CyberPipe

CyberPipe (formerly CSIRT-Collect) is a PowerShell script designed for Digital Forensics and Incident Response (DFIR) investigations. It automates the collection of memory and disk forensics data using several specialized tools.

Core Capabilities:

• Memory Capture: Uses MAGNET DumpIt (x86, x64, ARM64) or MAGNET RAM Capture.
• Triage Data Collection: Uses MAGNET Response CLI with selectable profiles.
• Encryption Detection: Uses MAGNET Encrypted Disk Detector to find full disk encryption.
• BitLocker Recovery: Automatically recovers BitLocker Recovery Keys from encrypted volumes.
• Data Storage: Saves output to local USB devices or network shares.
• Reporting: Provides real-time progress monitoring and comprehensive reports including volatile data and integrity hashes.

CyberPipe uses collection profiles to determine which artifacts are gathered. You can select a profile using the -CollectionProfile parameter.

Available Profiles:

• QuickTriage: Volatile + System Files (no RAM). Completes in ~2 minutes.
• Volatile: Only volatile data (network connections, registry, running processes).
• RAMOnly: Memory dump only.
• RAMPage: RAM + Pagefile.
• RAMSystem: RAM + Critical System Files.
• Default (Full Triage): RAM + Pagefile + Volatile + System Artifacts (this is the default if no profile is specified).

To use CyberPipe, ensure the following tools and binaries are available in the expected locations:

1. External Tools:

   • MAGNET DumpIt for Windows
   • KAPE
   • Encrypted Disk Detector (EDDv310.exe)

2. Required Binaries in /modules/bin:

   • DumpIt.exe (64-bit)
   • DumpIt_arm.exe (ARM release)
   • DumpIt_x86.exe (x86 release, optional)
   • EDDv310.exe (located in /modules/bin/EDD)

3. Deployment Pattern: Place CyberPipe.ps1 directly next to your KAPE directory (on a USB or network share). The script will automatically handle the creation of necessary subfolders.

CyberPipe requires a Tools directory containing the necessary forensic binaries. The location of this directory depends on your collection method:

For USB/Local Collections: Place the Tools directory in the same folder as the script.

E:\Triage\CyberPipe\CyberPipe.ps1
E:\Triage\CyberPipe\Tools\

For Network Collections: Place the Tools directory in the root of the network share.

\\Server\share\Tools\

To use CyberPipe, you must have the following tools installed and available in your Tools directory:

1. MAGNET Response
2. MAGNET Encrypted Disk Detector

CyberPipe can save all collected data directly to a network share using the -Net parameter. When using this flag, you must provide a UNC path. The script will automatically map the network drive and perform the collection.

This is useful for automated workflows triggered by EDR or SOC alerts.

Examples:

# Basic network collection
.\CyberPipe.ps1 -Net "\\server\share"

# Network collection with a specific profile
.\CyberPipe.ps1 -Net "\\server\share" -CollectionProfile QuickTriage

# Network collection with compression
.\CyberPipe.ps1 -Net "\\server\share" -Compress

.
# Basic network collection
.\CyberPipe.ps1 -Net "\\server\share"

# Network collection with specific profile
.\CyberPipe.ps1 -Net "\\server\share" -CollectionProfile QuickTriage

# Network collection with compression
.\CyberPipe.ps1 -Net "\\server\share" -Compress

By default, the script is configured for local/USB usage. To perform a collection over a network, you must modify the script to uncomment the “Network Collection” section.

You must update the network path (e.g., \Server riage) to match your environment. Your KAPE folder must reside under this specified directory.

Note on Permissions: Access to the network directory depends on your environment's permissions and whether the script is running via interactive session or automation.