🛡️ Forensicator Artifact Collector 🛡️

Cross-platform Forensic Artifact Collector
Windows | Linux | macOS | Network Devices

Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review.

---

🤔 About

Live Forensicator is a cross-platform forensic artifact collector.

It is designed to help forensic investigators and incident responders rapidly collect system and user activity artifacts from a live host or device. The collected artifacts can be uploaded to Forensicator Core for analysis. The collector also bundles a built-in HTML report for quick triage along the way.

Live Forensicator:

• Collects system and user activity artifacts, ready for Forensicator Core upload
• Generates structured, investigation-ready HTML reports
• Performs built-in triage — detects anomalous behavior and suspicious indicators, and highlights potential compromise or misconfiguration, on the spot

---

🧩 Forensicator Core

The collector gathers the evidence; Forensicator Core is where it gets analyzed. Core is the free, self-hosted DFIR platform that parses what this collector produces into structured, searchable findings, then enriches, correlates, and reports on them.

With Core you can:

• Upload a whole Windows host folder in one step. Core routes each file to its parser and verifies its SHA-256 against the collector's CollectionManifest.
• Parse the raw Windows artifacts collected with -WINARTIFACTS: registry hives with their transaction logs, Prefetch, $MFT/$UsnJrnl/$LogFile, SRUM, Windows Search, Defender quarantine, WER, BITS, WMI subscriptions, OneDrive logs, and more.
• Analyze RAM captures (Volatility3), network captures (PCAP), and event logs (raw .evtx or the collector's Event XML channel exports).
• Enrich IOCs automatically against VirusTotal, AbuseIPDB, OTX, URLhaus, ThreatFox, and MalwareBazaar.
• Group investigations and hosts under Cases, correlate findings across uploads, and produce executive and technical reports.

Core runs with Docker or on a Linux machine or VM:

git clone https://github.com/Raptormatics/Forensicator-Core forensicator-core
cd forensicator-core
cp .env.docker.example .env    # set NEXTAUTH_SECRET
docker compose up -d           # then open http://localhost:3000

👉 https://github.com/Raptormatics/Forensicator-Core

ℹ️ Core is source-available under the Business Source License 1.1. Each version converts to Apache 2.0 on its Change Date. See the Core repository's README for installation options and license details.

---

⚙️ Platform Support

🖳 Windows (PowerShell)

• Windows Artifact Analysis collection (opt-in) — raw Shimcache/Amcache/Prefetch/UserAssist/BAM/Autoruns/LNK/Jump List/Shellbag/$MFT/$UsnJrnl/SRUM/Defender quarantine/WER/Windows Search database/Recycle Bin/Notifications/BITS/Windows Timeline artifacts, plus each registry hive's own .LOG1/.LOG2 transaction logs for Forensicator Core to replay into a more complete hive — all via a Volume Shadow Copy snapshot to reach locked registry hives, $MFT, $UsnJrnl:$J, SRUDB.dat, Windows.edb, wpndatabase.db, and ActivitiesCache.db
• Advanced Event Log collection — System/Security/Application as raw .evtx, plus a configurable, richer channel list (Sysmon, Defender Operational, PowerShell, TaskScheduler, WMI-Activity, BITS-Client, RDP, etc.) exported as Core-ready single-line Event XML for Forensicator-Core's Log Analysis feature
• Windows Defender tamper-protection state and current exclusion configuration, captured as standalone findings
• Browser history extraction with IOC matching
• Investigation archive + structured JSON output for Forensicator Core
• Optional artifact encryption (AES)
• Built-in triage: Sigma rule engine (1,400+ community rules, opt-in via config.json: sigma.enabled — off by default, since it's a real-time scan with meaningful runtime/log-query cost) evaluated against Security/Sysmon Event Logs, known-Event-ID detection, and malware hash matching (e.g., abuse.ch feeds)
• Detection Insight - a summary of the detection, why it matters, the detection logic, what to look for, and its MITRE mapping
• Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM, shown in the report's tooltip

👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Windows

---

🍎 macOS (Shell)

• Collection of key forensic artifacts (system, user, network, process, file), FileVault/SIP/Gatekeeper/TCC/Signed System Volume integrity state, and browser history
• Investigation archive + structured JSON output for Forensicator Core
• Optional artifact encryption (AES)
• Built-in triage: detection engine covering reverse shells, SIP/Gatekeeper/kext tampering, PATH hijacking, deleted-binary execution, credential timestomping, and more
• Best-effort Sigma rule engine sourced from real SigmaHQ community rules, evaluated against the unified log
• Malware hash matching and browser history IOC matching, with auto-updating abuse.ch/URLhaus feeds
• Application code-signature verification

👉 https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS

⚠️ Note: macOS restricts real process-creation telemetry to its Endpoint Security Framework, which a plain script cannot access — so Sigma coverage is narrower here than on Windows/Linux. See the macOS README for specifics.

---

🐧 Linux (Bash)

• Cross-distro compatible Bash scripts, no non-native dependencies
• LUKS disk-encryption status and credential-file tampering timeline collection
• Structured JSON output for Forensicator Core
• Optional artifact encryption (AES)
• Built-in triage: detection engine covering reverse shells, timestomping, PATH hijacking, deleted-binary execution, package integrity, and more
• Sigma rule engine sourced from real SigmaHQ community rules, evaluated against auditd and journald where available
• Malware hash matching and malicious URL matching, with auto-updating abuse.ch/URLhaus feeds

👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Linux

⚠️ Note: Linux scripts are designed to avoid non-native utilities (e.g., net-tools) for maximum compatibility. Sigma coverage depends on whether auditd is already configured on the target box — see the Linux README.

---

🌐 Network Devices (Python)