FastIR Collector
We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our new FastIR Artifacts collector instead. Concepts: This tool collects different artefacts on live Windows and records the results in csv or json files. With the analyses of these artefacts, an early compromission can be detected. Downloads: Binaries can be found in the release page of this project. Requirements: pywin32, python WMI, python psutil, python yaml, construct, distorm3, hexdump, pytz. Alternatively, a pip freeze output is available in reqs.pip. Compiling: To compile FastIR, you will need pyinstaller. Simply use pyinstaller pyinstaller.spec at the project root directory. The binary will by default be in /dist. Important: for x64 systems, check that your local python installation is also in x64. Execution: ./fastIR_x64.exe -h for help ./fastIR_x64.exe --packages fast extract all artefacts except dump and FileCatcher packages ./fastIR_x64.exe --packages dump --dump mft to extract MFT ./fastIR_x64.exe --packages all --output_dir your_output_dir to set the directory output (by default ./output/) ./fastIR_x64.exe --profile your_file_profile to specify a profile
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A library for accessing and parsing Windows NT Registry File (REGF) format files, designed for digital forensics and registry analysis applications.
A digital artifact extraction framework for extracting data from volatile memory (RAM) samples, providing visibility into the runtime state of a system.
A comprehensive incident response tool for Windows computers, providing advanced memory forensics and access to locked systems.
TestDisk is a free data recovery software that can recover lost partitions and undelete files from various file systems.
A command-line tool for creating hex dumps, converting between binary and human-readable representations, and patching binary files.
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
A library to access the Extensible Storage Engine (ESE) Database File (EDB) format used in various Windows applications.
Exterro is a data risk management platform that optimizes e-discovery, digital forensics, and cybersecurity compliance operations.
PINNED
A cybersecurity platform that offers vulnerability scanning, Windows Defender and 3rd party AV management, and MFA compliance reporting, among other features.
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.