A live collection is an interaction with a changing system. Its value depends partly on whether a reviewer can distinguish the system's earlier activity from actions introduced by responders. A change ledger makes that distinction inspectable. It complements the evidence manifest: one describes intervention, while the other identifies collected objects.
Define the question and the intervention budget
Write the immediate evidence question, the authorized host scope, and the source that may be lost through delay. Identify the planned collection method and why its effects are acceptable for that question. A decision to collect volatile material may be reasonable even when the action changes the host. Explain the tradeoff at the time of the decision; do not reconstruct a confident rationale from memory after results arrive.
Create a ledger before execution
For each planned action, assign an identifier and record the operator, tool version, source of the collector, expected start time, intended output destination, and expected side effects. Separate a vendor-documented effect from an assumption based on prior use. If exact behavior is unknown, mark it unknown. Include remote management and containment actions when they can affect interpretation of the same host or interval.
Record the action that occurred
Capture actual start and end times, the clock basis, exit status, collected output, errors, and any deviation from the plan. Record interruptions, repeated attempts, and an unexpected prompt or permission change. Keep command or task parameters where appropriate, with secrets removed from the review copy. Maintain the protected original record according to the applicable handling process. Do not silently replace a failed attempt with its successful retry.
Separate prediction from observation
Use three fields: expected change, observed change, and basis for attribution. A process appearing during collection may be consistent with the collector; that does not prove every neighboring event had the same cause. Correlate the action identifier, time interval, executable identity, and source records. Leave uncertain relationships unresolved. A tested reproduction on a comparable disposable system can clarify a mechanism, but it cannot recreate the examined host's earlier state.
Keep a parallel system timeline
Present responder actions alongside the incident timeline with an explicit label. Retain differences between the host clock and the collection workstation clock. If containment affects connectivity, explain which later observations reflect the changed environment. A missing later network event after isolation cannot be interpreted as if the machine still had its previous access. Preserve relevant remote records before their retention windows expire.
Report the consequence for each conclusion
Identify the findings that remain supported despite intervention and those that cannot be separated from it. A statement such as “this file was present in the collected output” can be stronger than an unsupported statement about when it first appeared. State the causal limit directly. The aim is an accountable collection, not an assertion that the system experienced no change.
- Preserve clock context
Keep intervention times and event times traceable.
- Resolve conflicting output
Investigate input and interpretation differences before choosing a preferred result.