Forensic artifact collection for Windows. One script, 50+ artifacts, zero dependencies.
One PowerShell script. No agents, no dependencies, no configuration needed.
Collects processes, network, persistence, execution artifacts, registry hives, and event logs.
Read-only operations. No system modifications. SHA256 hash manifest.
Optimized for Microsoft Defender EDR. Upload, run, retrieve.
Logical folder structure with SHA256 hash manifest. Ready for parsing tools.
Works with Timeline Explorer, Eric Zimmerman tools, any forensic platform.
Works on Windows 10, 11, Server 2016+. Run locally or via Live Response.
Download latest