You have two options with this, you can either click the batch script which will run it with 'normal' privileges (on Windows Vista and newer, this means not as an Administrator, on XP it runs with Admin privileges). Inside this folder you will see a bunch of folders that contain the tools that we are going to leverage, as well as the file 'Windows_Live_Response.bat'. Once you have extracted the file, navigate to the Windows_Live_Response folder.

Once you have the zip file downloaded, you should extract it to either the system you want to gather the information from or (my preference) an external USB device. LiveResponseCollection-Cedarpelta.zip - download here (Marc has put a TON of work into his tool and if you are performing any type of malware analysis and you are not using it, you should add it to your toolset collection immediately!) I updated the zip file today (2 April 2014) with PEStudio 8.17 ( ) in order to perform some malware information gathering on-site if needed.

The first step is to ensure that you have downloaded the latest copy of the Live Response zip file. The topic of today's post is to create a small walk-through guide of how to accomplish this collection from start to finish on a Windows system.

be able to quickly perform some volatile data collection in an automated fashion. As many long time readers of this blog know, one of my goals has been to put together a Live Response tool collection that helps IT professionals/Incident Responders/GeekSquad employees/etc.

Pestudio tutorial