
ps auxww > processes.txt          # Linux

# Collect network connections
netstat -anob > netstat.txt       # Windows
ss -tlnp > netstat.txt            # Linux

# FTK Imager — disk image
ftkimager \\.\PhysicalDrive0 evidence --e01 --compress 6

# Hash all evidence files
find /evidence -type f -exec sha256sum {} \; > evidence_hashes.txt
```

## Verification

| Check | Method |
|---|---|
| Memory captured | Memory dump file exists and size matches RAM |
| Hashes recorded | SHA256 hash file exists for each evidence file |
| Triage complete | KAPE/Velociraptor output archive is non-empty |
| Chain of custody | Collection log documents collector, time, method |
| Evidence transferred | Files on analysis workstation match source hashes |

## References

- [KAPE Documentation](https://ericzimmerman.github.io/KapeDocs/)
- [Velociraptor Documentation](https://docs.velociraptor.app/)
- [SANS Digital Forensics](https://www.sans.org/digital-forensics-incident-response/)

---
v1.0 | Validated: 2026-03-18
