FastIR Collector Logo

FastIR Collector

0
Free
Visit Website

We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our new FastIR Artifacts collector instead. Concepts: This tool collects different artefacts on live Windows and records the results in csv or json files. With the analyses of these artefacts, an early compromission can be detected. Downloads: Binaries can be found in the release page of this project. Requirements: pywin32, python WMI, python psutil, python yaml, construct, distorm3, hexdump, pytz. Alternatively, a pip freeze output is available in reqs.pip. Compiling: To compile FastIR, you will need pyinstaller. Simply use pyinstaller pyinstaller.spec at the project root directory. The binary will by default be in /dist. Important: for x64 systems, check that your local python installation is also in x64. Execution: ./fastIR_x64.exe -h for help ./fastIR_x64.exe --packages fast extract all artefacts except dump and FileCatcher packages ./fastIR_x64.exe --packages dump --dump mft to extract MFT ./fastIR_x64.exe --packages all --output_dir your_output_dir to set the directory output (by default ./output/) ./fastIR_x64.exe --profile your_file_profile to specify a profile

FEATURES

ALTERNATIVES

Analyzing WiFiConfigStore.xml file for digital forensics on Android devices.

A library to access the Extensible Storage Engine (ESE) Database File (EDB) format used in various Windows applications.

Dump iOS Frequent Locations from StateModel#.archive files.

Hoarder is a tool to collect and parse windows artifacts.

A framework for orchestrating forensic collection, processing, and data export.

A command-line utility and Python package for mounting and unmounting various disk image formats with support for different volume systems and filesystems.

A tool that uses graph theory to reveal hidden relationships and attack paths in an Active Directory environment.

Magnet ACQUIRE offers robust data extraction capabilities for digital forensics investigations, supporting a wide range of devices.

PINNED