# Malware Safe Handling Practices

## Golden Rules

1. **Isolate**: Always work in isolated VMs or dedicated analysis machines
2. **Archive**: Store in password-protected ZIP archives (password: "infected")
3. **Rename**: Change executable extensions (.exe → .exe.sample)
4. **Hash**: Verify integrity with SHA256 before and after transfers
5. **Document**: Maintain chain of custody records
6. **Dispose**: Securely delete samples when no longer needed

## Storage Guidelines

### File System
- Dedicated partition or drive for sample storage
- Encrypted storage recommended (LUKS, BitLocker, VeraCrypt)
- Disable auto-indexing on sample directories
- Exclude from antivirus scanning (or use dedicated AV-free VM)

### Naming Convention
```
<sha256_prefix>_<family>_<date>.<original_ext>.sample
```

### Directory Structure
```
samples/
├── quarantine/     # Newly acquired, unprocessed
├── active/         # Currently under analysis
├── analyzed/       # Analysis complete, report generated
├── reference/      # Known-good samples for comparison
└── logs/           # Acquisition and handling logs
```

## Transfer Protocols

### Between Systems
- Use SCP/SFTP over encrypted channels
- Always use password-protected archives
- Verify hashes after transfer
- Never transfer over unencrypted channels

### To/From Cloud
- Use encrypted containers (VeraCrypt)
- Verify cloud storage encryption settings
- Be aware of cloud provider scanning policies
- Some providers automatically delete malware

## Chain of Custody

For each sample, record:
- **Source**: Where obtained (URL, email, forensic image)
- **Timestamp**: When acquired (UTC)
- **Handler**: Who handled the sample
- **Hash**: SHA256 at time of acquisition
- **Transfers**: Each time sample was moved/copied
- **Analysis**: What analysis was performed
- **Disposition**: Final status (archived, deleted, shared)

## Incident Response Considerations

- Preserve original evidence (work on copies)
- Maintain write-once logs
- Follow organizational evidence handling policies
- Consider legal requirements for your jurisdiction