{"id":18864871,"url":"https://github.com/rshipp/ir-triage-toolkit","last_synced_at":"2025-04-14T13:21:31.034Z","repository":{"id":9608275,"uuid":"11531802","full_name":"rshipp/ir-triage-toolkit","owner":"rshipp","description":"Create an incident response triage toolkit for use with Windows or Linux.","archived":false,"fork":false,"pushed_at":"2020-06-14T23:47:03.000Z","size":6772,"stargazers_count":17,"open_issues_count":0,"forks_count":11,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-04-05T09:58:07.323Z","etag":null,"topics":["checksum","incident","incident-response","linux","shell","toolkit","volatile-data","windows"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rshipp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-07-19T16:12:28.000Z","updated_at":"2024-08-12T19:12:03.000Z","dependencies_parsed_at":"2022-08-25T21:40:18.888Z","dependency_job_id":null,"html_url":"https://github.com/rshipp/ir-triage-toolkit","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fir-triage-toolkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fir-triage-toolkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fir-triage-toolkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fir-triage-toolkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rshipp","download_url":"https://codeload.github.com/rshipp/ir-triage-toolkit/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248886334,"owners_count":21177645,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["checksum","incident","incident-response","linux","shell","toolkit","volatile-data","windows"],"created_at":"2024-11-08T04:44:19.952Z","updated_at":"2025-04-14T13:21:30.995Z","avatar_url":"https://github.com/rshipp.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"ir-triage-toolkit\r\n=================\r\n\r\nCreate an incident response triage toolkit for use with Windows or\r\nLinux, without violating any license agreements or copyright\r\nrestrictions.\r\n\r\n## Description\r\nA collection of scripts that can be used to create a toolkit for\r\nincident response and volatile data collection. This includes bash\r\nscripts to create a Linux toolkit, and Batch scripts to create a Windows\r\ntoolkit.\r\n\r\n## Usage\r\n1. Dowload and extract the [zip](https://github.com/george2/ir-triage-toolkit/archive/master.zip).\r\n2. Open a shell, and change directory to wherever the zip was extracted.\r\n3. Run the script.\r\n\r\nWindows:\r\n\r\n    create-toolkit E:\\Store\\it\\here\r\n\r\nLinux:\r\n\r\n    ./create-toolkit /store/it/here\r\n\r\nNote: Steps 1-3 should be run on a non-involved machine, preferably\r\nbefore an incident even occurs. The toolkit it creates should be stored\r\non a USB drive or similar location, where it can be used in case an\r\nincident does occur.\r\n\r\nOnce the toolkit has been created, you can use it by opening a shell in\r\nthe directory where the toolkit is stored, and starting the volatile\r\ndata collection script:\r\n\r\nWindows:\r\n\r\n    run E:\\Store\\my\\volatile\\data\\here\r\n\r\nLinux:\r\n\r\n    ./run /store/my/volatile/data/here\r\n\r\nBe sure the directory in which you choose to save the volatile data has\r\nplenty of space (several GB, at least), as the script will dump the\r\ncontents of the system's memory, and store several other files of\r\nvarying sizes. Both Windows and Linux scripts accomplish the same basic\r\ntasks (see tasks.txt), and both follow the order of volatility (OOV) for\r\ndata collection as much as possible. They also create detailed,\r\ntimestamped logs of the commands executed, and create sha256 checksums\r\nof the files saved to the storage directory. Be prepared for the scripts\r\nto run for a while, as it may take some time to image and compute a\r\nchecksum of the system's memory.\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frshipp%2Fir-triage-toolkit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frshipp%2Fir-triage-toolkit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frshipp%2Fir-triage-toolkit/lists"}