annatchijova·annatchijova/SKILLS/acquisition-order-of-volatility/SKILL.md

acquisition-order-of-volatility

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Collect digital evidence in order of volatility, or destroy the thing you came for — memory, network state, and running processes evaporate the moment you pull power or start "just looking," and the act of collecting alters the scene, so order and method are the evidence's admissibility, not a formality. Use whenever evidence is being captured from a live or suspect system: "acquire the disk", "grab a memory dump", "should we pull the plug or shut down gracefully", "image this machine", "collect logs from the compromised host", "preserve the evidence", "is this forensically sound", "we already rebooted it". Sibling of finding-custody (chain of custody of the artifact) and tamper-evident-audit-chain (proving it was not altered after); it governs the collection act itself. It does not analyze the acquired image (that is the investigation) and never presents evidence collected out of order or without footprint as if it were pristine.