Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
Live-Forensicator — Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations. | Kitploit
Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.
Cross-platform Forensic Artifact Collector
Windows | Linux | macOS | Network Devices
Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review.
🤔 About
Live Forensicator is a cross-platform forensic artifact collector.
It is designed to help forensic investigators and incident responders rapidly collect system and user activity artifacts from a live host or device. The collected artifacts can be uploaded to Forensicator Core for analysis. The collector also bundles a built-in HTML report for quick triage along the way.
Live Forensicator:
Collects system and user activity artifacts, ready for Forensicator Core upload
Generates structured, investigation-ready HTML reports
Performs built-in triage — detects anomalous behavior and suspicious indicators, and highlights potential compromise or misconfiguration, on the spot
🧩 Forensicator Core
The collector gathers the evidence; Forensicator Core is where it gets analyzed. Core is the free, self-hosted DFIR platform that parses what this collector produces into structured, searchable findings, then enriches, correlates, and reports on them.
With Core you can:
Upload a whole Windows host folder in one step. Core routes each file to its parser and verifies its SHA-256 against the collector's CollectionManifest.
Parse the raw Windows artifacts collected with -WINARTIFACTS: registry hives with their transaction logs, Prefetch, $MFT/$UsnJrnl/$LogFile, SRUM, Windows Search, Defender quarantine, WER, BITS, WMI subscriptions, OneDrive logs, and more.
Analyze RAM captures (Volatility3), network captures (PCAP), and event logs (raw .evtx or the collector's Event XML channel exports).
Enrich IOCs automatically against VirusTotal, AbuseIPDB, OTX, URLhaus, ThreatFox, and MalwareBazaar.
Group investigations and hosts under Cases, correlate findings across uploads, and produce executive and technical reports.
Core runs with Docker or on a Linux machine or VM:
git clone https://github.com/Raptormatics/Forensicator-Core forensicator-core
cd forensicator-core
cp .env.docker.example .env # set NEXTAUTH_SECRET
docker compose up -d # then open http://localhost:3000
ℹ️ Core is source-available under the Business Source License 1.1. Each version converts to Apache 2.0 on its Change Date. See the Core repository's README for installation options and license details.
⚙️ Platform Support
🖳 Windows (PowerShell)
Windows Artifact Analysis collection (opt-in) — raw Shimcache/Amcache/Prefetch/UserAssist/BAM/Autoruns/LNK/Jump List/Shellbag/$MFT/$UsnJrnl/SRUM/Defender quarantine/WER/Windows Search database/Recycle Bin/Notifications/BITS/Windows Timeline artifacts, plus each registry hive's own .LOG1/.LOG2 transaction logs for Forensicator Core to replay into a more complete hive — all via a Volume Shadow Copy snapshot to reach locked registry hives, $MFT, $UsnJrnl:$J, SRUDB.dat, Windows.edb, wpndatabase.db, and ActivitiesCache.db
Advanced Event Log collection — System/Security/Application as raw .evtx, plus a configurable, richer channel list (Sysmon, Defender Operational, PowerShell, TaskScheduler, WMI-Activity, BITS-Client, RDP, etc.) exported as Core-ready single-line Event XML for Forensicator-Core's Log Analysis feature
Windows Defender tamper-protection state and current exclusion configuration, captured as standalone findings
Browser history extraction with IOC matching
Investigation archive + structured JSON output for Forensicator Core
Optional artifact encryption (AES)
Built-in triage: Sigma rule engine (1,400+ community rules, opt-in via config.json: sigma.enabled — off by default, since it's a real-time scan with meaningful runtime/log-query cost) evaluated against Security/Sysmon Event Logs, known-Event-ID detection, and malware hash matching (e.g., abuse.ch feeds)
Detection Insight - a summary of the detection, why it matters, the detection logic, what to look for, and its MITRE mapping
Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM, shown in the report's tooltip
Collection of key forensic artifacts (system, user, network, process, file), FileVault/SIP/Gatekeeper/TCC/Signed System Volume integrity state, and browser history
Investigation archive + structured JSON output for Forensicator Core
Optional artifact encryption (AES)
Built-in triage: detection engine covering reverse shells, SIP/Gatekeeper/kext tampering, PATH hijacking, deleted-binary execution, credential timestomping, and more
Best-effort Sigma rule engine sourced from real SigmaHQ community rules, evaluated against the unified log
Malware hash matching and browser history IOC matching, with auto-updating abuse.ch/URLhaus feeds
⚠️ Note: macOS restricts real process-creation telemetry to its Endpoint Security Framework, which a plain script cannot access — so Sigma coverage is narrower here than on Windows/Linux. See the macOS README for specifics.
🐧 Linux (Bash)
Cross-distro compatible Bash scripts, no non-native dependencies
LUKS disk-encryption status and credential-file tampering timeline collection
Structured JSON output for Forensicator Core
Optional artifact encryption (AES)
Built-in triage: detection engine covering reverse shells, timestomping, PATH hijacking, deleted-binary execution, package integrity, and more
Sigma rule engine sourced from real SigmaHQ community rules, evaluated against auditd and journald where available
Malware hash matching and malicious URL matching, with auto-updating abuse.ch/URLhaus feeds
⚠️ Note: Linux scripts are designed to avoid non-native utilities (e.g., net-tools) for maximum compatibility. Sigma coverage depends on whether auditd is already configured on the target box — see the Linux README.
johnng007/live-forensicator
