﻿EmergentRI Security Desk - Evidence Collector (Windows)
=======================================================

1. On a CLEAN computer, download the zip and EXTRACT it: right-click the zip -> "Extract All..." -> onto a USB stick.
   (Double-clicking RUN-ME.cmd while it is still inside the zip does nothing - Windows only unpacks that one file.)
2. Take the affected computer OFF the network (cable out, Wi-Fi off). Do not restart it first.
3. Plug in the stick, open the extracted folder, double-click RUN-ME.cmd.
   Windows will ask "Do you want to allow this app to make changes?" - say Yes (that is only so the
   Security event log can be exported). You may also see "Windows protected your PC": click More info,
   then Run anyway. (The script is plain text - open collect-evidence.ps1 in Notepad to read every line.)
4. About two minutes. When it says Done, an EVIDENCE folder is on the stick, next to RUN-ME.cmd.
   Take the stick to the clean computer and upload that folder at https://emergentri.com/security
   (Open the Security Desk -> attach the folder).

It is READ-ONLY. It copies logs, startup entries, installed programs, remote-tool traces and account
history into the EVIDENCE folder. It does not clean, delete, repair or change anything. It works for any
user account on any Windows 10 or 11 machine - nothing in it is tied to a name or a drive letter.

Why it is a script and not a signed .exe: a signed installer costs a code-signing certificate and a
build pipeline; we chose to ship the readable version first so you can see exactly what runs.

v2.3 (2026-10-16) - FORENSIC ADDITIONS: copies the remote-tool LOGFILES that record where a session came from (TeamViewer
logfile and outgoing connections, Remote Utilities logs and config, Supremo, LogMeIn Rescue, UltraViewer, Splashtop, ScreenConnect),
the Windows firewall log, every logon with its source address and type (65-logons-with-source.csv), service installs (66), Remote
Desktop sessions (67/68), PowerShell script blocks (69), the machine's identity and serials (80), and a SHA-256 of every collected
file (99-MANIFEST-sha256.txt) so the folder can be handed to law enforcement as evidence with a chain of custody.
IMPORTANT: copy the WHOLE folder to the clean computer. The web upload keeps only readable text files; the .evtx / .log / .csv
files are the forensic part and travel on the stick.
