Lesson 1.77: Collecting a triage package
Findings are only as good as the evidence behind them. Before the server is isolated or rebuilt, the volatile state (processes, connections, modules) and the key files are copied with their timestamps, every file gets a hash, and the package is sealed so anyone can later prove nothing changed. In the lab you collect a triage package from the compromised Git server in the order of volatility, preserve times with cp -a, write a SHA-256 manifest, archive and hash the package, and verify it.
18 min
You will learn to
- Collect in order of volatility
- Capture volatile state into a file
- Copy evidence with timestamps preserved
- Write and verify a SHA-256 manifest
- Package and hash for handover
Key terms
- Order of volatility
- Collect what vanishes first first: memory, processes and connections, then disk.
- Triage package
- A small, fast collection of the most useful volatile data and files from a live system.
- cp -a
- Archive copy: keeps mode, owner, timestamps and links.
- Manifest
- A list of files with their hashes, checked with sha256sum -c.
- Chain of custody
- Who collected what, when, and every hand it passed through.
← Core dumps that keep secrets · All lessons · Taking a copy of memory →