1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Analyze Memory Images using Volatility
Use command-line forensics tools to identify running processes and network connections in memory.
$ python vol.py -f memory_dump.raw imageinfo
This profiles the raw memory file to determine the correct operating system kernel configuration.
$ python vol.py -f memory_dump.raw --profile=Win7SP1x64 pslist
This retrieves the list of processes active at the time of memory acquisition, exposing suspicious parent-child trees.
$ python vol.py -f memory_dump.raw --profile=Win7SP1x64 connections
This lists active network sockets in memory, exposing Command and Control (C2) channels.
STEP 2
Conduct Disk Forensics with Autopsy
Perform GUI analysis of hard drive files to restore deleted directories and review registry metrics.
- Launch **Autopsy Forensic Browser**. Click New Case, set case name
Case-001, and click Next.
- In the **Add Data Source** window, select **Disk Image**, browse to your image file (e.g.
evidence_drive.raw), and click **Next**.
- Under **Configure Ingest Modules**, check **File Type Identifier**, **Hash Lookup**, **Keyword Search**, and **Extension Mismatch Detector**. Click **Finish**.
- Expand the **Data Sources** tree in the left pane, navigate to
C:\Users\victim\Downloads, inspect the metadata of any deleted files (displayed in red), and note their MD5 hash values.
4. Part 2: Complete Deliverable Assets & Production Templates
To collect active system states during a live incident response triage, we will write a local PowerShell collector script named TriageCollector.ps1:
PS> .\TriageCollector.ps1
This runs the triage collector locally to dump system states.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# TriageCollector.ps1 - Live Incident Response Collector
Line 2: This is a comment that describes what the code does: "TriageCollector.ps1 - Live Incident Response Collector". Comments start with # and are ignored by Python.
Write-Host "[*] Starting Live Triage Collector..." -ForegroundColor Yellow
Line 3: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
$LogFile = "C:\triage_report.txt"
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
New-Item -Path $LogFile -ItemType File -Force | Out-Null
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Add-Content $LogFile "=== ACTIVE NETWORK CONNECTIONS ==="
Line 6: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort | Out-String | Add-Content $LogFile
Line 7: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Add-Content $LogFile "\n=== SUSPICIOUS PROCESSES ==="
Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Get-Process | Where-Object {{$_.Path -notmatch "C:\\Windows"}} | Select-Object Id, ProcessName, Path | Out-String | Add-Content $LogFile
Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Write-Host "[SUCCESS] Triage report saved to $LogFile" -ForegroundColor Green
Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
# TriageCollector.ps1 - Live Incident Response Collector
Write-Host "[*] Starting Live Triage Collector..." -ForegroundColor Yellow
$LogFile = "C:\triage_report.txt"
New-Item -Path $LogFile -ItemType File -Force | Out-Null
Add-Content $LogFile "=== ACTIVE NETWORK CONNECTIONS ==="
Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort | Out-String | Add-Content $LogFile
Add-Content $LogFile "\n=== SUSPICIOUS PROCESSES ==="
Get-Process | Where-Object {{$_.Path -notmatch "C:\\Windows"}} | Select-Object Id, ProcessName, Path | Out-String | Add-Content $LogFile
Write-Host "[SUCCESS] Triage report saved to $LogFile" -ForegroundColor Green
5. Deliverables Summary
Created Files / Templates
TriageCollector.ps1 - PowerShell triage script- Incident Chronology Report (PDF format)
Verification Artifacts
- Output text dump of
C:\triage_report.txt.
- Screenshots showing identified malicious executable paths in Autopsy.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
