FastIR Collector Logo

FastIR Collector

0
Free
Visit Website

We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our new FastIR Artifacts collector instead. Concepts: This tool collects different artefacts on live Windows and records the results in csv or json files. With the analyses of these artefacts, an early compromission can be detected. Downloads: Binaries can be found in the release page of this project. Requirements: pywin32, python WMI, python psutil, python yaml, construct, distorm3, hexdump, pytz. Alternatively, a pip freeze output is available in reqs.pip. Compiling: To compile FastIR, you will need pyinstaller. Simply use pyinstaller pyinstaller.spec at the project root directory. The binary will by default be in /dist. Important: for x64 systems, check that your local python installation is also in x64. Execution: ./fastIR_x64.exe -h for help ./fastIR_x64.exe --packages fast extract all artefacts except dump and FileCatcher packages ./fastIR_x64.exe --packages dump --dump mft to extract MFT ./fastIR_x64.exe --packages all --output_dir your_output_dir to set the directory output (by default ./output/) ./fastIR_x64.exe --profile your_file_profile to specify a profile

FEATURES

ALTERNATIVES

A forensics tool for tracking USB device artifacts on Linux machines.

Autopsy is a GUI-based digital forensics platform for analyzing hard drives and smart phones, with a plug-in architecture for custom modules.

An open source digital forensic tool for processing and analyzing digital evidence with high performance and multiplatform support.

Toolkit for post-mortem analysis of Docker runtime environments using forensic HDD copies.

A framework/scripting tool to standardize and simplify the process of scripting favorite Live Acquisition utilities for Incident Responders.

Tool for analyzing Windows Recycle Bin INFO2 file

Python tool for remotely or locally dumping RAM of a Linux client for digital forensics analysis.

Tool for parsing NTFS journal files, $Logfile, and $MFT.