johnng007/live-forensicatorCross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.
<h1 align="center">🛡️ Forensicator Artifact Collector 🛡️</h1>
<h3 align="center">
Cross-platform Forensic Artifact Collector<br>
Windows | Linux | macOS | Network Devices
</h3>
<p align="center">
Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review.
</p>
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://github.com/user-attachments/assets/22187cf0-5b12-4c44-8644-45405d393109">
<source media="(prefers-color-scheme: light)" srcset="https://github.com/user-attachments/assets/f30b9752-edd4-491f-b466-40d302e5c73c">
<img alt="Forensicator Logo" src="https://assets.kitploit.com/production/public/readmes/5164/e558befc3c2705c44e4bc82827fdee62ea13f12ce070a63886ea88041dead6c9.png" >
</picture>
---
## 🤔 About
**Live Forensicator** is a cross-platform forensic artifact collector.
It is designed to help forensic investigators and incident responders rapidly collect system and user activity artifacts from a live host or device. The collected artifacts can be uploaded to Forensicator Core for analysis. The collector also bundles a built-in HTML report for quick triage along the way.
Live Forensicator:
* Collects system and user activity artifacts, ready for Forensicator Core upload
* Generates structured, investigation-ready HTML reports
* Performs built-in triage — detects anomalous behavior and suspicious indicators, and highlights potential compromise or misconfiguration, on the spot
---
## 🧩 Forensicator Core
The collector gathers the evidence; **[Forensicator Core](https://github.com/Raptormatics/Forensicator-Core)** is where it gets analyzed. Core is the free, self-hosted DFIR platform that parses what this collector produces into structured, searchable findings, then enriches, correlates, and reports on them.
With Core you can:
* Upload a whole host folder in one step (Host Artifacts). Core routes each file to its parser and verifies its SHA-256 against the collector's CollectionManifest.
* Parse the raw Windows artifacts collected with `-WINARTIFACTS`: registry hives with their transaction logs, Prefetch, $MFT/$UsnJrnl/$LogFile, SRUM, Windows Search, Defender quarantine, WER, BITS, WMI subscriptions, OneDrive logs, and more.
* Parse the raw Linux and macOS artifacts collected with `-A`: accounts, sudoers, shell histories, SSH keys, cron, systemd or launch items, login items, code signatures, TCC privacy grants, downloads, FSEvents, processes and a filesystem timeline — with their logs sent to Log Analysis in the same case.
* Analyze RAM captures (Volatility3), network captures (PCAP), and event logs (raw `.evtx` or the collector's Event XML channel exports).
* Enrich IOCs automatically against VirusTotal, AbuseIPDB, OTX, URLhaus, ThreatFox, and MalwareBazaar.
* Group investigations and hosts under Cases, correlate findings across uploads, and produce executive and technical reports.
Core runs with Docker or on a Linux machine or VM:
```bash
git clone https://github.com/Raptormatics/Forensicator-Core forensicator-core
cd forensicator-core
cp .env.docker.example .env # set NEXTAUTH_SECRET
docker compose up -d # then open http://localhost:3000
```
👉 https://github.com/Raptormatics/Forensicator-Core
> ℹ️ Core is source-available under the Business Source License 1.1. Each version converts to Apache 2.0 on its Change Date. See the Core repository's README for installation options and license details.
---
## ⚙️ Platform Support
### 🖳 Windows (PowerShell)
* Raw artifact collection for Core's Host Artifacts (`-WINARTIFACTS`, opt-in) — raw Shimcache/Amcache/Prefetch/UserAssist/BAM/Autoruns/LNK/Jump List/Shellbag/$MFT/$UsnJrnl/SRUM/Defender quarantine/WER/Windows Search database/Recycle Bin/Notifications/BITS/Windows Timeline artifacts, plus each registry hive's own `.LOG1`/`.LOG2` transaction logs for Forensicator Core to replay into a more complete hive — all via a Volume Shadow Copy snapshot to reach locked registry hives, $MFT, $UsnJrnl:$J, SRUDB.dat, Windows.edb, wpndatabase.db, and ActivitiesCache.db
* Advanced Event Log collection — System/Security/Application as raw .evtx, plus a configurable, richer channel list (Sysmon, Defender Operational, PowerShell, TaskScheduler, WMI-Activity, BITS-Client, RDP, etc.) exported as Core-ready single-line Event XML for Forensicator-Core's Log Analysis feature
* Windows Defender tamper-protection state and current exclusion configuration, captured as standalone findings
* Browser history extraction with IOC matching
* Investigation archive + structured JSON output for Forensicator Core
* Optional artifact encryption (AES)
* Built-in triage: Sigma rule engine (1,400+ community rules, opt-in via `config.json`: `sigma.enabled` — off by default, since it's a real-time scan with meaningful runtime/log-query cost) evaluated against Security/Sysmon Event Logs, known-Event-ID detection, and malware hash matching (e.g., abuse.ch feeds)
* Detection Insight - a summary of the detection, why it matters, the detection logic, what to look for, and its MITRE mapping
* Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM, shown in the report's tooltip
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Windows
---
### 🍎 macOS (Shell)
* Raw artifact collection for Core's Host Artifacts (`-A`, opt-in) — Directory Services account records, launch items, login and background items, code signatures of running and persistent programs, TCC privacy databases, quarantine events (downloads), KnowledgeC, install history, XProtect detections, FSEvents, histories, a process table, unified log exports and a filesystem timeline, with a SHA-256 manifest
* Collection of key forensic artifacts (system, user, network, process, file), FileVault/SIP/Gatekeeper/TCC/Signed System Volume integrity state, and browser history
* Investigation archive + structured JSON output for Forensicator Core
* Optional artifact encryption (AES)
* Built-in triage: detection engine covering reverse shells, SIP/Gatekeeper/kext tampering, PATH hijacking, deleted-binary execution, credential timestomping, and more
* Best-effort Sigma rule engine sourced from real SigmaHQ community rules, evaluated against the unified log
* Malware hash matching and browser history IOC matching, with auto-updating abuse.ch/URLhaus feeds
* Application code-signature verification
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS
> ⚠️ Note: macOS restricts real process-creation telemetry to its Endpoint Security Framework, which a plain script cannot access — so Sigma coverage is narrower here than on Windows/Linux. See the [macOS README](https://github.com/johnng007/live-forensicator/blob/main/MacOS/README.md) for specifics.
---
### 🐧 Linux (Bash)
* Cross-distro compatible Bash scripts, no non-native dependencies
* Raw artifact collection for Core's Host Artifacts (`-A`, opt-in) — accounts, sudoers, PAM, login records, every user's histories and SSH files, cron/at, systemd and other persistence, logs with their rotations, a journal export, the process table (deleted executables recovered), sockets, packages, containers and a filesystem timeline, with a SHA-256 manifest
* LUKS disk-encryption status and credential-file tampering timeline collection
* Structured JSON output for Forensicator Core
* Optional artifact encryption (AES)
* Built-in triage: detection engine covering reverse shells, timestomping, PATH hijacking, deleted-binary execution, package integrity, and more
* Sigma rule engine sourced from real SigmaHQ community rules, evaluated against auditd and journald where available
* Malware hash matching and malicious URL matching, with auto-updating abuse.ch/URLhaus feeds
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Linux
> ⚠️ Note: Linux scripts are designed to avoid non-native utilities (e.g., `net-tools`) for maximum compatibility. Sigma coverage depends on whether `auditd` is already configured on the target box — see the [Linux README](https://github.com/johnng007/live-forensicator/blob/main/Linux/README.md).
---
### 🌐 Network Devices (Python)
* SSH-based collection via [Netmiko](https://github.com/ktbyers/netmiko) — Cisco IOS/IOS-XE, Cisco NX-OS, Arista EOS, Juniper Junos, and VyOS
* Read-only by design — every collected command is non-mutating; no configuration changes are ever made to a device
* Per-device error isolation and concurrent multi-device collection — one unreachable device never aborts the rest of the run
* Self-contained HTML report per device
* Optional AES-256-CBC artifact encryption
* Config-driven baselines — device inventory, per-rule toggles, and every rule's expected-value baseline are set in `config.json`, no code changes needed to tune a deployment
* Built-in triage: 21 detection rules covering unauthorized local accounts, insecure management plane (Telnet/weak SNMP/missing AAA), logic-implant persistence (EEM applets, task schedulers), boot-image and config-section tampering, NTP/syslog tampering, brute-force login patterns, unexpected SPAN sessions and tunnel interfaces, loosened ACLs, and device-to-C2 and transit-traffic-to-known-malicious-IP detection
* Detection Insight on every finding — plain-language explanation, MITRE ATT&CK mapping, and recommendations, same knowledge-base pattern as the Windows collector
* Optional Forensicator AI per-finding verdicts (Ollama/OpenAI/Azure OpenAI/Anthropic)
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Network
> ⚠️ Note: Talks to network infrastructure over SSH rather than running on the host being investigated — needs a reachable device. See the [Network README](https://github.com/johnng007/live-forensicator/blob/main/Network/README.md) for exact per-vendor command/rule coverage.
---
## 🔍 Key Features
* Cross-platform forensic artifact collection — Windows, Linux, macOS, and (over SSH) network infrastructure
* Structured HTML reporting (with dashboards)
* Optional artifact encryption (Windows, Linux, macOS, and Network Devices)
* Built-in triage on every platform — detection of suspicious activity and anomalies as artifacts are collected, not just after the fact
* Event Log analysis (Windows)
* Sigma rule integration on the three host platforms — coverage and data source vary by OS; see each platform's section below and its own README. Network Devices uses its own declarative rule engine instead (Sigma's process/event-log model doesn't apply to network-device config auditing) — see its README's Detection Rules section
* Malware hash and IOC matching, with auto-updating threat-intel feeds (host platforms); IP/CIDR threat-intel blocklist matching against device session tables (Network Devices)
* Detection Insight with Mitre Mapping
* Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM, on every platform
---
## 📊 Output
Forensicator generates:
* Clean, structured HTML report
* Indexed findings for easy navigation
* Extracted artifacts stored locally
* Detection insight into each finding.
* Suspicious activity statistics with Sigma Rules.
This enables fast transition from **data collection → investigation → decision-making**.
---
## ⚠️ Important Notes
* Run scripts with elevated/privileged permissions for best results
* Activity may trigger IDS/IPS alerts — this is expected behavior
* External threat intelligence (hashes, IOCs) may be updated during execution
* Configuration can be customized via `config.json`
---
## 🔐 Artifact Integrity & Encryption
Forensicator supports optional encryption of collected artifacts using AES.
This is useful when:
* Evidence must be transported securely
* Chain-of-custody concerns exist
* Legal integrity of artifacts must be preserved
> ⚠️ Available on Windows, Linux, macOS, and Network Devices
> ⚠️ Not backward compatible prior to v4.1.1
---
## 🤖 Forensicator AI
Off by default. When enabled, each finding is sent to a local or commercial LLM as it's collected, and gets a real, plain-language verdict shown right in the report's tooltip.
**Quick setup (local LLM via Ollama), on every platform:**
```bash
# 1. Install Ollama (https://ollama.com) and pull a model
ollama pull mistral:7b-instruct
```
```jsonc
// 2. Enable it in config.json
"ai": {
"enabled": true,
"provider": "ollama",
"base_url": "http://localhost:11434",
"model": "mistral:7b-instruct"
}
```
Prefer a commercial API instead (OpenAI, Anthropic, Azure OpenAI, or any OpenAI-compatible endpoint)? Set `provider` accordingly and add your `api_key`.
📘 Full setup guide (all providers, tuning, troubleshooting): <a href="https://docs.forensicator.io">docs.forensicator.io</a>
---
## 🧠 Built-in Triage
On top of collection, Forensicator identifies suspicious activity on the spot through:
* Event Log analysis
* Sigma-based detections
* Malicious hash matching
* IOC-based URL analysis (browser history)
* Network-device configuration auditing (21 rules) — unauthorized accounts, insecure management plane, persistence mechanisms, config tampering/drift, and known-malicious-IP matching against device session tables
---
## 📸 Screenshots
<details>
<summary>Terminal Output</summary>
<img width="765" height="1127" src="https://assets.kitploit.com/production/public/readmes/5164/b07e4f463a5561c49af805d84378c261bfa4c4749ae411ae126bcfae5b14bcf9.png" />
<img width="1398" height="390" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/1883e0d50c0cccd3fa10f7fb7d3f7c37f489f3ce7e6a92adeff41b7eb19fb116.png" />
</details>
<details>
<summary>HTML Dashboard</summary>
<img width="1392" height="913" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/6f0a49a053eaab567f3056cbd47b43030e60493618cfa30b5add98696c2ac1a2.png" />
<br>
<img width="1383" height="908" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/35854e996397262a4527e947e43ab5d72e40d9b991ff51c3730ae550d9549c27.png" />
<br>
<img width="1387" height="920" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/2a71ada8fa7f6b3245a65131c6aefa63b7010751cea8ada90e4b5d26c2cb26bc.png" />
<br>
<img width="1390" height="914" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/498d10d08c9f50218b8236fcab6bbbd57846329691e810c5c7de43beb8abc2de.png" />
<br>
<img width="1382" height="913" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/cdebaabb54a5eba4fb2e5ae4400aec2ab26f833f57659bccfdbbfab5c89ef67c.png" />
</details>
<details>
<summary>Terminal Output with Forensicator AI</summary>
<img width="1293" height="762" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/7c51b7848ea3ee55dd5fbd06f7015e0e35a847bf0f3bace5cc364047189c631c.png" />
</details>
<details>
<summary>AI Analysis</summary>
<img width="1731" height="955" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/a33eb55e8cb08be1c324bc263ba8cbd6156c755066478f3892ce1f71e2230473.png" />
<br>
<img width="1730" height="649" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/b80bdd3730e7fb9499c883bd27f7a72bddc5ba102e418a678b7cce4b0f231a94.png" />
<br>
<img width="1730" height="862" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/6b8d33540f109d88cf6992c11d612b681d0fa135b338f73f411837b3eed8b398.png" />
<br>
<img width="1729" height="860" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/15e5fac629302a366039a6c5ad6dce4344e17b965cc9e58b62a78d12cefc3db4.png" />
<br>
<img width="1728" height="854" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/17ec17c5848c986ba82a47122f6f0769dae3a5b39924fce5ffe62648d2655bce.png" />
<br>
<img width="1732" height="865" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/93215edfe5a83c3945017b1756c788ef776bdee8c1c85e58d542d8abd8b96131.png" />
<br>
<img width="1734" height="854" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/f06218a33fd2f3de66b6b32ccdd067604cfb1157093c0a5a1381a457491d8f14.png" />
<br>
<img width="1730" height="946" alt="image" src="https://assets.kitploit.com/production/public/readmes/5164/7166e9759650669320f5d52006754c61f5c03f7c3b657fe85952130c90ea6b5e.png" />
</details>
---
## ✨ Changelog
Full changelog:
👉 https://docs.forensicator.io/changelog/
```bash
Windows: v4.3.0 (October 2026)
- NEW: Windows Artifact Analysis collection (-WINARTIFACTS, opt-in) — collects the raw Shimcache/Amcache (SYSTEM hive, Amcache.hve), Prefetch (.pf), UserAssist/BAM (NTUSER.DAT), Registry Autoruns (SYSTEM/SOFTWARE), and LNK/Jump List/Shellbag (.lnk, .automaticDestinations-ms/.customDestinations-ms, UsrClass.dat) artifacts Forensicator's Windows Artifact Analysis feature parses server-side. Locked hives are read via a Volume Shadow Copy snapshot (created and removed automatically), falling back to reg.exe save for whatever's loaded if VSS isn't available.
- NEW: -WINARTIFACTS also collects $MFT and the $UsnJrnl:$J alternate data stream (plus its raw fsutil usn queryjournal metadata) and SRUDB.dat (the SRUM/System Resource Usage Monitor ESE database), along with the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions registry data needed to interpret it — all raw files/streams for offline analysis, not parsed by this script. $MFT, $UsnJrnl:$J, and SRUDB.dat are read via the same VSS snapshot as the locked registry hives; the journal metadata and SRUM registry data are read live and collected regardless of VSS.
- NEW: -WINARTIFACTS also collects Windows Defender quarantine files (Entries/ResourceData, both RC4-encrypted by Defender itself), WER reports and crash dumps (size-capped via config.json: werCrashDumps.max_dump_size_mb, default 500 MB), the Windows Search database (Windows.edb/Windows.db, read via VSS), Recycle Bin $I metadata files, the Notification platform database (wpndatabase.db/appdb.dat, read via VSS), and the BITS job database (qmgr0.dat/qmgr1.dat/qmgr.db) — all raw, best-effort, not parsed by this script.
- NEW: -EVTX now also exports a richer, analyst-configurable set of event channels (config.json: logChannels.channels — defaults to System/Security/Application plus Sysmon, Defender Operational, PowerShell, TaskScheduler, WMI-Activity, BITS-Client, and RemoteDesktop Operational) as single-line Event XML per line, ready for direct upload into Forensicator-Core's Log Analysis feature. The original raw .evtx export of System/Security/Application is unchanged. A missing channel (e.g. no Sysmon installed) is detected and skipped with a clear warning instead of silently exporting nothing.
- NEW: Windows Defender status check now also captures IsTamperProtected (tamper-protection-disablement evidence) and a separate current-exclusion-configuration finding (Get-MpPreference) — both collected unconditionally, not gated behind -WINARTIFACTS.
- NEW: -WINARTIFACTS also collects each registry hive's own `.LOG1`/`.LOG2` transaction logs (SYSTEM/SOFTWARE/SECURITY/Amcache.hve and the per-profile NTUSER.DAT/UsrClass.dat), alongside the hive — Forensicator Core replays their uncommitted "dirty page" transactions for a more complete/accurate hive before parsing.
- NEW: -WINARTIFACTS also collects the Windows Timeline database (ActivitiesCache.db, one per user profile, under a randomly-named ConnectedDevicesPlatform\<UUID>\ subfolder this globs for) — raw, for Core to interpret.
- CHANGE: Sigma rule scanning is now OFF by default (config.json: `sigma.enabled`) — it's a real-time scan of Security/System/Sysmon event logs against ~1,400 community rules with meaningful runtime/log-query cost, so it now requires an explicit opt-in, same posture as Forensicator AI's own `enabled` flag.
Linux: v4.3.0 (October 2026)
- NEW: -A / --artifacts raw artifact collection for Forensicator Core's Host Artifacts, with a SHA-256 CollectionManifest.
- FIX: -t timeline, -z update, detection tuning and IOC matching fixes; an earlier collection is moved aside, never deleted; -d finds the key file -e writes.
macOS: v4.3.0 (October 2026)
- NEW: -A / --artifacts raw artifact collection for Forensicator Core's Host Artifacts (account records, launch and login items, code signatures, TCC, downloads, KnowledgeC, XProtect, FSEvents, histories, processes, unified log exports, filesystem timeline), with a SHA-256 CollectionManifest.
- FIX: Report and detections no longer break on macOS's bash 3.2; -e now encrypts (and -d decrypts); real user accounts, every user's artifacts and Chrome/Firefox history are collected; RAM capture and Sigma report honestly; detections tuned for stock macOS.
```
---
## 🤝 Contributing
Contributions are welcome — see [CONTRIBUTING.md](https://github.com/johnng007/live-forensicator/blob/main/CONTRIBUTING.md) for repo layout, how to add a detection rule on each platform, and testing/PR guidelines. The short version:
* Open an issue to discuss major changes
* Submit pull requests with clear descriptions
* Focus on accuracy, clarity, and usability
Participation is governed by our [Code of Conduct](https://github.com/johnng007/live-forensicator/blob/main/CODE_OF_CONDUCT.md). Found a security vulnerability? Please report it privately — see [SECURITY.md](https://github.com/johnng007/live-forensicator/blob/main/SECURITY.md) rather than opening a public issue.
---
## 📄 License
Live-Forensicator is open-source software licensed under the **Apache License 2.0**.
Copyright © 2026 [Raptormatics LLC](https://raptormatics.com).
You are free to use, reproduce, modify, and distribute Live-Forensicator in accordance with the terms of the Apache License 2.0.
See the [`LICENSE`](https://github.com/johnng007/live-forensicator/blob/main/LICENSE) file for the full license text.
### Third-Party Components
Live-Forensicator may include or interact with third-party tools, libraries, scripts, or components that are distributed under their own licenses. Those licenses remain applicable to their respective components.
Users are responsible for complying with the applicable licenses and terms of any third-party components they use with Live-Forensicator.
---
## ☕ Documentation
<a href="https://docs.forensicator.io/collector/changelog/"> Documentation</a>