Magnet Response Hands on Labs¶

Interactive Lab¶

Full Lab¶

Self hosted / real collection

Windows VM + evidence disk

Case SUSA-031 / follow the command

One command. One capture. A finding you can defend.

An incident note mentions unexpected PowerShell activity. Can you preserve the relevant history and explain what it tells you? Enter a harmless training command on one Windows VM, capture its history with Magnet Response, and find the recorded line in your saved evidence.

Tick a checkpoint only after saving its evidence. Progress is self reported; this page cannot check your VM.

Investigation brief¶

Case questionDoes the captured history contain our training command, and what can that record establish?

Collection scope

One Windows VM. Critical System Files › PowerShell history only. Save the capture to D:\SUSA-031\MagnetResponse.

Real case connection: Magnet Response preserves selected endpoint data for investigation. This exercise practises scope, attribution, integrity, and a bounded finding. A history string alone does not prove execution succeeded or identify who typed it.

Before you start¶

Need: a disposable Windows 10 or 11 VM you own, administrator access, Windows PowerShell 5.1 with PSReadLine, Magnet Response, a clean snapshot, and a separate writable evidence disk at D:. Keep that disk outside the rollback of the Windows disk.

Your route: open one numbered step at a time, run commands in the VM, and check each Look for result. Use the Windows PowerShell console, not ISE or a script run in the background, to create the history entry. Stay in the same Windows account throughout. No account or security setting changes are needed for the training command.

Need setup help?

Follow Install and open Magnet Response. Record the actual build's version, download source/date, archive filename and SHA-256 in your case notes. Review the licence before running it.

Attach a second virtual disk using your hypervisor. Initialise and format only that new, empty disk in Disk Management and assign D:. Resolve any existing use of D: first. Confirm it is separate from the Windows disk and has enough free space. Keep the program folder and the capture destination distinct; the examples use C:\Tools\Magnet Response for the program.

Run the helper commands as administrator in the VM. If elevation uses another account, that account has a different history path; use the account recorded in the case for the marker and source check. The browser lab contains fictional administrative command evidence; this full lab uses a harmless printed marker instead.

Activity 1: Prepare the environment¶

Your first winA recorded source profile and a command you can recognise later.

1. Check history recording and create a fresh case

Open Windows PowerShell as administrator on the training VM. PSReadLine saves console history to a file; it is separate from the session history shown by Get-History. Check the real save path rather than guess the user folder.

$mrCase = 'D:\SUSA-031'
$mrCaptureRoot = Join-Path $mrCase 'MagnetResponse'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1 for this lab.' }
$mrOptions = Get-PSReadLineOption -ErrorAction Stop
$mrOptions | Select-Object HistorySavePath, HistorySaveStyle | Format-List
if ($mrOptions.HistorySaveStyle.ToString() -eq 'SaveNothing') { throw 'History saving is disabled. Read the help before continuing.' }
if ((Split-Path $mrOptions.HistorySavePath -Leaf) -ne 'ConsoleHost_history.txt') { throw 'Use the Windows PowerShell console with its default history path.' }
if (Test-Path -LiteralPath $mrOptions.HistorySavePath) {
    if ((Get-Content -LiteralPath $mrOptions.HistorySavePath) -contains "Write-Output 'SUSA-031 harmless training marker'") {
        throw 'Marker already present. Use a fresh training snapshot.'
    }
}
Get-Volume -DriveLetter D -ErrorAction Stop |
    Select-Object DriveLetter, SizeRemaining, Size | Format-Table
if (Test-Path -LiteralPath $mrCase) { throw 'Case folder exists. Choose a new case path.' }
New-Item -ItemType Directory -Path $mrCase -ErrorAction Stop | Out-Null
New-Item -ItemType Directory -Path $mrCaptureRoot -ErrorAction Stop | Out-Null
[pscustomobject]@{
    Computer = $env:COMPUTERNAME
    User = "$env:USERDOMAIN\$env:USERNAME"
    Time = Get-Date -Format o
    TimeZone = (Get-TimeZone).Id
    HistoryPath = $mrOptions.HistorySavePath
    SaveStyle = $mrOptions.HistorySaveStyle.ToString()
} | Export-Csv -LiteralPath "$mrCase\source-context.csv" -NoTypeInformation
@('Case: SUSA-031 / authorised training VM', "Destination: $mrCaptureRoot",
  'Profile: Critical System Files / PowerShell history only') |
    Set-Content -LiteralPath "$mrCase\case-context.txt"
notepad.exe "$mrCase\case-context.txt"

Look for: your user/profile history path, a save style of SaveIncrementally or SaveAtExit, and a fresh case folder on D:. Add the clean snapshot name, authority and tool version/provenance to case-context.txt, then save it.

History recording is unavailable or disabled

Use the interactive Windows PowerShell console with PSReadLine loaded. SaveIncrementally writes after commands; SaveAtExit writes when the session exits. SaveNothing writes no history. On this disposable VM only, you may use Set-PSReadLineOption -HistorySaveStyle SaveIncrementally before the marker and record that training change. Do not change history settings on a real incident endpoint to manufacture missing evidence. If a custom path or history filter is configured, use a clean VM profile for this exercise. Microsoft documents the save styles.

2. Enter one harmless command and confirm it was saved

At the same interactive prompt, record a start bound for the controlled action:

Get-Date -Format o | Set-Content -LiteralPath "$mrCase\training-start.txt"

Type or paste this single line at the prompt and press Enter. It only prints text. Do not append it directly to the history file or put it in a .ps1 script; this exercise needs a console entered command.

Write-Output 'SUSA-031 harmless training marker'

Look for: SUSA-031 harmless training marker printed in the console. Save the end time and close the session normally so SaveAtExit can finish writing:

Get-Date -Format o | Set-Content -LiteralPath "$mrCase\training-end.txt"
exit

Open a new Windows PowerShell window in the same account and verify the saved source:

$mrCase = 'D:\SUSA-031'
$mrContext = Import-Csv -LiteralPath "$mrCase\source-context.csv"
$mrNeedle = "Write-Output 'SUSA-031 harmless training marker'"
if (-not (Test-Path -LiteralPath $mrContext.HistoryPath)) { throw 'History file missing. Check the recorded account, path and save style.' }
$mrSourceLines = @(Get-Content -LiteralPath $mrContext.HistoryPath -ErrorAction Stop)
if ($mrNeedle -notin $mrSourceLines) { throw 'Exact marker missing. Check history settings and the interactive session.' }
"Marker confirmed in: $($mrContext.HistoryPath)" |
    Set-Content -LiteralPath "$mrCase\source-check.txt"
Get-Content -LiteralPath "$mrCase\source-check.txt"

Use your actual case path if you changed it. Look for: confirmation that the exact command is in the recorded history file. Other helper commands will also appear in history; the distinctive, exact line is your clue. The saved start/end files are controlled action time bounds, not timestamps embedded in the history record.

Ready to capture I saved the VM, account, source history path, save style, snapshot, tool provenance and evidence destination. I entered the harmless marker interactively, saved its time bounds, and confirmed the exact line in the source history.Pause point: keep the case records. The console session has closed and the marker is saved.

Next: capture this history with a focused profile.

Continue to capture

Activity 2: Collect the focused set¶

Your next winOne scoped capture linked to its source, settings and run record.

Make your prediction

You know the marker was saved. If the capture returns its command text, does that alone prove who typed it or that it executed successfully? Keep that distinction in mind as you collect.

1. Configure only the history you need

Start Magnet Response as administrator on the same VM. Follow the capture guide for screenshots.

Setting	Choose for this lab
Case reference	`SUSA-031`
Collection option	Only Collect Critical System Files
Configure	Uncheck unrelated selections; choose only PowerShell history, then Save and Close
Other categories	Leave RAM, volatile data, extended process capture and general file collection off
Save output to	`D:\SUSA-031\MagnetResponse` (or your fresh case's `MagnetResponse` folder)

Look for: the focused profile and separate destination. Save a settings screenshot and write the actual version, case reference and selections into capture-notes.txt in the case folder. The program's default output may be beside its executable; change it to the evidence disk before capture.

2. Start capture and preserve its result

Record the start time, select Start Capture, and wait for completion. Before Exit, record the finish time, displayed outcome and exact saved output path in capture-notes.txt. Save the completion screen and warnings. Open the reported location and keep the entire output, including logs, collection metadata and any supplied integrity values.

Look for: a new case labelled result under your evidence destination. Depending on the build, the output can contain files or a consolidated ZIP. Follow the actual result, rather than expecting the screenshot's timestamp or folder size. You will review a copy in Activity 3.

No output, errors, or missing history?

What happened	First check
Capture cannot start	Check the case reference, saved profile, destination access and free space.
Output is a ZIP	Keep the original archive. Extract a working copy in Activity 3.
History is missing	Confirm the marker was saved before capture, the recorded Windows account/path, and the selected history profile.
Capture reports access errors	Retain the errors and affected paths; check administrator access. Completion is not complete coverage.
Need to retry	Keep the first run and logs. Use a new empty output folder, record why, and keep the two runs separately.

Capture preserved I saved the case reference, tool version, profile and destination settings. I kept the complete output, exact saved path, times, completion record, logs and warnings, including any retries.Pause point: you can close Magnet Response. The saved output is enough for the review.

Next: find the command in the captured evidence.

Investigate your capture

Activity 3: Review and report¶

Your final winA located history line and a finding with clear limits.

Returning in a new PowerShell window?

If you already created the working copy in Step 1, restore these variables and continue at Step 2. Use your actual case path if you changed it. You do not need to collect again or overwrite the existing working copy.

$mrCase = 'D:\SUSA-031'
$mrWorking = Join-Path $mrCase 'Working'

1. Fingerprint the original and create a working copy

Open Windows PowerShell on the VM. The commands below restore the case variables and ask for the exact output folder or ZIP path shown by Magnet Response. Paste the path without surrounding quotes. Use your actual case path if you changed it. Do not select the live source history or the program folder.

$mrCase = 'D:\SUSA-031'
$mrCaptureRoot = Join-Path $mrCase 'MagnetResponse'
$mrWorking = Join-Path $mrCase 'Working'
$mrRunItem = Get-Item -LiteralPath (Read-Host 'Paste the exact saved output folder or ZIP path') -ErrorAction Stop
$mrRun = $mrRunItem.FullName
if (-not $mrRun.StartsWith("$mrCaptureRoot\", [System.StringComparison]::OrdinalIgnoreCase)) {
    throw 'Select the actual result inside the recorded capture destination.'
}
if (-not $mrRunItem.PSIsContainer -and $mrRunItem.Extension -ne '.zip') { throw 'Select a capture folder or ZIP.' }
if (Test-Path -LiteralPath $mrWorking) { throw 'Working copy already exists. Keep it and choose a new working folder.' }
$mrRawFiles = if ($mrRunItem.PSIsContainer) {
    @(Get-ChildItem -LiteralPath $mrRun -Recurse -File -Force -ErrorAction Stop)
} else { @($mrRunItem) }
if ($mrRawFiles.Count -eq 0) { throw 'Empty output. Review capture errors.' }
$mrRawFiles | Get-FileHash -Algorithm SHA256 -ErrorAction Stop |
    Export-Csv -LiteralPath "$mrCase\capture-sha256.csv" -NoTypeInformation
$mrRun | Set-Content -LiteralPath "$mrCase\capture-path.txt"
New-Item -ItemType Directory -Path $mrWorking -ErrorAction Stop | Out-Null
Copy-Item -LiteralPath $mrRun -Destination $mrWorking -Recurse -ErrorAction Stop
Get-ChildItem -LiteralPath $mrWorking -Force | Select-Object Name, Length

Look for: a hash manifest outside the original capture and a copy under Working. If the copy contains a ZIP, use File Explorer's Extract All on that copied archive, choosing a new folder inside Working. Leave the original output and archive unchanged. Record extraction and any errors. If supplied tool integrity values have a documented verification method, verify them and note the result; your own SHA-256 manifest records the files you retained.

Use the review guide to recognise the saved tree. A typical relative path contains Saved_Files\PowerShell_History\C\Users\<user>\...\PSReadLine\ConsoleHost_history.txt; build specific wrappers can differ.

2. Find your exact command in the saved history

Run this in the same PowerShell window as Step 1, or restore the variables above. List candidates in the working copy, then choose the file under the same user profile path recorded in source-context.csv. Do not use the first result blindly: the capture may include several users. If there is no candidate, check ZIP extraction, source settings, and retained errors first.

$mrCandidates = @(Get-ChildItem -LiteralPath $mrWorking -Recurse -File -Filter 'ConsoleHost_history.txt' -ErrorAction Stop)
if ($mrCandidates.Count -eq 0) { throw 'No working history file. Check extraction, profile and logs.' }
$mrCandidates | Select-Object FullName, Length | Format-List
$mrHistory = (Get-Item -LiteralPath (Read-Host 'Paste the matching working history file path') -ErrorAction Stop).FullName
if ($mrHistory -notin $mrCandidates.FullName) { throw 'Choose a listed working-copy history file.' }
$mrNeedle = "Write-Output 'SUSA-031 harmless training marker'"
$mrMatches = @(Select-String -LiteralPath $mrHistory -Pattern ('^' + [regex]::Escape($mrNeedle) + '$'))
@("Working file: $mrHistory", "Exact matching lines: $($mrMatches.Count)") |
    Set-Content -LiteralPath "$mrCase\marker-result.txt"
$mrMatches | Select-Object Path, LineNumber, Line |
    Export-Csv -LiteralPath "$mrCase\marker-matches.csv" -NoTypeInformation
Get-FileHash -Algorithm SHA256 -LiteralPath $mrHistory |
    Export-Csv -LiteralPath "$mrCase\reviewed-history-sha256.csv" -NoTypeInformation
$mrMatches | Select-Object LineNumber, Line | Format-List

Look for: the exact Write-Output line, normally once in a fresh run. Keep the path, line number and file hash with it. The exact line search avoids counting helper commands that merely mention the marker. If zero lines match, inspect the selected file, spelling, account, capture times and source confirmation. More than one match needs an explanation. Save a no match result and errors as a limitation; do not append a marker to captured evidence to make it pass.

Your discovery: the captured file contains a command string associated with the recorded profile. Your training notes say you ran it, but the history file alone does not establish successful execution, an exact execution time or authorship. Do not assign the file's modification time to every command.

3. Make your call and write a short handover

Make the analyst's callThe saved history contains your marker. Which finding can you defend from that file?

Choose a finding, then use your actual result below.

Save this template as handover.txt in your case folder. A few clear sentences per finding are enough. Include a missing marker or collection failure honestly.

Case SUSA-031: preserve and examine PowerShell history.
Authority, VM, snapshot, Windows account and time zone:
Magnet Response version, download source/hash and focused profile:
Capture destination, exact output path, start/finish and outcome:
Logs, warnings, missing or unreadable files:
Original capture hash manifest and working-copy/extraction record:
Source profile path; reviewed file path/hash; matching line number/text:
Observation: what the captured history contains (or does not return).
Interpretation: supported meaning, confidence and reasons.
Limits: history can be incomplete; text alone does not prove success or authorship.
Next check: one independent source and the question it could answer.
Training ground truth: harmless command and recorded start/end time bounds.
Closeout: retained case opened and checked; disposable VM rollback recorded.

Choose a next check: look for relevant PowerShell Operational or process creation records, if they were already being recorded. Compare account, command/process context and time. Missing logs do not prove the command did not run; successful execution may need evidence of the command's actual effect. Keep this proposal separate from what the history already shows.

Optional challenge: what would change your confidence?

Imagine this was an administrative command rather than a harmless printed marker. Write two possible explanations for the recorded text: a command that failed, or an entry saved without execution. Then name evidence that would help distinguish them, such as a corresponding account change record or verified system state. PSReadLine can add a history entry without executing it, which is why recorded text needs corroboration.

For practical extension, plan a second, separately named capture containing an appropriate existing log source if your build supports it. Record the new scope and compare it with the first capture. Do not enable new logging and assume it recreates earlier events. This extension is not required for completion.

Case closeout4. Preserve the case before resetting the VM

Preserve first

Check the complete original capture, logs, case notes, hash manifests, working history and finding. Keep failed or retried runs too. Copy the case outside the VM or retain its separate evidence disk, and open the retained copy before rollback.

Close Magnet Response and PowerShell. Record the closeout in handover.txt, shut down the disposable VM, and restore the recorded clean Windows disk snapshot while keeping the evidence disk. This removes the training history through rollback. Do not clear, trim or delete captured history, and do not edit a real endpoint's history as a cleanup step.

Look for: the retained case is readable, and the reset VM is back at its documented baseline. If you postpone rollback, note that the harmless training entry remains on the disposable VM.

Ready for another analyst I saved original hashes, the working history result, and a handover with a finding, limits and a next check. I opened and checked the retained case, and recorded the disposable VM's rollback or postponed closeout.Completion is supported by saved evidence and explained gaps. The optional challenge adds no required checkpoint.

Finish with a finding someone else can verify from the saved history.

Review the evidence checklist

Full Lab evidence checklist¶

Case folder handoverSave the two checkpoints in each activity.

Contextcase-context.txt, source-context.csv, training-start.txt, training-end.txt and source-check.txt
CaptureComplete original output in MagnetResponse/, settings/completion screenshots, capture-notes.txt, capture-path.txt and retained logs
Findingcapture-sha256.csv, Working/, marker-result.txt, marker-matches.csv, reviewed-history-sha256.csv and handover.txt; explain missing records or hash errors

Your win: you followed one recorded command from the VM to a preserved capture and explained its meaning without overstating it. Keep the case evidence before snapshot rollback.

Magnet Response Hands on Labs¶

Interactive Lab¶

Magnet Response Interactive Lab

Was a command to add an administrator saved?

Locations / Files to Collect:

Choose what to check next