Data from Local System

A compromised host may already hold useful data

Collection from a local system gathers information available on the accessed host. Sources can include documents, configuration files, local databases, application data, and other accessible material. What an actor can collect depends on the effective identity, permissions, encryption state, and system configuration.

The presence of sensitive information on a device does not establish that it was collected. Investigators should distinguish what the actor could access from the reads, copies, or artifacts actually supported by evidence.

A process reads several project folders

In a fictional endpoint case, a program launched from an unexpected location accesses files across multiple project directories. The analyst examines process identity, file paths, access events where available, timing, and any output files or archives.

An indexing service, backup program, or approved search tool could also read broadly. Compare the process with its expected owner, installation source, schedule, and normal behavior. A high volume of access is a useful lead but not a complete explanation.

If the process creates a new package of documents, preserve the artifact and relevant metadata through controlled handling. The package may contain confidential information, so avoid copying its contents into an unrestricted investigation ticket.

Interpret file evidence precisely

A directory listing indicates discovery of names, not necessarily reading file contents. A read event may show access to a particular object without establishing that every byte was retained. A copied file or archive can provide stronger evidence of collection, subject to its provenance and contents.

Monitoring coverage matters. Some environments record detailed file access only for selected resources or under specific audit settings. An empty search should not become a claim that no local information was accessed unless the relevant coverage supports it.

Automated Collection describes repeated rule-driven gathering. Archive Collected Data describes packaging, and Data Staged describes preparation in a convenient location. These related actions should remain distinct in the timeline.

Address access as well as artifacts

Contain the harmful process or host as justified, preserve useful evidence, and investigate how the actor obtained the access. Deleting a collected package does not protect the original documents if the compromised identity remains able to read them.

For practice, compare a legitimate backup with an unexplained process reading restricted project files. Identify which process, file, schedule, and owner records distinguish the activities. Then remove the file-read telemetry from the scenario and revise the conclusion to reflect the evidence gap. Incident response coordinates the wider work, while Incident reporting and handover separates confirmed collection from merely possible exposure.

Related concepts

• MITRE ATT&CK
• Logs and telemetry
• Command and Scripting Interpreter