post-incident-ot-forensicslisted

## When to Use - Evidence collection after containment in an OT incident. - Building an incident timeline across controllers, HMIs, historians, and network devices. - Preserving evidence before systems are restored or re-imaged. - Supporting legal, regulatory, or insurance follow-up on an OT incident. ## Prerequisites - Containment record from the response skills. Evidence collection follows containment, not before. - Decision authority confirmed: operations manager for anything that touches a running process, safety engineer for anything on a controller. - Forensic share with controlled access and write-once storage if available. - sha256sum or an equivalent hash tool. - Chain-of-custody form per the site's legal or regulatory requirement. - Credentials: read-only on logs and historian, engineering access only where gated. - Authorization: operations manager approves evidence collection on live systems. The safety engineer approves any controller interaction. - Upstream skills: `ot-incident-triage`, `ot-network-isolation-procedure`, and the containment record. ### Safety This skill is passive by default. Collection reads live systems and exports files. Any step that changes a device is gated. - Passive. Reads logs, captures traffic, exports data. Safe to run during normal operations. ## Workflow > SAFETY: If at any point the action risks human safety or process integrity, halt and escalate to the operations lead before continuing. 1. Confirm the decision authority a