# Collecting Volatile Evidence From A Suspect Host

> Collects volatile evidence from a potentially compromised host in correct order of

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-collecting-volatile-evidence-from-a-suspect-host`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/collecting-volatile-evidence-from-a-suspect-host
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-collecting-volatile-evidence-from-a-suspect-host
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Collecting Volatile Evidence from a Suspect Host

## When to Use

- A host is suspected of compromise and you must capture state that disappears on reboot.
- You are performing live response before isolating or imaging the machine.
- You need an ordered, integrity-preserving collection for later analysis.

**Do not use** this as a substitute for full disk imaging when persistence matters — volatile
collection complements, not replaces, a forensic image. And do not reboot before collecting.

## Prerequisites

- Trusted, statically linked collection tools run from external media (not host binaries).
- Authorization to collect, and a destination on external/write-once media.

## Safety & Handling

- Assume host tools are compromised; use your own trusted binaries to avoid rootkit deception.
- Hash every artifact at collection time and record actions for chain of custody; minimize
  changes to the host.

## Workflow

### Step 1: Follow the order of volatility

Collect most-volatile first (RFC 3227): CPU/registers and cache → RAM → network state and
connections → running processes → logged-on users/sessions → open files/handles → then disk.

### Step 2: Capture memory first

Acquire a full RAM image with a trusted acquisition tool before anything that alters memory; it
is the richest and most perishable source.

### Step 3: Snapshot network and process state

Record active connections, listening ports, ARP/DNS cache, running processes with command lines
and parent links, and loaded modules.

```bash
python scripts/analyst.py manifest ./collection --case IR-42 --host WS01
```

### Step 4: Record users and handles

Capture logged-on users, sessions, scheduled tasks, and open handles/files.

### Step 5: Hash, log, and hand off

Hash each artifact, write a collection manifest with timestamps, and transfer to the analysis
environment preserving integrity.

## Validation

- Artifacts are collected in order of volatility, memory first, before any reboot.
- Every artifact has a recorded hash and collection timestamp in the manifest.
- Trusted external tools were used; host changes are documented.

## Pitfalls

- Rebooting or shutting down before capturing RAM, destroying the best evidence.
- Using the host's own (possibly trojaned) tools and trusting their output.
- No hashing/manifest, undermining evidentiary integrity.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the manifest helper.
- RFC 3227 and NIST SP 800-86 (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-collecting-volatile-evidence-from-a-suspect-host
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.