ZEKASTRA case pack VP-05 - acquisition log - SYNTHETIC TRAINING DATA

Case: Meridyen Mimarlık Ltd. - file server MRD-FS01 - internal reference MRD-2026-014
Collected by: incident response examiner, account ir.examiner
All times UTC.

2026-05-11 07:21:40  Collector MRD-WEC01: ForwardedEvents exported for Computer = MRD-FS01.meridyen.example, window above; parsed to CSV.
2026-05-11 07:30:12  MRD-FS01, live response session (console): Sysmon/Operational and Security .evtx copied with the raw-copy tool; Sysmon parsed with EvtxECmd.
2026-05-11 07:34:55  MRD-FS01: $MFT of C: copied; parsed with MFTECmd; excerpt filtered as stated in export-metadata.txt.
2026-05-11 07:36:20  MRD-FS01: C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\WinSvcUpdate copied as WinSvcUpdate.xml (UTF-16 with CRLF line ends in the original; converted to UTF-8 with LF line ends for this pack, content unchanged).
2026-05-11 07:36:41  MRD-FS01: C:\ProgramData\rc\rclone.conf copied.
2026-05-11 07:52:03  MRD-FW01: session log export, rule out-internet, window in local time as stated.
2026-05-11 08:05:00  Hashes computed for every file and written to manifest.txt.

Clock check at collection: MRD-FS01 and MRD-WEC01 agreed with the domain time source within 1 second. MRD-FW01 showed 10:51:58 local time at 07:51:58 UTC.