Competition Checklist · 06 · Forensics
Forensics Checklist
Preserve evidence, record hashes and metadata, correlate authentication, processes, services, scheduled activity, browser artifacts, network state, and timelines before drawing conclusions or changing the system.
The goal is not to collect everything. Collect the evidence needed to answer the question, preserve context, and support conclusions with multiple independent artifacts.
Quick Use
Evidence rule
Preserve before you remediate
The moment you terminate a process, remove an account, disable a service, delete a file, or change permissions, the evidence changes. Capture what you need first.
Opening pass
Set the case context before collection
Read the forensic question or incident prompt before collecting evidence.
Collection should be driven by the question you need to answer so you do not waste time or alter unrelated evidence.
Preserve the original state before remediation.
Stopping a process, deleting a file, disabling a task, or changing an account can destroy timestamps, logs, and relationships you may need later.
Record the system name, user context, current time, and time zone.
Timeline analysis becomes unreliable if evidence from different systems is compared without time context.
Hash important files before and after handling when practical.
A cryptographic hash provides a repeatable integrity check for the exact bytes you examined.
Capture paths, timestamps, process IDs, service names, usernames, and network endpoints exactly.
Precise identifiers make cross-system correlation possible and reduce guesswork.
Separate observations from conclusions.
Write down what the evidence actually shows before deciding what it means.
Preservation
Protect the evidence before changing the system
Case notes
Your notes make it clear which system and moment each artifact came from.
File integrity
The evidence record is specific enough to identify the same file later.
Screenshots and exports
Screenshots supplement evidence instead of replacing exact text, paths, timestamps, or hashes.
Change boundary
High-impact remediation happens only after the evidence you need is preserved.
Windows evidence
Correlate identity, execution, persistence, and network state
Authentication events
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624,4625,4672} -MaxEvents 150Successful, failed, and privileged logons are correlated with usernames, times, and source information.
Account and group changes
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4720,4722,4725,4728,4732,4733} -MaxEvents 150Unexpected identity or privilege changes are tied to the responsible account and time.
Process creation
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4688} -MaxEvents 150Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Process evidence includes path, command line, parent relationship, user context, and time when available.
Service installation
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 100New services are correlated with executable paths, accounts, and related activity.
Scheduled tasks
Get-ScheduledTask
Suspicious tasks are documented by name, action, trigger, author, run-as identity, and path.
Network state
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Connections are mapped to owning processes before containment.
Linux evidence
Correlate authentication, processes, schedules, and sockets
Authentication evidence
sudo tail -n 150 /var/log/auth.log
sudo journalctl _SYSTEMD_UNIT=ssh.service --no-pager -n 100
Logins, failures, sudo activity, and SSH sessions are correlated by user and timestamp.
Recent user sessions
last -a | head -n 50
lastb -a | head -n 50
Recent successful and failed sessions are compared with approved users and expected sources.
Process evidence
ps auxf
pstree -ap
Suspicious processes are documented by user, parent, command line, and execution context.
Executable details
readlink -f /proc/<PID>/exe
tr '\0' ' ' < /proc/<PID>/cmdline
The real executable path and command line are preserved before termination.
Scheduled activity
crontab -l
sudo crontab -l
systemctl list-timers --all
Cron jobs and timers are recorded by owner, schedule, command, and associated service.
Network state
sudo ss -ntup
sudo ss -lntup
Active and listening sockets are correlated with processes before changes.
File quick reference
Record the exact file before interpreting it
Hash
Windows
Get-FileHash <Path> -Algorithm SHA256
Linux
sha256sum <path>
Identify the exact bytes of a file and detect whether it changes during handling.
Metadata
Windows
Get-Item <Path> | Format-List *
Linux
stat <path>
Capture size, ownership, and available timestamps for correlation.
Directory context
Windows
Get-ChildItem <Directory> -Force
Linux
ls -la <directory>
Understand neighboring files, hidden items, and naming patterns.
File type
Windows
Use extension, properties, and trusted inspection tools
Linux
file <path>
Determine whether the content matches the apparent filename or extension.
Browser & download artifacts
Follow the path from download to execution
History
Visited sites, timestamps, search activity, and navigation near the suspicious event.
Downloads
Source URL, local filename, download time, destination path, and related browser activity.
Recent files
Files opened or created near the incident window.
Archive extraction
Extracted folders, renamed files, and timestamps that connect a downloaded archive to later execution.
Execution follow-up
Process creation, service installation, scheduled tasks, Run keys, cron jobs, or timers following the download.
Network follow-up
Outbound connections from the downloaded or extracted program and related processes.
Timeline reconstruction
Build the sequence from independent artifacts
Authentication
Who logged in, from where, and when did the relevant session begin?
Browser / download
What was visited or downloaded during that session?
File system
When did the file appear, change, move, or extract?
Process
Was the file executed, by which user, and with what parent or command line?
Network
Did the process create a listener or outbound connection?
Persistence
Did a service, task, Run key, cron job, or timer create recurring execution?
Privilege
Did account or group state change after the execution?
Verification
Do at least two independent artifacts support the important conclusion?
Evidence table
Keep one structured record for the important artifacts
Confidence
State how strongly the evidence supports the conclusion
High confidence
Multiple independent artifacts agree on the same sequence, identity, path, or event.
Moderate confidence
The evidence points strongly in one direction but one important link is missing.
Low confidence
The conclusion depends on one weak artifact, assumption, or timestamp without corroboration.
Unresolved
The available evidence is insufficient or contradictory. Record the uncertainty rather than guessing.
High-priority findings
Preserve the relationships before containment
Unknown executable with active outbound connection
Record path, PID, parent, command line, user, hash, timestamps, remote endpoint, and related logs before containment.
New privileged account
Preserve account-creation, group-change, and logon evidence before changing the account.
Suspicious scheduled persistence
Record task or timer name, action, trigger, run-as identity, executable path, and timestamps before disabling it.
Recently installed service
Capture service name, executable path, start account, installation event, and related process or network evidence.
Downloaded archive followed by execution
Preserve browser download data, archive hash, extracted paths, execution evidence, and subsequent network or persistence activity.
Repeated failed logons followed by privileged success
Preserve source information, usernames, timestamps, successful session details, and subsequent administrative actions.
Do not blindly do
Common evidence-destroying mistakes
Do not execute an unknown file just to see what it does.
Do not delete suspicious files before recording path, hash, metadata, and related evidence.
Do not terminate a suspicious process before recording process and network context.
Do not disable a task, service, cron job, or timer before preserving its configuration.
Do not rely on one timestamp without corroborating it with another artifact.
Do not assume a filename proves file type or purpose.
Do not treat a screenshot as a substitute for exact evidence details.
Do not turn an observation into a conclusion unless the evidence supports it.
Verification sweep
Confirm the case record is complete enough to support your conclusion
Integrity
Important files have recorded paths, hashes, sizes, and timestamps where practical.
Identity
Authentication and privilege evidence is tied to specific users and times.
Execution
Process evidence includes enough context to explain what ran and how.
Persistence
Services, tasks, Run keys, cron jobs, and timers were documented before remediation.
Network
Connections and listeners were mapped to processes or services.
Timeline
Important events are ordered consistently using known time-zone context.
Correlation
Major conclusions are supported by more than one independent artifact when possible.
Notes
Observations, conclusions, remediation, and unresolved questions are clearly separated.
Forensics final checklist
Finish with evidence, correlation, and explicit confidence
The forensic question or incident prompt was read before collection.
System name, current time, and time zone were recorded.
Important evidence was preserved before remediation.
Suspicious files have recorded paths, metadata, and SHA-256 hashes where practical.
Authentication evidence was reviewed.
Privilege and account changes were reviewed.
Suspicious processes were documented before containment.
Scheduled persistence was documented before disablement.
Network connections and listeners were correlated with processes or services.
Browser and download artifacts were reviewed when relevant.
Windows or Linux logs were correlated with file and process evidence.
A timeline was built from the most relevant events.
Major conclusions are supported by multiple artifacts when possible.
Confidence and uncertainty are recorded explicitly.
The evidence notes distinguish observation from interpretation.
Remediation was verified after evidence collection.