Understanding Live Triage

Live response and triage is the focused examination of a running system to understand its current state, preserve time-sensitive evidence, and decide what should happen next.

What you will learn

By the end, you should be able to explain why collection order matters, distinguish triage from full examination, and choose a proportionate first action.

Live response and triage

Core concept

Live response gathers relevant information while a computer is running. Triage uses that information to assess urgency, scope, and the next evidence requirement. The aim is not to collect everything; it is to answer defined questions while avoiding unnecessary change.

System timeProcessesConnectionsUsersTargeted artefacts

Keep in mind: Every action on a live system changes it. Record commands, tools, times, outputs, and errors so the effect can be understood.

01VolatilityHow quickly evidence can change or disappear02TriageA rapid assessment that guides priority and next steps03ProvenanceWhere evidence came from and how it was handled

What live triage is not

Live triageFocused collection and assessment on a running system

Disk imagingA sector-level acquisition of persistent storage

Memory analysisDetailed examination of an acquired memory image

Full forensic examinationComprehensive analysis performed after preservation

Why it matters

Protect short-lived evidence

Running processes, connections, logged-on users, and decrypted material may disappear at shutdown.

Focus the investigation

Rapid facts help identify affected systems, relevant accounts, and the next evidence source.

Support proportionate action

Triage helps analysts balance evidence value, operational impact, and investigative urgency.

Preserve context

Contemporaneous notes connect each output to the system state, tool, time, and analyst action.

Collection workflow

1. Authorise and scopeRecord authority, the investigation question, the target system, and allowed actions.
2. Record the starting stateCapture system time, identity, network configuration, and obvious signs of disruption.
3. Prioritise volatilityCollect the most valuable evidence that is likely to disappear first.
4. Acquire targeted artefactsUse suitable tools and store outputs on a controlled destination.
5. Assess and preserveVerify outputs, document limitations, and decide whether to contain, collect more, or perform offline examination.

Practice scenario

Work through the case in order. Each decision reflects a choice an analyst must make before a collection command is run.

01 · ScopeAn alert names WIN11-LAB, but your case note names only FINANCE-07. What should you do?

Begin remote collection from WIN11-LAB immediatelyPause and have the case scope clarified before touching WIN11-LABAdd WIN11-LAB to the case note yourself

Choose the action that protects both the evidence and the analyst.

02 · PreserveThe authorised workstation has a suspicious external connection and an unknown PowerShell process. What is the most defensible first action?

Disconnect power immediately without recording anythingRecord the state and collect relevant volatile evidence using an authorised methodCopy every file from the system before taking notes

Prioritise the evidence most likely to change or disappear.

03 · ExplainYour collection shows powershell.exe launched by winword.exe from an unusual path. What can you report now?

The user definitely executed malwareThe process relationship is a suspicious lead requiring preservation and corroborationThe activity is safe because PowerShell is a Microsoft tool

Separate the observation from its possible explanation.

Quality checklist

Start with an evidence question

Is this process and connection expected, and what evidence will let us decide?

1. 1ObserveRecord the starting state before changing it.
2. 2PrioritiseCollect relevant evidence by volatility and value.
3. 3VerifyCheck outputs and document gaps or errors.
4. 4DecideContain, expand collection, or move to offline analysis.

!Plan for operational friction

Tool blockingLimited privilegesClock driftLarge outputsRemote latencySystem change

Record what could not be collected and how the collection method may have affected the system.

Choose a tool

Targeted artefacts

KAPE

Collect and process selected forensic artefacts quickly.

Remote collection

Velociraptor

Query endpoints and perform repeatable artefact collection or hunts.

PowerShell triage

Kansa

Collect focused Windows response data using PowerShell modules.

Continue learning

• Explore KAPE for targeted artefact collection and processing.
• Explore Velociraptor for remote queries, collection, and hunts.
• Explore Magnet Response for a portable response workflow.