When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is necessary.
I am envisioning a batch script that collected all the basic information about the system (e.g. open network connections, IP addresses, host name, logged on user, local administrators, etc.) and then takes a memory dump using Memorize or similar tool for later analysis.
It would be more efficient if we would run these scripts remotely rather than connecting a thumb drive to the machine with the tools loaded but my concern is that copying the tools to the suspect machine would modify the file system and would be bad for forensics purposes.
Are there any other good options for collecting this information remotely without compromising the forensic data? I am aware of PSexec but tools like memorize will still have to be copied to the remote machine. Perhaps putting all the tools on a read-only share, and redirecting the data back to the analysis workstation with netcat or cryptcat?
Thanks!