/hub/runs/protectli-evidence-retention-recovery
Published resultTest date: 2026-10-14Tested system: Protectli Vault + Windows evidence host

Home SOC: Evidence Collection, Retention and Recovery

The firewall records also need to survive review and a restart. These checks cover Vault event forwarding, the Windows evidence tools, rolling storage and recovery after sign-in, with the maintenance gaps and failed readings kept in the record.

This page keeps the shared controls, retained measurements, failures, and comparison limits together. The linked files are there when you need the underlying table or method.

What you can compare here

This is a two-machine workflow: the Vault supplies events and native observations, while Windows receives, indexes and serves them. Scheduled recovery requires Windows sign-in, and USB sampling needs an authenticated appliance console after a Vault reboot. The Hub is a saved result record, not a live health monitor.

Related pages

Read the article Project repository

You can reuse Trevor-measured data from this page under the repository MIT terms. Retain the required notices when reusing the project documentation, and credit Trevor Unland when citing this run. Project media has separate terms in the repository.

Recorded results

Open the details under any row for the specific setup, outcome, artifact identity, and supporting file.

Simulated events through the real handlers

Isolated loopback receiver and evidence builder

Published result

Tested system: Protectli Vault + Windows evidence host · Two-machine evidence workflow; isolated host replay

Replay cases
17 cases
Actual simulated engine outputs.
Received datagrams
153 datagrams
Separate loopback receiver.
Verified original references
7 references
Exact source checks.
Pipeline and fault checks
75 tests
Historical isolated software suite; distinct from the later 250-check retention suite.

17 cases delivered 153 datagrams with the expected SID/action counts; seven original references verified and the report/source routes returned HTTP 200. These were replay receipts, without model inference. The separate local pipeline/fault lane passed 75 software tests using temporary stores and mocked failure conditions.

Setup and original evidence

Protectli V1610 · Windows Python receiver, evidence builder and dashboard · Two-machine evidence workflow; isolated host replay · Isolated loopback receiver and evidence builder

Pinned results and methodActual test host

Activated rolling storage

Current policy · fixture-tested expiry and live activation

Published result

Tested system: Protectli Vault + Windows evidence host · Windows evidence storage

Preserved setup baseline
310110946 bytes
Nine original members, including failures; immutable baseline separate from ordinary expiry.
Hot budget
1024 MiB
1 GiB originals, active rollover at 32 MiB.
Cold budget
4096 MiB
4 GiB compressed sealed segments.
Ordinary sealed-segment window
7 days
After sealing; capacity may shorten it. Disposable-fixture expiry test, not a full live seven-day observation.

The live migration preserved all setup bytes and returned new Vault receipts without a full/storage-error state. Hot originals roll at 32 MiB into a verified compressed cold tier; ordinary sealed segments expire seven days after sealing or earlier under capacity pressure.

Setup and original evidence

Protectli V1610 · Windows Python / rolling-v2 / SQLite · Windows evidence storage · Current policy · fixture-tested expiry and live activation

Pinned results and methodActual test host

Saved review sources and retrieval

Separate pins · exact hashes · visible expiry

Published result

Tested system: Protectli Vault + Windows evidence host · Windows evidence storage

Pinned-source budget
64 MiB
Separate from hot/cold ordinary storage.
Pinned-record limit
4096 records
New note refused at the limit, without stopping collection.
Pre-activation regression checks
250 tests
Software/fixture checks, not independent incidents.

New operator notes preserve their cited raw records under a separate 64 MiB / 4,096-record budget. A full pin budget refuses another note while collection continues; an expired unpreserved source returns HTTP 410. The pre-activation suite passed 250 tests, including storage and recovery fixtures.

Setup and original evidence

Protectli V1610 · Windows Python / rolling-v2 / SQLite · Windows evidence storage · Separate pins · exact hashes · visible expiry

Pinned results and methodActual test host

Actual reboot and sign-in recovery

Recorded appliance reboot and newer Windows boot

Published result

Tested system: Protectli Vault + Windows evidence host · Vault + Windows sign-in recovery

Vault login prompt
59 seconds
Approximate observed appliance reboot interval, separate from full application readiness.

The Vault reached its login prompt in about 59 seconds. After Windows reboot and sign-in, recovery started the owned components and the next check reused them without duplicates. Original log prefix, notes and backup hashes matched; certificate-valid HTTPS, direct Vault DNS and exact UID/EVE correlation passed.

Setup and original evidence

Protectli V1610 · Vault boot / Windows Task Scheduler and PowerShell · Vault + Windows sign-in recovery · Recorded appliance reboot and newer Windows boot

Pinned results and methodActual test host

Scheduled dashboard restoration

Later ownership-receipt repair, without a new reboot

Published result

Tested system: Protectli Vault + Windows evidence host · Windows sign-in and five-minute recovery

A manual receiver launch had left a stale recovery-owner receipt. After exact ownership reconciliation, the scheduled task restored the dashboard and reporting runtime, then repeated the restoration after an idle dashboard stop without stopping collection. Original files/prefixes verified. This repair was not a new sign-out/sign-in or reboot test.

Setup and original evidence

Protectli V1610 · Windows Task Scheduler / PowerShell 7 · Windows sign-in and five-minute recovery · Later ownership-receipt repair, without a new reboot

Pinned results and methodActual test host

Retained operation and observation gaps

Historical snapshot, not current live health

Published result

Tested system: Protectli Vault + Windows evidence host · Vault + Windows evidence workflow

Timestamped observations
352 observations
Retained Oct 5–7 snapshot; not independent incidents.
Sampled core minimum
30 °C
Operating observations, separate from guarded load.
Sampled core maximum
56 °C
Operating observations, separate from the 62 °C load peak.
Observation gaps over ten minutes
5 gaps
27 min, 12 min, 11h57, 20 min and 12 min.

352 observations recorded sampled cores at 30–56 °C, with no sampled full/storage-error/capacity-warning state. Five gaps exceeded ten minutes, including an 11h57 host interruption; one native reading had unknown fields and another was stale. Maintenance and UDP receipt uncertainty remain visible.

Setup and original evidence

Protectli V1610 · Vault native sensors / Windows observation journal · Vault + Windows evidence workflow · Historical snapshot, not current live health

Pinned results and methodActual test host

Clock correction and event timing

Point-in-time host/appliance clock comparison

Published result

Tested system: Protectli Vault + Windows evidence host · Vault + Windows evidence workflow

Post-repair clock difference
46 ms
Approximate independent host/appliance comparison after successful resync.

The Windows time-service repair completed a successful resync and cleared its synchronization warning. A direct comparison then showed about 46 ms difference from the Vault. Earlier records with roughly 20 seconds of skew stayed unchanged; these offsets are not network latency or a clock-drift study.

Setup and original evidence

Protectli V1610 · Windows W32Time / Vault clock · Vault + Windows evidence workflow · Independent clock check after repair

Pinned configuration and clock checksActual test host

Supporting evidence

Results and method

These are the few files that support this page directly. The repository holds the wider project history.

Isolated pipeline and fault checks 17 replay cases and the historical 75-test software lane.Activated rolling retention Current capacities, baseline preservation, pinning and tested expiry.Actual restart and recovery Recorded appliance reboot and Windows boot/sign-in acceptance; earlier budgets are historical.Later scheduler repair Executed scheduled recovery and collection-preserving dashboard restoration.Observed operation and gaps Timestamped observations, interruptions and freshness limits.Clock and path configuration IPv4 scope, interface controls and point-in-time time-service repair.

Controls

  • Exact client/EVE correlation and original-source hashes checked forwarding and retrieval; device and receiver timestamps stayed separate.
  • Original log prefixes, configuration exports, notes and archives were preserved before restart and storage migration.
  • Disposable stores tested rollover, cold retrieval, expiry, pinning, tamper refusal and restart. Age expiry was not presented as seven days of elapsed live operation.
  • Sign-in/five-minute recovery uses Interactive/Limited ownership checks. A foreign port owner is refused rather than adopted or terminated.
  • Loopback fault fixtures and simulated engine output use separate receivers and temporary stores, without changing production evidence.

What this run established

  • $Actual Vault and Windows reboot checks recovered the owned path and source-backed records. Later scheduled recovery repair restored the dashboard without restarting collection.
  • $Rolling-v2 replaced the historical stop-at-200-MiB cap; the migration preserved all 310,110,946 setup-evidence bytes, including failed attempts.
  • $The retained operating snapshot has 352 observations, five gaps over ten minutes, one unknown native observation and one stale observation. It cannot be described as uninterrupted collection.
  • $The first post-reboot model HTTP 500 and native completion-detection timeout remain recorded. AI answer quality belongs on the Minisforum page, outside these firewall/evidence results.

The Lab Notes

Get an email when I publish new hardware reviews, benchmarks, and security research. Unsubscribe anytime.

Email goes to Buttondown. Privacy details.

© 2026 Trevor Unland. All rights reserved.

PrivacyTermsRSS Feed

$ echo "Built with React + TypeScript"