CyberPipe v5

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

Functions:

• 🐏 Capture a memory image with MAGNET DumpIt for Windows, (x32, x64, ARM64), or MAGNET RAM Capture on legacy systems;
• 💻 Create a Triage collection* with MAGNET Response;
• 🔐 Check for encrypted disks with Encrypted Disk Detector;
• 🔑 Recover the active BitLocker Recovery key;
• 💾 Save all artifacts, output, and audit logs to USB or source network drive.

*There are collection profiles available for:

• Volatile Artifacts
• Triage Collection (Volatile, RAM, Pagefile, Triage artifacts)
• Just RAM
• RAM & Pagefile
• or build your own using the RESPONSE CLI options

Prerequisites:

• MAGNET Response
• MAGNET Encrypted Disk Detector

Network Collections:

CyberPipe 5 also has the capability to write captures to a network repository. Just un-comment # the Network section and update the \\server\share line to reflect your environment.

In this configuration it can be included as part of automation functions like a collection being triggered from an event logged on the EDR.

Prior version (KAPE support):

If you're a prior user of CyberPipe and want to use the previous method where KAPE facilitates the collection with the MAGNET tools, or have made other KAPE modifications, use v4.01 CyberPipe.v4.01.ps1

Note: this script was previously titled CSIRT-Collect. Project name and repo updated with version 4.0.

For more information visit BakerStreetForensics.com