Triage collection

A triage collection acquires a targeted set of high-value files from a system instead of imaging the entire disk. A typical Windows collection includes the registry hives and their transaction logs, event logs, NTFS metadata such as the $MFT, $UsnJrnl and $LogFile, Prefetch, Amcache, SRUM, browser data, LNK files and Jump Lists. It usually amounts to a few hundred megabytes to a few gigabytes and can be gathered in minutes, which makes it practical across many machines.

Common free tools are KAPE, whose targets define what to collect (the KapeTriage compound target is a widely used starting point); Velociraptor, through the Windows.Triage.Targets artifact, either from a server or as a standalone offline collector executable; and the open-source CyLR collector.

Many important files are locked by Windows while it runs, so these tools read the volume through raw NTFS access rather than normal file APIs. That lets them copy in-use hives and NTFS metadata files, and some can also pull files from volume shadow copies.

The trade-off is completeness. A triage collection does not contain unallocated space, file slack or the content of deleted files, so carving and deep recovery are not possible afterwards. Record hashes and collection logs to preserve the chain of custody, and respect the order of volatility: memory should be captured before a disk triage when it matters.