FastIR Collector
We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our new FastIR Artifacts collector instead. Concepts: This tool collects different artefacts on live Windows and records the results in csv or json files. With the analyses of these artefacts, an early compromission can be detected. Downloads: Binaries can be found in the release page of this project. Requirements: pywin32, python WMI, python psutil, python yaml, construct, distorm3, hexdump, pytz. Alternatively, a pip freeze output is available in reqs.pip. Compiling: To compile FastIR, you will need pyinstaller. Simply use pyinstaller pyinstaller.spec at the project root directory. The binary will by default be in /dist. Important: for x64 systems, check that your local python installation is also in x64. Execution: ./fastIR_x64.exe -h for help ./fastIR_x64.exe --packages fast extract all artefacts except dump and FileCatcher packages ./fastIR_x64.exe --packages dump --dump mft to extract MFT ./fastIR_x64.exe --packages all --output_dir your_output_dir to set the directory output (by default ./output/) ./fastIR_x64.exe --profile your_file_profile to specify a profile
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
Autopsy is a GUI-based digital forensics platform for analyzing hard drives and smart phones, with a plug-in architecture for custom modules.
Hindsight is a free tool for analyzing web artifacts from Google Chrome/Chromium browsers and presenting the data in a timeline for forensic analysis.
DMG2IMG is a tool for converting Apple compressed dmg archives to standard image disk files with support for zlib, bzip2, and LZFSE compression.
Modern digital forensics and incident response platform with comprehensive tools.
A tool for collecting and analyzing screenshots from remote desktop protocols, web applications, and VNC connections.
A recognition framework for identifying products, services, operating systems, and hardware by matching fingerprints against network probes.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.